The American Property Casualty Insurance Association told the NAIC's Third-Party Data and Models (H) Working Group that members find its vendor oversight plan unworkable, one of 23 comment letters filed on the December exposure (NAIC Spring National Meeting minutes, March 2026). The July 8 revision shows how far the letters carried: mandatory registration is gone, a voluntary NAIC-hosted registry replaces it, and the leverage now sits inside the rate filing.
Key Takeaways
- 23 comment letters moved the framework twice in seven months: six insurance functions became two, all lines of business narrowed to property and casualty, and the registration mandate disappeared entirely.
- No actuarial membership body filed. The Academy, the CAS and the SOA are absent from the posted file on a framework that decides how vendor models enter rate filings.
- A voluntary NAIC-hosted registry replaces state-by-state registration, with submissions held at the NAIC, which the draft notes "is not subject to open records laws in any state."
- The prohibition backstop did not move. A vendor that declines a regulator's information request can be barred from every P&C product in that state, registry entry or not.
- 95% of auto insurers and 85% of homeowners insurers use credit-based insurance scores where permitted, which leaves the filing lever weakest against the most embedded models.
What the Comment File Moved
The objections in the posted compilation are far less uniform than an industry-opposes framing suggests. APCIA's is the sharpest, warning that cumulative requirements would leave insurers with limited access because many vendors "may be unwilling or unable to comply," and that registration per dataset or model would duplicate existing oversight including the Fair Credit Reporting Act's insurance support organization regime. ACLI, whose 275 member companies hold 94% of U.S. life industry assets, said it is not aware of language in any insurance code authorizing a vendor registration regime.
The vendors wrote too, and none of them threatened to leave. Verisk's Insurance Services Office asked to narrow scope to underwriting and rating and to centralize registration in a single multistate process. LexisNexis noted some departments already accept direct third-party filings. MIB requested a carve-out for consumer reporting agencies, citing the FCRA's "maximum possible accuracy" standard and 30-day reinvestigation timelines. The NAIC's consumer representatives pushed the other way, asking that registration reach any vendor doing business with an insurer.
| Commenter | Core ask, February 2026 | Where the July 8 draft landed |
|---|---|---|
| APCIA | Rethink the framework; scope and definitions too broad | Scope cut to P&C pricing and underwriting, phase one |
| ACLI | Voluntary registration; drop data vendors | Registration voluntary; data vendors still in |
| AHIP, Microsoft | Exclude general-purpose AI model providers | Definitions tied to pricing and underwriting use, not tool type |
| AITC | Safe harbors; protect small vendors from fixed costs | No tiering yet; registration burden now optional |
| ISO/Verisk | Central multistate registration; stronger confidentiality | Single NAIC-hosted registry; NAIC holds submissions |
| MIB | FCRA carve-out for consumer reporting agencies | Registry labels vendors by existing status, no carve-out |
| Consumer representatives | Broaden registration to all insurer vendors; NAIC database | NAIC database adopted; scope narrowed instead of broadened |
The July 8 text abandons the three-step registration ladder in its first substantive bullet: vendors are "encouraged to voluntarily register through a shared multi-state registry" hosted at the NAIC. One sentence delivers ACLI's voluntary program, ISO's central multistate process and the consumer representatives' NAIC database. The attestation clause absorbed a regulator's point rather than a trade association's: Connecticut's Wanchin Chou told the Spring session that a CEO may lack the credentials to sign a governance attestation, and the annual sign-off now must come from "a senior leader with relevant technical expertise" holding formal authority over data and model governance.
The Leverage Moved Into the Rate Filing
What the working group did not concede is enforcement. Where a third-party model or dataset is used, it "must be filed in either the insurer's own filing or as a separate filing submitted directly to the regulator, as requested by the regulator," and a vendor's failure to provide requested information "may result in the regulator prohibiting insurers from using the data and/or model" for any P&C product in the state. Registration became voluntary; cooperation did not. The statutory-authority objection that ACLI, AHIP and APCIA all raised was answered not by claiming authority over vendors but by routing around them.
For a filing actuary the operative sentence is the fallback for states with limited filing authority: where a state cannot approve a vendor's model separately, the model "will be evaluated as if it is part of an insurer's filing with the expectation that the insurer demonstrates the use of the data or model produces actuarially sound rates." That converts vendor opacity into the signing actuary's problem by construction. It is the same accountability clause that has survived every round, restated as a filing standard rather than a principle.
