When AI is Outsourced: What Regulators Need to Know About Oversight of Third-Party Administrators
An insurer may outsource an operational function, but it cannot outsource its responsibility for meaningful oversight or the regulatory consequences of how that function is performed. As third-party administrators (TPAs) increasingly incorporate artificial intelligence (AI), automated decision-making, analytics, and other technology-enabled processes into insurance operations, regulators face an important question: How can an insurer demonstrate meaningful oversight of technology it may not directly own, operate, or fully understand?
This question is becoming more important as AI is used to support claims administration, policy servicing, premium processing, customer communications, complaint handling, fraud detection, utilization management, and other consumer-facing or compliance-sensitive activities. These tools may improve speed, consistency, and operational efficiency, but they can also introduce or amplify risks involving accountability, data quality, unfair discrimination, explainability, privacy, cybersecurity, model performance, system access, and the timely identification and correction of compliance issues.
For example, a TPA may use an automated tool to classify incoming claims, identify potentially fraudulent activity, or generate consumer correspondence. Even if the tool does not make the final claims determination, errors in classification, escalation, or generated explanations may affect claim timeliness, consistency, complaint volume, or the accuracy of information provided to consumers. Third-party arrangements can create a gap between responsibility and control. The insurer may remain accountable for the regulated activity while having limited visibility into the administrator’s data, systems, models, subcontractors, testing protocols, monitoring activities, or change-management practices. For regulators, the question is therefore not only whether the insurer has contractual oversight rights, but whether the insurer can and does use those rights to obtain reliable information, evaluate risk, and take corrective action when needed.
A regulatory review of AI governance should be grounded in the insurer’s legal obligations, the nature and risk of the AI-enabled activity, the degree of reliance on third parties, and the potential effects on consumers, operations, financial reporting, and market outcomes. The review should be risk-based, proportionate, and aligned with the scope of the regulator’s authority. Scoping should consider inherent and residual risk, materiality, direct consumer impact, material financial or financial-reporting impact, data sensitivity, autonomy, reversibility, provider dependency, and whether the system automates, augments, or merely supports decision-making. The review should also distinguish among binding statutory or regulatory requirements, jurisdiction-specific guidance, voluntary frameworks, and developing examination or audit resources.
Several resources can inform a regulator’s review, including the National Association of Insurance Commissioners (NAIC) Model Bulletin on the Use of Artificial Intelligence Systems by Insurers,[1] the National Institute of Standards and Technology (NIST) AI Risk Management Framework,[2] NIST’s Generative AI Profile,[5] and third-party AI risk resources published by the Information Systems Audit and Control Association (ISACA).[8] The NAIC’s draft Artificial Intelligence Risk Evaluation Supplement also serves as a developing, optional examination resource, although it is not a binding standard.[7] These resources differ in purpose, legal effect, and scope, but they reflect common oversight themes: governance and accountability, risk identification, control design, compliance, transparency, third-party management, documentation, monitoring, auditing, reporting, and remediation.
In the context of third-party administrators, a regulator’s review should look beyond the existence of an AI policy. The review should consider whether the insurer has identified outsourced AI-enabled activities, assigned accountable internal ownership, assessed inherent and residual risks, implemented appropriate contractual and operational controls, maintained sufficient reporting and audit rights, monitored performance and complaints, and addressed deficiencies or vendor-related control gaps through timely escalation and remediation.
