A worked example. Meridian Claims Intelligence is fictional. This is the page a carrier reviewer opens from a share link, on the same fixture the worked profile uses; nothing here is tracked and nothing is real except the mechanism.

Carrier diligence profile

Meridian Claims Intelligence, as a reviewer reads it.

The exam-relevant fields first, in one table, with the gaps stated plainly rather than hidden. Every response cites the document, page and sentence it came from.

Since you last opened this link on 2026-09-15, 1 system record and 2 responses have been updated. Each one is marked below.

AI systems disclosed6

Consumer-impacting3

Responses with a cited source16 of 23

Evidence artifacts9 of 12

Security posture

Multi-factor authentication for access to insurer data: Enforced for every account
Last penetration test: 2026-03-14
Incident notification to the insurer: Within 48 hours
Accountable for AI governance: Head of Data Science, reporting to the Chief Operating Officer

AI systems

System	Function	Consumer impacting	Provider	Independent validation	Bias testing
MDL-001 Claims Severity Triage	Claims handlingtier high	Yes	in-house	2025-06-30	2026-04-11
MDL-002 FNOL Intake Classifier	First notice of losstier high	Yes	not disclosed	none	2026-04-11
MDL-003 Fraud Signal Scoring	SIU referraltier high	Yes	in-house	2026-02-14	2026-04-11
MDL-004 Adjuster Note Summarization	Internal operationstier low	Nodetermination not documented	not disclosed	none	n/a
MDL-005 Subrogation Opportunity Detection	Recoverytier medium	Nodetermination not documented	in-house	none	n/a
MDL-006 Document OCR & Classification	Intake processingtier low	No	Contracted OCR provider, US region	none	n/a

Confidentiality

This profile was prepared by Meridian Claims Intelligence for Northfield Mutual's review. The evidence list and the passages cited under each response are confidential to Meridian Claims Intelligence and are provided for that review only. Opening them records your acknowledgement, and the record is disclosed to Meridian Claims Intelligence. This is a record of acknowledgement, not a signed agreement; any agreement between you and Meridian Claims Intelligence stands on its own terms.

Responses

Each answer shows the document, location and sentence it came from. Request clarification on any single item without restarting the assessment.

AIS-1.1NAIC AI model bulletin, Section 3 ¶1.2 and ¶3.1updated since your last visit

Describe the AI Systems Program, including governance structure, named accountability, and the process by which AI systems are approved for production use.

Meridian maintains a written AI Systems Program owned by the VP of Engineering, with an AI Review Board holding approval authority over production deployment of any consumer-impacting model.

AI Governance Policy v2.1 · §2.1, p. 7verified 2026-09-02

AIS-1.2NAIC AI model bulletin, Section 3 ¶1.3 and ¶2.3updated since your last visit

Identify the individual accountable for AI governance and describe their reporting line to senior management.

The VP of Engineering chairs the AI Review Board and reports to the CTO.

AI Governance Policy v2.1 · §2.2, p. 8verified 2026-09-02

AIS-1.3NAIC AI model bulletin, Section 3 ¶2.2

Describe how AI governance decisions, including approvals and exceptions, are recorded and retained.

Board minutes, approvals and conditions are retained in the engineering wiki.

No source citedverified 2026-08-14

AIS-2.1NAIC AI model bulletin, Section 3 ¶3.3(a) · AI Systems Evaluation Tool (pilot)

Provide a complete inventory of AI systems used in delivering the service, including the insurance function each supports.

Six AI systems are in production across claims handling, first notice of loss, SIU referral, internal operations, recovery and intake processing.

AI Governance Policy v2.1 · §1.4, p. 5verified 2026-09-02

AIS-2.2NAIC AI model bulletin, Section 2 (Adverse Consumer Outcome) and Section 3 ¶1.1

For each AI system, state whether it affects a consumer outcome, who made that determination, and on what basis.

Three of six systems affect consumer outcomes. The remaining three are internal-only.

No source citedverified 2026-08-14

AIS-2.3NAIC AI model bulletin, Section 3 ¶1.4 · AI Systems Evaluation Tool (pilot), proportionality

Describe the risk classification applied to each AI system and the criteria that place a system in the highest tier.

Systems are tiered high, medium or low on consumer impact and reversibility of the decision they inform.

Model card: Fraud Signal Scoring · §2, p. 3verified 2026-09-02

AIS-2.4NAIC AI model bulletin, Section 3 ¶3.3(b) and ¶3.7

Provide current model documentation for each high-risk system, reflecting the version now in production.

Model documentation is maintained for MDL-001, MDL-003 and MDL-005.

Model card: Claims Severity Triage · §1, p. 2verified 2026-09-02

AIS-3.1NAIC AI model bulletin, Section 3 ¶3.2 (data lineage, quality, integrity)

Describe the categories of data used as inputs to each AI system, including any consumer data.

Inputs are closed-claim records from the Meridian production warehouse. No externally licensed claims data is used.

Model card: Claims Severity Triage · §4, p. 5verified 2026-09-02

AIS-3.4NAIC AI model bulletin, Section 3 ¶3.2 (lineage) and ¶3.4 (training data suitability)

For each high-risk model, describe the data used in training, including provenance, third-party sources, and any use of consumer data.

MDL-001 and MDL-003 are trained on the internal claims corpus with provenance recorded per release. MDL-002 is a fine-tune of a third-party base model with no approved provenance record.

Model card: Claims Severity Triage · §4, p. 5verified 2026-09-02

AIS-3.5NAIC AI model bulletin, Section 3 ¶3.2 and ¶3.5

Describe the de-identification or minimisation applied to consumer data before it is used in training.