Test APCIA's walk-away warning against the actual dependency structure. FICO estimates roughly 95% of auto insurers and 85% of homeowners insurers use credit-based insurance scores where the factor is legally permitted (Illinois Department of Insurance, citing FICO). Catastrophe models sit under coastal property indications and reinsurance purchases, with Karen Clark & Company's U.S. hurricane model Version 5.0 certified by the Florida Commission in June 2025. In personal lines, third-party inputs largely are the pricing stack.
That penetration constrains the new lever more than it constrains the vendors. Prohibiting a model one carrier relies on is a routine filing objection; prohibiting one embedded across most of a state's market would disrupt the policyholders the prohibition protects. The filing lever is strongest against narrowly deployed models and weakest against systemically embedded ones, which is backwards relative to where concentration risk actually sits. Carriers running vendor scores through MGA and program intake inherit the lineage problem on top of it, as the site's submission-intake analysis set out.
Oversight Already Exists, Model by Model
The duplication objection carries more actuarial substance than most of the file. The American InsurTech Council told the working group that more than half the states already let third-party data vendors file the models carriers use in personal lines directly for inspection, and NAMIC told the Spring session that some jurisdictions accept model filings from non-licensed entities through SERFF. Florida has run a standing review commission for hurricane loss models since 1995, and it now certifies flood models too, having accepted KCC's flood model in November 2024.
Licensed advisory organizations such as ISO are examined under state rating law, and the framework's definitions exclude any licensee from the vendor category outright.
Model by model, then, the industry is right that almost everything important gets reviewed somewhere. What no existing mechanism supplies is the cross-sectional view. The Florida commission audits a hurricane model's science; it does not know which Ohio homeowners writers depend on it. A SERFF filing shows one state one carrier's use; it does not show that forty carriers in thirty states run the same score. The revision's stated purpose, comprehensive awareness of the third parties playing a material role in pricing and underwriting, targets the aggregation gap rather than the review gap.
One clause moved in the opposite direction from every other concession. The registry will record not only who the vendors are but "which insurers have purchased data and/or models," labelling each vendor's existing status such as insurance support organization or licensed advisory organization. Client lists are commercially sensitive in a way governance documents are not, and no February letter anticipated disclosing them. It is also the one instrument aimed at the inversion above, letting a regulator see embeddedness before deciding how hard to pull.
The docket now supplies its own base rate. In December 2025 Fenwick's regulatory tracker anticipated a model law on third-party oversight, potentially including vendor licensing. Two structural retreats later, the compliance surface is the rate filing and the person who signs it. The strongest actuarial idea in the whole file came from a regulator in Connecticut, on the question of which credentials that signature requires, and no actuarial body filed a word about it.
Further Reading
- NAIC Vendor Registry: Third-Party Model Documentation and the Actuary Workflow Shift: the registered-versus-unregistered documentation asymmetry this revision now resolves through the filing process.
- NAIC Third-Party AI Framework Keeps Carrier Accountability: the accountability clause that survived both comment rounds, and the contract rights carriers need before adoption.
- NAIC Proposes Third-Party AI Vendor Registry for Insurers: the December draft's structure, the SR 11-7 banking parallel, and the original five objections.
- MGA AI Submission Intake and Data Lineage: why untraceable third-party inputs in delegated underwriting become a filing defense problem.
Sources
- NAIC, Third-Party Data and Models (H) Working Group (accessed July 2026)
- NAIC, Regulatory Framework for Third-Party Data and Model Vendors, P&C Pricing and Underwriting Data and Models, exposed July 8, 2026
- NAIC, Third-Party Regulatory Framework Comment Letter Compilation (February 2026)
- NAIC, Third-Party Data and Models Working Group Materials and Minutes, Spring 2026 National Meeting (March 23, 2026)
- NAIC, Third-Party Data and Models Working Group Agenda, 2026 Summer National Meeting (August 12, 2026)
- NAIC, Third-Party Regulatory Framework Exposure Draft (December 9, 2025)
- Illinois Department of Insurance, Credit: How Insurers Use It
- Karen Clark & Company, KCC US Hurricane Model Version 5.0 Certified by the Florida Commission on Hurricane Loss Projection Methodology (June 2025)
- Karen Clark & Company, KCC Flood Model Certified by Florida Commission on Hurricane Loss Projection Methodology (November 2024)
- Fenwick, Tracking the Evolution of AI Insurance Regulation (December 2025)