Review the evidence behind the promise

CP-01Company and product

Describe the legal entity, ownership, financial condition, insurance coverage, and operating history supporting this product.

Evidence requested Corporate profile, audited financials or funding evidence, insurance certificates, operating history

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CP-02Company and productCritical

Define the exact product, model providers, hosting arrangement, deployment options, and functions included in the proposed service.

Evidence requested Architecture overview, product specification, model and hosting inventory

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CP-03Company and product

Identify current insurance deployments comparable to our line of business, jurisdiction, workflow, scale, and decision impact.

Evidence requested Reference architecture, anonymized case examples, reference contacts where permitted

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CP-04Company and productCritical

Disclose material litigation, regulatory actions, security incidents, service failures, or public controversies from the past five years.

Evidence requested Signed disclosure, incident summaries, corrective-action evidence

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CP-05Company and product

Provide the product roadmap and identify features, models, or dependencies that may be deprecated or materially changed.

Evidence requested Roadmap, deprecation policy, release and notice commitments

Vendor response Not assessed No Partial Yes N/A Reviewer notes

GA-01Governance and accountabilityCritical

Who is accountable for AI risk, product safety, security, privacy, compliance, and customer escalation at the vendor?

Evidence requested Governance charter, role descriptions, committee records, escalation contacts

Vendor response Not assessed No Partial Yes N/A Reviewer notes

GA-02Governance and accountability

How does the vendor classify AI use cases and scale review, testing, approval, and monitoring to risk?

Evidence requested Risk-tiering methodology, approval gates, completed example

Vendor response Not assessed No Partial Yes N/A Reviewer notes

GA-03Governance and accountability

What independent challenge or second-line review occurs before a material model or product change is released?

Evidence requested Review procedure, independence criteria, recent review record

Vendor response Not assessed No Partial Yes N/A Reviewer notes

GA-04Governance and accountabilityCritical

How are customer-specific requirements, prohibited uses, human oversight, and approval conditions recorded and enforced?

Evidence requested Control configuration, customer policy mapping, approval record

Vendor response Not assessed No Partial Yes N/A Reviewer notes

GA-05Governance and accountability

How are employees and contractors trained, screened, and held accountable for handling AI systems and insurer data?

Evidence requested Training curriculum, completion records, background-screening policy, code of conduct

Vendor response Not assessed No Partial Yes N/A Reviewer notes

DP-01Data and privacyCritical

List every data category the service collects, receives, derives, generates, stores, logs, or transmits, including consumer and claim data.

Evidence requested Data inventory, data-flow diagram, field-level specification

Vendor response Not assessed No Partial Yes N/A Reviewer notes

DP-02Data and privacyCritical

Identify the legal and contractual basis for obtaining and using each data source, including external consumer data and inferred attributes.

Evidence requested Source register, licenses, consents, privacy analysis, provenance records

Vendor response Not assessed No Partial Yes N/A Reviewer notes

DP-03Data and privacyCritical

Will insurer data, prompts, outputs, feedback, or metadata train or improve any model available to other customers?

Evidence requested Contract language, technical configuration, model-training policy

Vendor response Not assessed No Partial Yes N/A Reviewer notes

DP-04Data and privacyCritical

How are data minimization, purpose limitation, retention, deletion, correction, access, and legal-hold requirements implemented?

Evidence requested Retention schedule, deletion workflow, privacy-rights procedure, test evidence

Vendor response Not assessed No Partial Yes N/A Reviewer notes

DP-05Data and privacy

Where is data processed and stored, and what cross-border transfers, remote access, or regional failover may occur?

Evidence requested Hosting regions, transfer mechanism, access locations, failover design

Vendor response Not assessed No Partial Yes N/A Reviewer notes

ML-01Model lifecycleCritical

Identify every model and material algorithm used, its provider, version, intended purpose, limitations, and prohibited uses.

Evidence requested Model inventory, model cards, system cards, limitation statements

Vendor response Not assessed No Partial Yes N/A Reviewer notes

ML-02Model lifecycle

Explain how training, validation, test, and production data are separated and how leakage, representativeness, and data quality are assessed.

Evidence requested Development methodology, dataset documentation, quality and leakage tests

Vendor response Not assessed No Partial Yes N/A Reviewer notes

ML-03Model lifecycleCritical

Provide performance results relevant to our use case, population, line of business, and operating conditions, including error distributions.