Direct identifiers are removed before training by a documented de-identification job.

Model card: Claims Severity Triage · §4.2, p. 6verified 2026-09-02

AIS-3.7NAIC AI model bulletin, Section 3 ¶3.4

Describe independent validation performed on each high-risk model, including who performed it and when.

MDL-001 and MDL-003 have been validated by the platform team. MDL-002 validation is planned.

No source citedverified 2026-08-14

AIS-4.1NAIC AI model bulletin, Section 3 ¶4.1 and Section 4 ¶2.1

Describe the due diligence performed on third parties whose models or data are incorporated into the service.

Third parties are assessed at procurement against the standard security questionnaire.

No source citedverified 2026-08-14

AIS-4.2NAIC AI model bulletin, Section 4 ¶2.1 · 23 NYCRR 500.11(a)(1)

Identify all third parties whose AI systems, models, or model outputs are incorporated into the products or services provided to the insurer, including processing location.

Meridian uses a leading commercial language model provider for intake classification and summarization, under enterprise terms that prohibit training on customer data.

No source citedverified 2026-08-14

AIS-4.3NAIC AI model bulletin, Section 3 ¶4.2 and Section 4 ¶2.2

Describe contractual provisions governing the third party’s use of insurer data for model training.

The standard Data Processing Agreement prohibits use of insurer data for model training.

Data Processing Agreement, standard form · §7.3, p. 9verified 2026-09-02

AIS-5.1NAIC AI model bulletin, Section 3 ¶1.1 and ¶3.2 (bias analysis)

Describe testing performed to detect unfair discrimination in AI system outputs, including methodology, protected classes considered, and cadence.

Disparate impact testing runs quarterly on consumer-impacting models using adverse impact ratio with a 0.80 action threshold.

Bias and disparate impact testing, Q1 2026 · §1.2, p. 3verified 2026-09-02

AIS-5.2NAIC AI model bulletin, Section 3 ¶3.3(c) (model drift) and Section 4 ¶2.4

Describe ongoing performance monitoring and the thresholds that trigger intervention.

Performance is monitored weekly with alerting on drift beyond tolerance.

No source citedverified 2026-08-14

AIS-5.3NAIC AI model bulletin, Section 4 ¶2.4

Provide the most recent testing results for each consumer-impacting system.

Q1 2026 results are documented; no model fell below threshold.

Bias and disparate impact testing, Q1 2026 · §3, p. 14verified 2026-09-02

AIS-6.1NAIC AI model bulletin, Section 3 ¶2.3 and ¶3.1

Describe where a human reviews or can override an AI system output before it reaches a consumer.

No model auto-denies, auto-closes or reduces a claim payment. Scores are advisory and surfaced to a licensed adjuster.

Adjuster Override Rate Analysis, H1 2026 · sheet 1verified 2026-09-02

AIS-6.3NAIC AI model bulletin, Section 3 ¶3.1 and Section 2 (Adverse Consumer Outcome)

Describe human review and override capability where an AI system contributes to an adverse consumer outcome, and provide override rates.

Adjusters record an accept or override decision on every advisory score. H1 2026 override rate was 11.4% for MDL-001.

Adjuster Override Rate Analysis, H1 2026 · sheet 1, summary rowverified 2026-09-02

SEC-1.123 NYCRR 500.11(a)

Describe the information security controls applicable to the insurer’s nonpublic information held or processed by the third party.

Insurer nonpublic information is encrypted at rest (AES-256) and in transit (TLS 1.3), with quarterly access reviews.

SOC 2 Type II, FY2026 · CC6.1, p. 31verified 2026-09-02

SEC-2.123 NYCRR 500.12

Describe access controls, including multi-factor authentication, applied to systems holding insurer nonpublic information.

Role-scoped access with MFA enforced for all personnel and all production access paths.

SOC 2 Type II, FY2026 · CC6.6, p. 34verified 2026-09-02

SEC-3.123 NYCRR 500.5(a)

Provide evidence of penetration testing performed within the last twelve months.

Penetration testing performed by Bishop Fork Security in October 2025.

Penetration test report, Bishop Fork Security · §1, p. 4verified 2026-09-02

SEC-4.123 NYCRR 500.11(b)(3)

Describe the incident notification obligation and timeline owed to the insurer.

Meridian notifies affected customers within 72 hours of confirming an incident.

No source citedverified 2026-08-14

Evidence

The evidence list opens once confidentiality is acknowledged above.

Artifact	Kind	Approved	State
AI Governance Policy v2.1EV-POLICY	Policy	2026-06-02	Provided
Model card: Claims Severity TriageEV-CARD-001	Model card	2025-07-18	Provided
Model card: Fraud Signal ScoringEV-CARD-003	Model card	2026-02-20	Provided
Model card: Subrogation Opportunity DetectionEV-CARD-005	Model card	2025-11-10	Provided
Bias and disparate impact testing, Q1 2026EV-BIAS	Test report	2026-04-11	Provided
SOC 2 Type II, FY2026EV-SOC2	Attestation	2026-03-31	Provided
Adjuster Override Rate Analysis, H1 2026EV-OVERRIDE			Withheld, contains third-party personal data
Incident Response Plan v3EV-IRP	Plan	2026-01-22	Provided
Penetration test report, Bishop Fork SecurityEV-PENTEST	Test report	2025-10-28	Provided
Data Processing Agreement, standard formEV-DPA	Contract	2026-02-09	Provided
Subprocessor & sub-model registerEV-SUBREG	Register		Not provided
Model Validation Report, FNOL Intake ClassifierEV-VAL-002	Validation		Not provided