ARM (The Institutes Insurance Designations): Deploying a Vendor AI Triage Model in Six Weeks

Recommendation: do not launch as proposed on the six-week schedule. The schedule is a project artifact, not a risk decision. Three findings independently warrant delay or a materially restricted launch.

Finding 1: the disparity is unexplained, and the vendor's denial is not an analysis. ZIP code not being a named input does not answer a proxy-discrimination question; it is the classic form of it. A 2.3x decline rate needs feature-level attribution to determine whether legitimate risk factors explain it or whether correlated features are doing the prohibited work. You cannot underwrite that answer to a regulator on the strength of a vendor assurance.

Finding 2: training data is stale relative to the portfolio. The model was trained on 2019-2022 data and two lines have since been exited. The population it learned from is not the population it will score. That is a model validity problem before it is a fairness problem, and it affects the 12% auto-decline rate.

Finding 3: the contract cannot support a governance program. No audit rights, no drift monitoring, and a liability cap at 12 months of fees means the company retains all model risk while holding none of the levers.

Decisions and owners:

• The model risk committee (or board risk committee) owns the go/no-go, not the business line and not the vendor.
• Legal and compliance own the state-by-state filing, notice, and adverse action implications.
• The business owner must accept in writing the residual risk.

Viable paths: delay; or a restricted launch in a small number of states with zero auto-declines and 100% human review, which preserves learning while removing the automated harm.

Before launch (validation and documentation):

• Independent validation, not vendor self-attestation: discrimination and calibration testing, a feature-level attribution of the 2.3x disparity, and a search for a less discriminatory alternative that performs comparably.
• Retrain or revalidate on post-2023 data reflecting the current portfolio.
• Documented feature inventory, reason codes, and an explainability method that can generate defensible adverse action reasons.
• Defined model tier and owner; approved model risk policy; a documented kill switch and rollback plan.
• Human-in-the-loop for all declines at launch, with override data captured.

After launch (monitoring):

• Monthly: decline rate, override rate and override outcomes, segment-level approval rates, score distribution stability (PSI) against the validation baseline, complaint volume and content.
• Quarterly: disparate impact re-test on actual decisions, challenger model comparison, threshold review with the 12% target re-set against loss experience rather than inherited from the pilot.
• Annual: full revalidation, retraining decision, and independent review.

Contract terms that must change:

• Audit rights directly and through a third party, on reasonable notice.
• Documented disclosure of features, weights, and any change to them; sub-versioning so silent model updates are impossible.
• Contractual drift-monitoring reports at defined intervals.
• Data ownership, permitted use, security, and breach notification.
• Liability cap consistent with the size of the decision, plus indemnity where the vendor's representations are wrong.
• Termination, transition assistance, and source-code or documentation escrow.

Answer structure. Do not lead with the fact that ZIP code is not an input; that answer is technically true, unresponsive, and invites the next question.

1. Governance: who approved the model, what validation it received, who owns it, and what authority can suspend it.
2. Method: what the model does (triage, not final adjudication), what data it uses, and how features were selected.
3. Testing: describe the disparate-impact testing performed, the specific results including the 2.3x finding, and what was done about it. Volunteering a known result with a remediation plan is far stronger than having the regulator discover it.
4. Mitigation: human review of declines, adverse action reason codes, override capture, monitoring frequency, and revalidation date.
5. Business justification and alternatives: why the factors used are predictive of risk, and what less discriminatory alternatives were considered and why they were rejected.

Suspension triggers (write them down before launch):

• Disparate impact exceeding a pre-agreed threshold in any segment for two consecutive months.
• Population stability index above the agreed limit, or an unexplained shift in the decline rate.
• Any material vendor model change without notice, or loss of audit access.
• Adverse action notices found to be inconsistent or unexplainable in audit sampling.
• A complaint pattern indicating a segment is being systematically declined.

Pre-committing to triggers is what turns a monitoring dashboard into a control. A metric nobody is obligated to act on is decoration.