Yes, we could send it today
No rule fires on this answer, for a product that runs on a third-party or fine-tuned model. A reviewer moves on.
Free snapshot · question 2 of 9
If a carrier asked today, could you send them a document that names your AI providers?
We mean a document your company has formally approved, such as a vendor register, a subprocessor list, or an architecture document someone senior has signed off. It has to name the provider and say where the model runs. A line like "claim summaries are generated by Anthropic Claude, running in AWS in the us-east-1 region" is what a reviewer needs to see. A page in an engineering wiki that nobody has approved does not count, and neither does telling them you use a leading AI provider.
Why a carrier asks
What the answer decides.
A carrier has to name every third party inside your product in its own examination response, so the reviewer needs a sentence they can copy across. "We use a leading provider" is not something they can write in a regulatory file. Approval matters as much as the content, because a wiki page can change the day after they read it, which is why they ask for a document your company stands behind. When a reviewer cannot close the question on their own side, the safe move for them is to stop and ask you, and that is how a forty minute review becomes a six week queue.
What the engine does with each answer
Derived, not written.
Each outcome below was produced by running Vaulith's rules engine on that answer, for a product that runs on a third-party or fine-tuned model. The same rules run in the paid assessment, on your whole estate, with the arithmetic shown.
No, not in a document like that
Will stop the reviewR-SUBPROCESSOR
No subprocessor or sub-model register
One model (the system you described) runs on a third-party provider that is not named in any approved record. "A leading commercial provider" is not an answer a reviewer can write down. The carrier has to name every third party in its own examination response, so an unnamed provider makes your gap their finding, and a reviewer who cannot close a question in their own file will stop and ask rather than accept it.
The examination items it touches
Where this lands in the questionnaire.
- AIS-4.2 Identify all third parties whose AI systems, models, or model outputs are incorporated into the products or services provided to the insurer, including processing location.NAIC AI model bulletin §5.1 · 23 NYCRR 500.11(a)
- AIS-4.1 Describe the due diligence performed on third parties whose models or data are incorporated into the service.NAIC AI model bulletin §5, third-party AI systems
- AIS-4.3 Describe contractual provisions governing the third party’s use of insurer data for model training.NAIC AI model bulletin §5.2
- AIS-2.1 Provide a complete inventory of AI systems used in delivering the service, including the insurance function each supports.NAIC AI Systems Evaluation Tool, AI use inventory
- SEC-1.1 Describe the information security controls applicable to the insurer’s nonpublic information held or processed by the third party.23 NYCRR 500.11(a)
- SEC-5.1 Confirm the retention period applied to insurer nonpublic information after contract termination.23 NYCRR 500.13
Answer it about your own estate.
The snapshot asks this and eight more, in about ninety seconds, with nothing leaving your browser, and returns every finding with its reasoning and its remediation.