Why Third-Party AI Oversight Requires More Than a Contract
Insurance-specific AI expectations increasingly focus on demonstrable governance rather than the mere existence of policy language. The NAIC Model Bulletin states that consumer-impacting decisions supported by AI remain subject to applicable insurance laws and describes the governance, risk-management, internal-control, documentation, testing, and third-party oversight information a department may request during an investigation or examination.[1] This approach is consistent with the NIST AI Risk Management Framework, which organizes voluntary risk-management activity around Govern, Map, Measure, and Manage and treats governance as a cross-cutting function throughout the AI life cycle.[2]
State approaches also illustrate why a one-size-fits-all review is insufficient. Colorado’s amended Regulation 10-1-1, effective October 15, 2025, establishes governance and risk-management requirements for specified life, private passenger automobile, and health benefit plan insurers using external consumer data and information sources, as well as algorithms and predictive models that use such data, in insurance practices.[3] New York Department of Financial Services Circular Letter No. 7 addresses AI systems and external consumer data used in underwriting and pricing and emphasizes discrimination testing, actuarial validity, governance, transparency, internal controls, and third-party vendor oversight.[4] Accordingly, regulators should first identify the applicable legal authority and line of business, then tailor the scope, evidence requests, and testing to the risk presented by the outsourced activity.
Regulators do not necessarily need to begin with a highly technical model review. A practical starting point is to determine whether the insurer can explain where and how its third-party administrators use AI-enabled tools, how those tools affect regulated activities or consumer outcomes, and what evidence supports the insurer’s oversight. If an insurer cannot identify the tools in use, describe the related risks, or produce documentation showing active monitoring, it may be difficult to demonstrate effective oversight.
When regulators use external specialists to supplement an AI governance or TPA oversight review, the work should remain grounded in the regulator’s authority, documented evidence, and the risks associated with the specific activities under review. External specialists can provide technical and subject-matter expertise to assist with review planning, targeted information requests, assessments of governance and control documentation, evaluations of administrator contracts and monitoring practices, and the organization of findings. Any conclusions, however, should remain tied to applicable legal authority, the insurer’s specific use of AI or reliance on outsourced operations, and the evidence obtained during the review.
These themes can be translated into practical oversight questions that help regulators
assess whether an insurer’s TPA governance is operating effectively.
What Questions Should Regulators Be Asking?
These oversight themes can be translated into the following examination and inquiry questions. The insurer’s responses should be supported by records, testing, and evidence of operating effectiveness—not solely by policy statements or contractual assurances.
Where is AI used? Has the insurer identified AI systems, automated decision tools, predictive models, generative AI, and embedded vendor functionality used by the TPA or its subcontractors? The review should account for AI that may be added through a software update, embedded within a larger platform, introduced by a subcontractor, used informally by employees, or described by the vendor as analytics or automation rather than AI.
Which uses are material? Which tools can materially affect consumers, regulated decisions, claims outcomes, pricing, eligibility, timeliness, explanations, complaint handling, or regulatory reporting?
Who is accountable? Who owns, approves, validates, and monitors each use, and who has authority to suspend, restrict, or discontinue it? Is the insurer aware of their responsibility and working to ensure that accountable internal ownership is in place despite outsourcing?
What data drives the outcome? Can the insurer demonstrate data lineage, provenance, quality, permitted use, retention, and controls over external data and potential proxies for protected characteristics?
How are risks classified, considered, and tested across the lifecycle? How are inherent and residual risk, materiality, consumer and financial impact, autonomy, reversibility, accuracy, reliability, robustness, explainability, privacy, cybersecurity, unfair discrimination, human oversight, and model or data drift evaluated before deployment, after material changes, and on an ongoing basis? Do these controls address acquisition, implementation, and monitoring? Are processes in place to support AI rollback, suspension, and ultimately retirement?
How are vendors governed? Do due diligence, contracts, and oversight procedures address permitted use, data protection and ownership, confidentiality, performance expectations, access to records and model documentation, validation and testing results, audit or assessment rights, regulatory cooperation, corrective action, service continuity, subcontractors, and termination responsibilities?[1][6] Do vendors provide sufficient advance notice before enabling new AI functionality, materially changing existing functionality, or using AI with the insurer’s data or regulated activities? Can the insurer understand and evaluate the functionality, including its purpose, decision role, material inputs and data sources, testing methods and results, performance thresholds, known limitations, and effects on consumers and regulated processes, before implementation or use? The insurer should maintain sufficient knowledge and visibility into AI deployments to make informed decisions regarding approval, restriction, deferral, or rejection and to oversee material changes. Governance responsibilities should further extend to monitoring incidents, complaints, remediation activities, concentration risk, and data return or destruction processes.