Evidence requested Validation report, subgroup results, confidence intervals, benchmark definition

Vendor response Not assessed No Partial Yes N/A Reviewer notes

ML-04Model lifecycle

Describe independent validation, challenger testing, calibration, robustness testing, and the criteria for production approval.

Evidence requested Independent validation report, test plan, approval record, unresolved findings

Vendor response Not assessed No Partial Yes N/A Reviewer notes

ML-05Model lifecycleCritical

How are model, prompt, retrieval, rule, data, and configuration changes versioned, tested, approved, communicated, and reversible?

Evidence requested Change-control procedure, version history, rollback evidence, customer notice terms

Vendor response Not assessed No Partial Yes N/A Reviewer notes

FC-01Fairness and consumer outcomesCritical

How does the vendor identify protected or vulnerable groups and test for unfair discrimination, proxy effects, and disproportionate adverse outcomes?

Evidence requested Fairness methodology, subgroup testing, proxy analysis, legal review

Vendor response Not assessed No Partial Yes N/A Reviewer notes

FC-02Fairness and consumer outcomesCritical

Can the vendor provide explanations and reason information suitable for consumer notices, claim communications, underwriting decisions, or appeals?

Evidence requested Sample explanations, reason-code methodology, fidelity testing, communication templates

Vendor response Not assessed No Partial Yes N/A Reviewer notes

FC-03Fairness and consumer outcomes

What outcome, accuracy, and fairness differences have been observed across relevant segments, jurisdictions, languages, channels, and claim types?

Evidence requested Segmented results, exception analysis, remediation record

Vendor response Not assessed No Partial Yes N/A Reviewer notes

FC-04Fairness and consumer outcomesCritical

How can consumers or insurer staff contest, correct, escalate, or override an AI-supported result, and how are those events analyzed?

Evidence requested Appeal and override workflow, logs, service levels, trend reporting

Vendor response Not assessed No Partial Yes N/A Reviewer notes

FC-05Fairness and consumer outcomes

What controls prevent inappropriate optimization for speed, severity, conversion, fraud yield, or cost at the expense of lawful and fair outcomes?

Evidence requested Objective-function documentation, guardrail metrics, approval criteria

Vendor response Not assessed No Partial Yes N/A Reviewer notes

SR-01Security and resilienceCritical

Provide current independent security assurance and the scope, exceptions, and remediation status relevant to the service.

Evidence requested SOC 2 Type II or equivalent, ISO certificate, penetration-test summary, remediation tracker

Vendor response Not assessed No Partial Yes N/A Reviewer notes

SR-02Security and resilienceCritical

How are identity, privileged access, least privilege, segregation, secrets, encryption, tenant isolation, and administrative activity controlled?

Evidence requested Control design, access matrix, encryption specification, audit-log sample

Vendor response Not assessed No Partial Yes N/A Reviewer notes

SR-03Security and resilience

Describe secure development, dependency governance, vulnerability management, code review, testing, and patch timelines.

Evidence requested Secure SDLC, SBOM, scan results, patch policy, exception record

Vendor response Not assessed No Partial Yes N/A Reviewer notes

SR-04Security and resilienceCritical

What incident detection, investigation, containment, evidence preservation, notification, and customer coordination capabilities apply?

Evidence requested Incident-response plan, notification terms, exercise record, forensic-retention policy

Vendor response Not assessed No Partial Yes N/A Reviewer notes

SR-05Security and resilience

Provide availability commitments, capacity limits, recovery objectives, backup controls, continuity tests, and dependency failure behavior.

Evidence requested SLA, BCP and DR results, RTO and RPO, load tests, degradation design

Vendor response Not assessed No Partial Yes N/A Reviewer notes

AG-01Generative and agentic AICritical

Which generative models, retrieval components, tools, plug-ins, agents, and external services can influence an output or action?

Evidence requested End-to-end architecture, tool registry, dependency inventory, trust boundaries

Vendor response Not assessed No Partial Yes N/A Reviewer notes

AG-02Generative and agentic AICritical

How does the system prevent, detect, test, and respond to prompt injection, data exfiltration, malicious content, and unsafe tool use?

Evidence requested Threat model, red-team report, injection tests, tool authorization controls

Vendor response Not assessed No Partial Yes N/A Reviewer notes

AG-03Generative and agentic AI

What grounding, citation, confidence, abstention, output validation, and hallucination controls are used for insurance content?

