Building fair and compliant insurance models

Disparate impact is a neutral rule that produces unequal outcomes across protected groups. This is the hard one. Your model never sees race, but its predictions still fall harder on one group.

The zip code example is classic disparate impact. No intent. Real harm.

The proxy problem in one picture

Consider variables an auto model might use:

• Zip code (proxies for race, income, neighborhood)
• Credit-based insurance score (proxies for income, sometimes race)
• Occupation (proxies for education, income)
• Type of prior insurance (proxies for wealth)

None mention a protected class. Together they can reconstruct one with surprising accuracy. Machine learning models are especially prone to this because they exploit every correlation available.

How to Actually Test for Disparate Impact

You cannot fix what you do not measure. Here is the practical workflow.

Step 1: Get the protected attribute. You often are not allowed to use race in pricing, but you may need to estimate it to test for bias. A common method is BISG (Bayesian Improved Surname Geocoding), which estimates race probability from surname and location. The CFPB published its BISG methodology publicly.

Step 2: Compare outcomes across groups. Look at average premium, approval rate, or predicted risk by estimated group.

Step 3: Run a formal test. The most cited is the four-fifths rule (from employment law, borrowed widely): if the selection or favorable rate for one group is less than 80% of the rate for the most favored group, that is a red flag.

Here is a stripped-down disparate-impact check in Python:

Step 4: If you find impact, find the cause. Which features drive the gap? This is where explainability tools come in.

Explainability Is Now a Mandate, Not a Nice-to-Have

Regulators increasingly require that you can explain why a model charged a specific person a specific price. A black box that says "trust me" will not pass a rate filing.

Two ideas you should know:

Adverse action notices. Under the Fair Credit Reporting Act (FCRA), when you take an adverse action (deny coverage, charge more) based partly on a consumer report, you must tell the consumer the main reasons. "Our AI decided" is not a legal reason.

SHAP values. SHAP (SHapley Additive exPlanations) is a widely used technique that attributes a prediction to each input feature. For one customer, SHAP might show: base rate plus $120 for prior claims, plus $60 for vehicle type, plus $200 for zip code. That last line is exactly what a regulator will circle.

The NAIC Model Bulletin

In 2023 the NAIC (National Association of Insurance Commissioners, the body that coordinates state regulators) adopted a Model Bulletin on the use of AI by insurers. Many states have since adopted versions of it. The core expectations:

• Insurers are responsible for AI outcomes, including from third-party vendors.
• You need a written AI governance program.
• You must test for bias and document it.
• You must be able to explain decisions.

You can read the NAIC Model Bulletin on AI directly. It is short and readable, and it is the closest thing to a national standard right now.

Colorado went further with a specific regulation on life insurers' use of external data and algorithms, requiring quantitative bias testing. Expect more states to follow this template through 2026 and beyond.

Fixing a Biased Model

You found disparate impact. Now what? You have several levers, from crude to sophisticated.

Option 1: Drop the offending feature. Remove zip code. Simple, but you often lose real predictive value, and other features may still proxy for the same thing. Rarely enough on its own.

Option 2: Find a fairer substitute. Instead of raw zip code, use variables with a clearer causal link to risk: local traffic density, weather-related claim frequency, road quality. These explain *why* geography matters without smuggling in race.

Option 3: Constrain the model during training. Add a fairness constraint so the optimizer is penalized when outcomes diverge across groups. This trades a little accuracy for a lot of defensibility.

Option 4: Adjust outputs. Post-process predictions to equalize a chosen fairness metric. Effective, but be careful: deliberately adjusting price by group can itself look like disparate treatment. Get legal review first.

There is no universal "fair" setting. Fairness definitions can conflict mathematically. You cannot always equalize both error rates and selection rates at once. This is a known impossibility result, so you must choose the definition that fits the regulation you face and document why.

A concrete before-and-after

A home insurer's wildfire model used zip code as a top feature. Bias testing showed a gap correlated with a protected group. The fix: replace zip code with parcel-level inputs (distance to vegetation, roof material, defensible space, historical fire perimeters). The new model was actually *more* accurate on wildfire risk and passed review, because every feature had a clear physical link to loss.

This is the pattern to internalize: causal features beat correlational proxies, for both fairness and accuracy.

Building a Governance Process That Regulators Trust

Model fairness is not a one-time test. It is a program. A defensible setup includes:

• A model inventory. Every model, its purpose, its inputs, its owner.
• Pre-deployment bias testing with documented metrics and thresholds.
• Ongoing monitoring. Data drifts. A model fair at launch can become unfair as the population shifts.
• A human in the loop for high-impact decisions like denials.
• Vendor accountability. If you buy a scoring model, you still own the outcome. Get testing documentation contractually.
• An audit trail. Every decision reproducible and explainable months later.

The insurers who thrive under AI regulation treat compliance as an engineering discipline, not a legal afterthought.

Key Takeaways

• Proxy discrimination is the top AI risk in insurance pricing. A model can produce unfair outcomes without ever using a protected variable. Zip code and credit scores are common culprits.
• Test for disparate impact quantitatively. Estimate protected attributes (for example with BISG), compare outcomes across groups, and apply thresholds like the four-fifths rule.
• Explainability is now required. Use tools like SHAP so you can justify any individual price and issue proper adverse action notices under the FCRA.
• Know the NAIC Model Bulletin. It is the emerging national standard: insurers own AI outcomes, must govern them, and must document bias testing, even for vendor models.
• Prefer causal features over correlational proxies. Replacing zip code with parcel-level or physical risk factors often improves both fairness and accuracy at the same time.