Explainable Boosting Machines, an additive architecture from Microsoft Research that carries its explanation inside the model's own structure rather than generating one afterward, are appearing in P&C rate filings as Colorado's July 1, 2026 algorithm-governance deadline and 23-state adoption of the NAIC Model Bulletin turn explainability into an enforceable filing requirement.

A gradient-boosted model wrapped in SHAP and an EBM producing the identical prediction both claim to explain themselves. Only one is explaining a decision it actually made.

Key Takeaways

  • July 1, 2026 was the full compliance date under Colorado's Amended Regulation 10-1-1, not the June 30 date attached to the state's general AI Act, which was blocked in April and replaced.
  • Exhibit C of the twelve-state AI Systems Evaluation Tool asks for model architecture, training data, validation procedures and bias testing results. A SHAP summary plot answers a different question.
  • Shape functions are the model. An EBM's per-variable curves can occupy the same exhibit position a GLM relativity table does, and its pairwise interactions arrive as heatmaps the fitting process produced.
  • A point or two of Gini is smaller than the swing a single accident year of new claims produces in fitted relativities at the next review. A deficiency notice is a filing delay measured in months.
  • One-third of health insurers do not regularly test AI and ML models for bias or discrimination. No model architecture closes that gap on its own.

The Deadline That Actually Binds

Coverage of Colorado's AI law has largely tracked the wrong statute for insurance purposes. The broad consumer-facing AI Act, SB24-205, was headed toward a June 30, 2026 effective date before a federal magistrate blocked enforcement in late April 2026 after a constitutional challenge. The legislature's May replacement, SB189, pushed the general law to January 1, 2027 and narrowed it from a duty-of-care and impact-assessment regime to a disclosure-based one.

The regulation binding P&C and health insurers this year is Amended Regulation 10-1-1, the Division of Insurance's governance and risk management framework for external consumer data, algorithms and predictive models, which expanded from life insurers to private passenger auto and health benefit plan insurers effective October 15, 2025. Auto and health insurers filed an interim progress report by December 1, 2025, and full compliance, including a written report on governance, quantitative bias testing and remediation of any unfair discrimination detected, was due July 1, 2026, annually thereafter.

The national layer sits on top of that. The NAIC Model Bulletin, adopted in December 2023 and now in force in 23 states plus the District of Columbia, names "lack of transparency and explainability" directly as a consumer risk AI systems can introduce, and instructs insurers to calibrate controls to "the transparency and explainability of outcomes to the impacted consumer".

The AI Systems Evaluation Tool pilot running January through September 2026 across twelve states, Colorado, California, Connecticut and Illinois among them, operationalizes that. Exhibit C asks for model architecture, training data, validation procedures and bias testing results for each high-risk system, which puts an examiner in the position of assessing whether a filing's explanation describes the model or a proxy for it.

What an EBM Computes

An Explainable Boosting Machine is a generalized additive model: an intercept plus one learned function per feature, plus a small set of pairwise interaction terms. Each per-feature function is a shape function fitted from data rather than a linear coefficient assumed by the modeler.

The architectural trick is how those functions get fitted. Instead of one regression spline per feature, the EBM uses an ensemble of shallow bagged trees boosted in strict round-robin fashion, one feature at a time, at a deliberately low learning rate. That cyclic, feature-isolated procedure stops any one variable's tree from absorbing signal belonging to a correlated variable, which is the failure mode making a full gradient-boosted model's feature attributions unstable and order-dependent.

The distinction regulators are drawing is between post-hoc explanation and intrinsic interpretability, and it is not semantic. SHAP and LIME analyze feature contributions after the model has produced its output, fitting a simplified, locally linear approximation around each prediction. An EBM's shape functions are the computation. Nothing is approximated afterward because nothing more complex was computed.

That maps onto a filing directly. Where a GLM filing shows factor levels and relativities by rating variable, an EBM filing shows the shape function itself, plotted against the variable's full range, in the same exhibit position. Interactions that a black-box model would require a separate SHAP interaction-value analysis to discover arrive instead as a heatmap the fitting process produced, collapsing the technical plot and the regulatory narrative translating it back into one exhibit.

The accuracy question is smaller than it is usually framed. Microsoft Research describes EBM accuracy as "comparable to state-of-the-art machine learning methods such as Random Forest and Boosted Trees", and a March 2025 study applying EBMs to car insurance claim frequency and severity evaluated out-of-sample accuracy with Murphy diagrams and Bregman-dominance tests rather than one headline metric. A 2023 CAS E-Forum paper comparing GLM, an interpretable GLM variant, XGBoost and neural networks for auto pure premium found explainability and implementation costs, not predictive lift, were the binding constraint. A point or two of Gini sits inside the noise band the next indication re-estimates anyway. A deficiency notice does not.

What Interpretability Does Not Fix

An EBM is still trained on the same claims and policy data as any other pricing model, and it inherits every problem that data carries. Making a bad relationship visible is not the same as making the underlying data better.

Concept drift is indifferent to architecture. An EBM's shape functions go stale the same way a GLM's relativities or a boosted model's learned splits do when the risk distribution shifts, so the monitoring discipline a pricing pipeline needs applies whether the model at its center is a black box or not.

An interaction legible to an actuary is also not automatically sound. Surfacing a ZIP-code-by-credit-score interaction is a precondition for judging whether it functions as a race proxy, not a substitute for making that judgment. Every shape function still needs the same feature-to-filed-factor justification a GLM factor would, and an automatically detected interaction can surface a proxy relationship as readily as a hand-built term can. Intrinsic interpretability makes the review possible and does not make it unnecessary. Against AI usage rates as high as 92% for health insurers and 88% for auto insurers, and one-third of health insurers not regularly testing for bias, architecture is the smaller half of the problem.

Migration is not always the right answer either. For a carrier writing only in lighter-enforcement states, an existing XGBoost model with well-built SHAP and partial dependence documentation remains a defensible filing position, and rebuilding a production pricing pipeline carries a real implementation timeline. The calculus changes for a high-risk model filed in Colorado, Illinois or Connecticut, for any carrier inside the evaluation tool pilot, and for a new build where the architecture decision is still open. Those are the cases where the prior explainability layer may not survive the exact scrutiny Exhibit C was written to apply.

Further Reading

Sources