Evidence requested Evaluation results, grounding design, failure examples, abstention thresholds

Vendor response Not assessed No Partial Yes N/A Reviewer notes

AG-04Generative and agentic AICritical

What actions may an agent take, with what permissions, transaction limits, separation of duties, confirmations, and human approvals?

Evidence requested Action catalog, permission model, approval workflow, transaction and rollback tests

Vendor response Not assessed No Partial Yes N/A Reviewer notes

AG-05Generative and agentic AICritical

Are prompts, system instructions, memory, retrieval sources, outputs, tool calls, and agent steps logged and reconstructable?

Evidence requested Trace example, logging specification, retention and access controls

Vendor response Not assessed No Partial Yes N/A Reviewer notes

OM-01Operations and monitoring

Which performance, data quality, drift, fairness, security, adoption, override, complaint, and business-outcome metrics are monitored?

Evidence requested Monitoring catalog, thresholds, dashboard sample, metric ownership

Vendor response Not assessed No Partial Yes N/A Reviewer notes

OM-02Operations and monitoring

How are alerts investigated, prioritized, escalated, resolved, and linked to changes, incidents, complaints, or consumer outcomes?

Evidence requested Alert workflow, severity matrix, case samples, response service levels

Vendor response Not assessed No Partial Yes N/A Reviewer notes

OM-03Operations and monitoring

What service levels apply to support, defects, data issues, model failures, security events, and regulatory requests?

Evidence requested Support SLA, escalation matrix, regulatory-response process

Vendor response Not assessed No Partial Yes N/A Reviewer notes

OM-04Operations and monitoringCritical

Can the insurer pause, constrain, override, roll back, or disable the service without vendor intervention when risk thresholds are breached?

Evidence requested Kill-switch design, runbook, role permissions, test record

Vendor response Not assessed No Partial Yes N/A Reviewer notes

OM-05Operations and monitoring

How will the vendor support insurer testing, parallel runs, controlled pilots, post-deployment validation, and benefit realization?

Evidence requested Implementation plan, test environment, pilot method, measurement support

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CA-01Compliance and auditCritical

How does the service support applicable insurance laws, unfair-trade-practice requirements, anti-discrimination obligations, privacy duties, record retention, and examinations?

Evidence requested Compliance mapping, legal analysis, control matrix, jurisdictional configuration

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CA-02Compliance and auditCritical

Will the vendor provide complete, timely, reproducible records and knowledgeable personnel for insurer audits and regulatory inquiries?

Evidence requested Audit-right language, sample evidence package, response commitments

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CA-03Compliance and audit

How does the vendor track legal and regulatory change and determine whether products, models, data, documentation, or controls must change?

Evidence requested Regulatory-change procedure, recent impact assessment, ownership

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CA-04Compliance and audit

Identify certifications, reports, audits, validations, or attestations relied upon and disclose their scope limits and unresolved exceptions.

Evidence requested Assurance inventory, scope statements, exception and remediation records

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CA-05Compliance and auditCritical

Can the insurer independently test the system and retain evidence needed to demonstrate governance and outcomes over time?

Evidence requested Testing rights, data access, export capability, evidence-retention terms

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CE-01Contracting and exitCritical

Identify all subprocessors, model providers, data suppliers, affiliates, and other fourth parties, including their roles and locations.

Evidence requested Subprocessor register, data and service dependency map, notification process

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CE-02Contracting and exitCritical

Do contracts flow insurer requirements, confidentiality, privacy, security, audit, deletion, incident, and regulatory obligations to relevant fourth parties?

Evidence requested Flow-down clauses, subprocessor contract standard, oversight evidence

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CE-03Contracting and exit

What liability, indemnity, warranty, insurance, service-credit, and limitation-of-liability terms apply to AI errors, data events, infringement, and noncompliance?

Evidence requested Proposed agreement, insurance certificates, negotiated risk schedule

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CE-04Contracting and exitCritical

What advance notice, approval, objection, testing, and termination rights apply to material changes in models, data, hosting, subprocessors, or functionality?

Evidence requested Change and subprocessor clauses, notice periods, objection and termination rights

Vendor response Not assessed No Partial Yes N/A Reviewer notes

CE-05Contracting and exitCritical

Can the insurer export its data, configuration, logs, evidence, and records in usable formats and obtain verified deletion at exit?

Evidence requested Exit plan, export specification, transition assistance, deletion certificate

Vendor response Not assessed No Partial Yes N/A Reviewer notes