The NAIC's Third-Party Data and Models Working Group advanced a vendor registration framework on March 23, 2026 that requires disclosure of training data sources and date ranges for every model touching pricing, underwriting, claims, utilization review, marketing, or fraud detection.

The framework is arriving into a market where most carriers cannot answer the question. Survey work puts the share unable to trace where their training data originated at 77%, and agentic systems need exactly the interaction data that privacy law protects most closely.

Key Takeaways

  • 77% of organizations cannot trace where training data originated. Seventy-eight percent cannot validate data before it enters an AI training pipeline, and fifty-three percent have no mechanism to recover or remove training data after an incident.
  • Registration creates no safe harbour. Carriers remain accountable for the behaviour of models they deploy, so the registry mainly gives regulators a baseline against which to read a carrier's own due diligence file.
  • Twenty-two percent of insurers plan an agentic AI solution in production by year-end 2026 per Celent, and agentic systems train on conversation sequences and document chains rather than tabular loss data.
  • MAPFRE lifted fraud detection recall by 31% on synthetic data, worth an estimated $310,000 per 100 fraudulent claims identified, using CTGANs to fill in a rare-event class real data could not populate.
  • Differential privacy is a stated tradeoff, not a free one. A triage model routing 95% of claims correctly at epsilon 3.0 can fall to 88% at epsilon 1.0.

What the Framework Asks For

The registration regime covers models with direct consumer impact and asks each registered vendor for the same short list: model description and intended use, training data sources and date ranges, documented testing methodology including bias testing, known limitations with supported and unsupported use cases, change-management practices, and a contact for regulator inquiries. First state implementations are expected in late 2026 or early 2027, with NAIC adoption anticipated at the November 2026 Fall National Meeting.

The item that changes carrier behaviour is the second one. Model architecture is already described in rate filings; provenance generally is not. Filings citing machine learning models have referenced "historical claims data from 2018-2023" without specifying anonymization procedure, consent basis, or representativeness testing.

Running alongside it, the 12-state AI Systems Evaluation Tool pilot covers March through September 2026, and its Exhibit D examines data sources, quality controls, representativeness, and potential for proxy discrimination on each high-risk system.

State law is converging on the same disclosure. Twenty US states have comprehensive privacy laws in effect as of March 2026, and California's AB 2013, effective January 1, 2026, requires publicly accessible generative AI systems trained on personal information to publish dataset disclosures covering sources, data types, and personal information content.

Provenance Cannot Be Reconstructed, Only Recorded

The reason 77% cannot trace origin is architectural rather than negligent, and it determines what the fixes can and cannot do.

A carrier assembling an agentic claims handler pulls from several sources at once: adjuster notes, call transcripts recorded under consent frameworks that vary by state, vendor-supplied scenarios, public filings, and policyholder correspondence subject to state retention limits. Lineage metadata is not captured at ingestion, because the tooling to capture it does not exist in most carrier data environments. Privacy review, where it happens, happens after the dataset is assembled.

That ordering is why seventy-eight percent cannot validate data before it enters a training pipeline while fifty-three percent cannot remove it afterwards. The window in which the record could have been made has closed.

Both leading remedies work by never creating the problem. Synthetic generation produces artificial records preserving the statistical structure of real data without containing real policyholders. MAPFRE used CTGANs through the Synthetic Data Vault to augment property fraud claims, a rare and costly class, lifting detection recall 31% at an estimated $310,000 per 100 fraudulent claims identified. Gartner projects 40% of insurer AI algorithms will use synthetic data by 2027 to support fairness and compliance.

Federated learning moves the model to the data instead, sharing only encrypted parameter updates. The Society of Actuaries demonstrated the loss modelling case with Colorado State University in 2024, and ASTRI published a working platform with the Hong Kong Insurance Authority in November 2025. In practice the two are layered rather than chosen between.

Training Data TypePrimary TechniqueDocumentation Artifact
Claims conversations and transcriptsSynthetic generation (transformer-based)Generation methodology report, distributional validation, bias testing results
Underwriting submission patternsDifferential privacy (epsilon 2.0-4.0)Privacy budget allocation, utility-privacy tradeoff analysis
Cross-carrier loss modeling dataFederated learningFederation protocol, parameter aggregation method, no-data-movement attestation
Policyholder demographic featuresSynthetic generation with representativeness constraintsDemographic parity testing, four-fifths rule validation
Historical pricing and rating dataStatistical simulation (copula-based)Distributional fit tests, tail behavior validation

For a pricing actuary the consequence is a number, not a posture. Differential privacy states its cost explicitly through the privacy budget: a claims triage model routing 95% of claims correctly at epsilon 3.0 can fall to 88% at epsilon 1.0. Synthetic approximation error and federated convergence gaps add uncertainty of the same kind without stating it as cleanly. Prediction intervals on a privacy-preserved model are wider than on the unrestricted one, and that widening belongs in the actuarial memorandum supporting the filing rather than in the model documentation alone.

Neither Remedy Covers the Whole Corpus

The gap in both fixes is the part of the training data that makes an agent an agent.

Synthetic data addresses privacy and leaves representativeness untouched. A synthetic set that faithfully reproduces the statistical properties of a carrier's historical book reproduces whatever the book underrepresented, and Exhibit D screens for exactly that. The NAIC's bias testing requirement does not distinguish real training data from synthetic, so a carrier asserting that synthetic data eliminates privacy risk has answered one exhibit and not the other. The defensible position documents both that the set contains no real policyholder and that the generation process was validated against representativeness benchmarks.

Federated learning fits structured prediction well and conversational behaviour poorly. Loss modelling, fraud scoring, and routing classifiers distribute cleanly. Multi-turn claims conversations and document-processing sequences need full interaction context, which federated architectures can carry but with real complexity in maintaining sequence coherence across training rounds. Most carriers deploying agentic AI will use federated learning for some components and synthetic data for others.

What is left over is real policyholder interaction data, and the enforcement record shows the cost of collecting it without a provenance architecture. The Texas Attorney General's January 2025 action against Allstate and Arity alleges collection of trillions of miles of location data from over 45 million consumers through tracking software embedded in third-party apps, used both to underwrite Allstate policies and sold on to other carriers, with a federal class action proceeding alongside. Under the registration framework, a vendor in that position would have to disclose those sources and collection methods on the same short list as everyone else.

Further Reading

Sources