The Insurer's Shadow AI Portfolio
Northwind Mutual is a 4,800-employee property and casualty insurer. Over 18 months, business units independently bought nine AI tools: underwriting triage, claims photo estimation, a broker chatbot, a fraud scoring add-on, and five others. Only three went through architecture review. There is no enterprise AI inventory, and one procurement contract lets the vendor train models on claims data. A market conduct examiner has asked for the AI inventory, human-oversight evidence, and vendor risk assessments within 45 days. The CIO wants a freeze on all AI activity until governance is fixed. The CRO argues a blanket freeze would ground a claims model that is reducing cycle time by 19%. The CDO says data lineage cannot be produced for four of the tools. Two business units have public ROI commitments. The board expects an 'AI governance framework' by Q3. You have one approved governance FTE, no new platform budget, and an AI steering committee that has met twice.
1. Diagnose the governance failure and recommend what to do in the first 45 days. Address the CIO's proposed freeze explicitly.
Read the worked answer
Root cause is not 'too much AI'; it is the absence of an intake and accountability system. Nine tools arrived through procurement, not through a governed portfolio. A blanket freeze would punish the one model with measured operational value and push the other eight further into shadow IT, where the examiner's questions get harder.
In the first 45 days: (1) Build the inventory from procurement, accounts payable, cloud spend, and a mandatory business-unit attestation; record purpose, data categories, vendor, population affected, human review, last validation, and contract data-use terms. (2) Tier the nine tools by customer impact, regulated decision, data sensitivity, and autonomy. (3) Suspend only tools that fail a minimum bar: no lawful data basis, no human oversight for an adverse decision, or vendor training on claims data without permission. (4) Assign a named business owner and model owner to each; the four tools without lineage get a documented data-map remediation date. (5) Create an interim approval path so new requests do not stall.
The freeze should become a conditional pause on new high-risk deployments, not all AI. That gives the CIO control without grounding the 19% cycle-time gain, and it gives the examiner evidence of a risk-based system rather than a panic response. The metric to report is not 'tools frozen' but 'tools with an owner, a risk tier, and an evidence pack.'
2. Design a right-sized governance model with one FTE and no platform budget. Specify decision rights, intake, and tiering, and explain the tradeoffs.
Read the worked answer
With one FTE, the governance lead cannot be the approver of everything; the role must be secretariat, standards owner, and escalation point. Use a three-tier model.
Tier 3 (high risk: underwriting, claims denial, employment, credit, health, or any customer-affecting decision) requires a full assessment, CRO and legal sign-off, and steering committee approval. Tier 2 (moderate: customer-facing but advisory, or internal decisions with appeal) uses a two-page intake, a checklist, and delegated approval by the governance lead plus the business-unit risk partner. Tier 1 (low: productivity, summarization, code assist with no customer data) is registered self-service with spot checks.
Reuse the existing GRC platform for intake and evidence; do not buy a new AI platform. Decision rights: business owner accountable for outcomes; model owner for performance; risk for independent challenge; steering committee for Tier 3 and policy exceptions.
The tradeoff is deliberate: Tier 1 and Tier 2 will have lighter evidence and some risk will be accepted, in exchange for coverage and speed. Do not let the committee become a review board for every chatbot. Publish a 10-day service-level target for Tier 2 and a 30-day target for Tier 3. Track inventory coverage, percentage of tools with named owners, approval cycle time, and exceptions, and report those to the board rather than a list of technologies.
3. What should the regulator response contain, and what should it not claim?
Read the worked answer
Respond with a dated, factual inventory, not a narrative of maturity. For each tool: name, business purpose, status (production, pilot, retired), population affected, data categories, vendor and hosting, whether the vendor trains on company data, human oversight, validation date, known incidents, and accountable executive.
Provide the evidence pack: approval records, vendor risk assessments, monitoring reports, training records, and complaint or appeal logs. Explicitly distinguish the three reviewed tools from the six that were not, and explain the interim controls now applied.
Do not claim full compliance, 'explainable AI,' or that no adverse decisions occur if a model triages claims. Do not claim the inventory is complete if four tools lack lineage; state the gap, the remediation owner, and the date. Avoid hiding behind 'the vendor's model'; as deployer, the company owns use and oversight. If legal privilege applies to internal reviews, provide the underlying facts and documents rather than a privileged summary.
Include a remediation plan with milestones at 30, 60, and 90 days, and name the executive accountable. The goal is to demonstrate control and candor, because an examiner who finds a gap you disclosed and scheduled is in a very different position from one who finds a gap you denied. Keep the response factual and consistent with what business units have already told the examiner.