What evidence shows controls are working? Can the insurer produce inventories, risk assessments, approvals, validation reports, monitoring results, overrides, complaints, exceptions, incidents, and remediation records?
How are adverse outcomes and incidents corrected? Are exceptions, complaints, adverse consumer outcomes, data-integrity issues, unauthorized use, model drift, loss of human oversight, third-party failures, and control deficiencies classified, contained, escalated, investigated, remediated, documented, and tracked through closure? Can affected consumer decisions be identified and corrected, and do root-cause and lessons-learned processes update inventories, risk classifications, controls, training, monitoring thresholds, contractual requirements, and governance reporting?
Evidence Regulators Should Expect to See
The quality of oversight should be assessed through evidence connecting governance expectations to actual decisions and outcomes. Depending on authority, scope, and risk, a regulator may request an AI inventory for the enterprise or relevant business unit, documented use cases and decision roles, and assessments of inherent and residual risk, materiality, autonomy, reversibility, consumer impact, financial impact, and financial reporting impact. Additional evidence may include approvals; data lineage and technical documentation; model cards or comparable technical summaries; validation, discrimination, privacy, and cybersecurity assessments; vendor due-diligence files; contracts and audit rights; change and monitoring records; complaints, overrides, and incidents; continuity plans; risk acceptance; and validated remediation. For generative AI, the review may also consider risks such as inaccurate or fabricated output, information integrity, sensitive data leakage, intellectual property concerns, unintended autonomous actions, and overreliance on generated content.[5]
A regulator can structure the review in stages based on its authority, scope, and the risks presented. It can first identify AI-enabled activities, determine which uses affect consumers or regulated operations, and prioritize high-impact or poorly controlled applications. It can then evaluate governance and control design, including inventory completeness, accountability, approvals, testing standards, human oversight, change management, and vendor controls. Next, it can test operating effectiveness by sampling approvals, validations, model changes, overrides, complaints, incidents, monitoring alerts, and corrective actions. Where authority and reliable data permit, the regulator can also assess outcomes such as error rates, timeliness, consistency, adverse impacts, and indicators of unfair discrimination. This work is supported by the ongoing efforts of the NAIC Big Data and Artificial Intelligence (H) Working Group and the draft AI Risk Evaluation Supplement, which provides a developing, optional resource for scoping inquiries and organizing risk-based review.[7] Regulators should actively consider these resources and the developing guidance.
As insurers continue to rely on third-party administrators and other service providers, regulators should expect AI oversight to extend beyond the insurer’s own systems and policies. The central issue is not simply whether a TPA uses AI, but whether the insurer understands that use, evaluates the associated risks, obtains sufficient information to exercise meaningful oversight, and takes timely action when issues arise. By considering AI use, consumer impact, risk, and supporting documentation, regulators can help insurers strengthen the governance, oversight, and accountability processes used to support responsible AI and manage associated risks throughout its lifecycle.
Source Notes
National Association of Insurance Commissioners, Model Bulletin: Use of Artificial Intelligence Systems by Insurers, adopted December 4, 2023.
Elham Tabassi, National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework (AI RMF 1.0), NIST AI 100-1, January 26, 2023.
Colorado Division of Insurance, Notice of Adoption—Amended Regulation 10-1-1 Governance and Risk Management Framework Requirements for Insurers’ Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models, August 20, 2025.
New York State Department of Financial Services, Insurance Circular Letter No. 7: Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing, July 11, 2024.
Chloe Autio et al., National Institute of Standards and Technology, Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1, July 26, 2024.
National Association of Insurance Commissioners, Registration and Regulation of Third Party Administrators (TPAs), Guideline 1090, October 2011.
NAIC Artificial Intelligence (AI) Risk Evaluation Supplement and AI Risk Evaluation Supplement – Versions 5.0 and 6.0.
ISACA Now, “Six Steps for Third-Party AI Risk Management,” ISACA, May 8, 2025, updated March 13, 2026.
Comments