Your Rules Engine Is In Scope: The AI Governance Gap Carriers Missed

IntroductionMost carriers can say how many AI pilots they are running. Far fewer can say where every automated decision in the business sits. That gap is the subject of this episode.Josh Hollander is joined by Karl Canty and Paul Laurent of Artefact, the global data and AI consultancy, for a working conversation about the four frameworks converging on US insurance: the NAIC model bulletin, California's ADMT rules, Colorado's algorithm governance regime, and New York's DFS circular letter. Paul argues that this combination has made US insurance the most completely defined AI governance environment anywhere, and that the scope reaches well past the AI programs carriers are proud of. Rules engines, credit scores, telematics feeds, and vendor models are all inside it.Karl's argument is that carriers moving on this for the first time are not first movers, they are late, and that the inventory work the rules force on you is the same work that makes your own data usable for growth.Guest BioKarl Canty is Partner and US Insurance Lead at Artefact, where he is building the firm's North American insurance practice. He has spent about twenty-five years in insurance data, technology, and operations, including advisory roles at PwC and EY, a data and AI leadership role at EXL, and a partnership at Capco. He writes for Digital Insurance on where AI actually pays for carriers.Paul Laurent is Head of AI Risk and Data Trust at Artefact, running the firm's AI governance advisory practice across North America. He describes himself as a technical lawyer: criminal prosecutions early on, a master's in computer science, then a decade at Oracle translating regulatory obligations into working architecture, followed by identity, data security, privacy, and now AI. He has contributed to NIST framework work across cybersecurity, privacy, and AI risk management.Key Topics-The four timelines - New York in force since July 2024, an NAIC pilot ending in an AI systems evaluation, California live with enforcement from January 2027, and Colorado already amended toward California's standard.-Scope is wider than AI - California's rules reach deterministic tools and legacy rules engines, which pulls decades-old underwriting and claims infrastructure into the conversation.-The vendor chain is not a place to put the risk - The NAIC treats external consumer data and information systems, including credit scores and telematics, as the carrier's responsibility. -Compliance cannot be delegated to a th