Law / United States / 
Michigan
Michigan DIFS Bulletin 2024-20-INS, Use of Artificial Intelligence Systems by Insurers
Guidance, not a law: the Michigan Department of Insurance and Financial Services's reading of Insurance Code of 1956, rate-making standards, rates not unfairly discriminatory (Act 218 of 1956). It binds nobody by itself; the law it reads does.
Guidance on an AI sector rules rule, addressed to private bodies.
- Enforcement body
- Michigan Department of Insurance and Financial Services
- Instrument type
- guidance published by a regulator
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Obligation class
- Governance, Disclosure
- Audit expectation
- on_request
- Who audits it
- Regulator
As of .
What the regulator expects
- It reaches you if you operate as an Insurer, which the bulletin defines as an insurer, nonprofit health service plan, HMO or dental plan organization that holds a certificate of authority to do business in Michigan.
- Comply with all applicable insurance laws and regulations, including those on unfair trade practices and unfair discrimination, in decisions or actions that impact consumers and are made or supported by AI Systems or other advanced analytical and computational technologies; rates developed with AI techniques must not be excessive, inadequate, or unfairly discriminatory under MCL 500.2403(1)(d).
- The Department expects you to develop, implement, and maintain a written AIS Program for the responsible use of AI Systems that make or support decisions related to regulated insurance practices, designed to mitigate the risk of Adverse Consumer Outcomes.
- Your AIS Program should vest responsibility for its development, implementation, monitoring, and oversight, and for your strategy for AI Systems, with senior management accountable to the board or an appropriate committee of the board (guideline 1.3).
- Your AIS Program should address governance, risk management controls, and internal audit functions, and all phases of an AI System's life cycle, whether the system is developed by you or by a third-party vendor (guidelines 1.2, 1.7 and 1.8).
- Your AIS Program should include processes and procedures providing notice to impacted consumers that AI Systems are in use, and access to appropriate levels of information based on the phase of the insurance life cycle in which they are used (guideline 1.9).
- Your AIS Program should document your risk identification, mitigation, and management framework and internal controls, including inventories and descriptions of Predictive Models, validation, testing, and retesting, protection of non-public information, and data and record retention (guidelines 3.1 to 3.7).
- Your AIS Program should address your process for acquiring, using, or relying on third-party data and AI Systems, including due diligence and, where appropriate and available, contract terms for audit rights and cooperation with regulatory inquiries (guidelines 4.1 to 4.3).
What it makes you log
Who may demand the log
Regulator
What the log must hold
System identity, Data lineage
Logging duty
The Department expects an insurer's written AIS Program to address data and record retention (guideline 3.6), inventories and descriptions of its predictive models and detailed documentation of their development and use (guideline 3.3), and the requirements for documenting compliance with the program (guideline 2.2). The bulletin states no retention period and no log format, and says it does not prescribe specific documentation requirements. In an investigation or market conduct action the insurer can expect the Department to ask for that documentation (Section 4).
- Kind
- Explicit
- As of
- Provision
- Bulletin 2024-20-INS, Section 3, AIS Program Guidelines 2.2, 3.3 and 3.6
- Trigger
- automated_decisions
Why the legislator wanted it
AIS Program Guideline 2.2, which ties the documentation to what the Department may request under Section 4.
- As of
- Quote
- 2.2 The requirements adopted by the Insurer to document compliance with the AIS Program policies, processes, procedures, and standards. Documentation requirements should be developed with Section 4 in mind.
- Source link
- https://www.michigan.gov/difs/-/media/Project/Websites/difs/Bulletins/2024/Bulletin_2024-20-INS.pdf#page=5
- Source kind
- Regulator guidance
- Purpose
- regulator_supervision
- accountability_demonstration
What this law does
Bulletin 2024-20-INS was issued and entered by the Director of the Michigan Department of Insurance and Financial Services on . The bulletin is addressed to Insurers, which it defines as Insurers, Nonprofit Health Service Plans, HMOs, and Dental Plan Organizations that hold certificates of authority to do business in the state.
It states that decisions or actions impacting consumers that are made or supported by advanced analytical and computational technologies, including AI Systems, must comply with all applicable insurance laws and regulations, including those that address unfair trade practices and unfair discrimination.
The Department recognizes the Principles of Artificial Intelligence that the National Association of Insurance Commissioners adopted in 2020 as an appropriate source of guidance for Insurers as they develop and use AI systems. The bulletin relies on the Unfair and Prohibited Trade Practices and Frauds Act, MCL 500.2001 to 500.2093, and states that actions taken by insurers in the state must not violate it, regardless of the methods the insurer used to determine or support its actions.
The bulletin also relies on the Corporate Governance Annual Disclosure Act, MCL 500.1751 to 500.1767, which requires insurers to report on governance practices. Under MCL 500.2403(1)(d), property and casualty insurance rates must not be excessive, inadequate, or unfairly discriminatory, whatever methodology the insurer used to develop them.
All insurers authorized to do business in Michigan are expected to develop, implement, and maintain a written program, called an AIS Program, for the responsible use of AI Systems that make or support decisions related to regulated insurance practices. The program guidelines say responsibility for the program should rest with senior management accountable to the board or an appropriate committee of the board.
The guidelines say the program should include processes and procedures providing notice to impacted consumers that AI Systems are in use. The guidelines on third-party AI Systems and data include, where appropriate and available, contract terms that provide audit rights or entitle the insurer to receive audit reports.
In an investigation or market conduct action, an insurer can expect to be asked about its development, deployment, and use of AI Systems, whether or not it has a written AIS Program. The bulletin states that its goal is not to prescribe specific practices or specific documentation requirements, and that insurers may demonstrate compliance with the laws that regulate their conduct through alternative means.