Insurance Markets: Benefits and Challenges Presented by Innovative Uses of Technology

The innovative use of technology by insurance companies (insurtech) is growing and offers the potential to improve customer experiences while also lowering insurer costs. Some stakeholders have raised questions about how certain uses of insurtech could create both risks for consumers and challenges for regulators, and whether some challenges might slow technological innovation in the insurance sector.

GAO was asked to provide information on insurtech activities in the property/casualty and life insurance sectors. This report (1) identifies new uses of technologies and potential benefits and challenges for insurers and their customers; and (2) discusses what stakeholders identified as key challenges that could affect the adoption of new technologies, and actions taken to address those challenges. GAO reviewed available literature; analyzed relevant laws and regulations; and conducted interviews with more than 35 stakeholders, including federal and state regulators, technology companies, insurers, and consumer groups (selected based on literature reviews and recommendations, and for relevance to the scope of GAO's review).

GAO is not making any recommendations in this report.

Insurtech companies (recently established companies bringing technology-enabled innovations to the insurance industry) as well as established insurers have begun to use technologies, including artificial intelligence (AI) and mobile applications, in an attempt to improve risk assessment and enhance customer experiences. For example:

Consumers can purchase insurance products specifically tailored to their situation and needs, such as renters or auto insurance that can be turned on and off as needed using a mobile app.

Some insurers have begun to use nontraditional data (such as from social media) to analyze policyholder risk, and use AI and complex algorithms to reduce costs by automating information gathering and risk assessment.

However, implementing these technologies can create potential challenges for insurers and risks for consumers, including the following:

The use of AI to create underwriting models for determining premium rates can make it challenging for insurers to ensure that factors prohibited by regulation (such as race) are not used in models. Such models are often developed by data scientists who, unlike actuaries, may not fully understand insurance-specific requirements.

Insurer collection and use of consumer data not provided by the consumer raise questions about data accuracy, privacy, and ownership.

Some insurtechs sell coverage through nonadmitted insurers. As we have previously reported, nonadmitted insurers—unlike traditional insurers—are not required to be licensed in each state in which they sell insurance, and receive less regulatory oversight of their policies and rates. Also, if nonadmitted insurers became insolvent, state guaranty funds would not be available to help pay policyholder claims.

Stakeholders with whom GAO spoke identified challenges they said might affect adoption of innovative technologies. These include paper-based documentation requirements that do not accommodate online insurance transactions, and challenges for regulators in the evaluation of complex rating models. The National Association of Insurance Commissioners (NAIC) and state regulators have initiated a number of actions designed to address such concerns. For example:

State insurance regulators, through an NAIC task force, have been examining regulatory areas that may pose obstacles for innovation, such as requirements for paper documentation or signatures.

NAIC issued draft best practices for states to use when reviewing complex rating models.

NAIC adopted a model law that creates a legal framework for states to use to require insurance companies to operate cybersecurity programs and protect consumer data.

Because many of these regulatory initiatives are still in development (or recently developed), the effect on innovation and consumer protection is unknown.

The innovative use of technology by insurance companies (insurtech) is  growing and offers the potential to reduce insurer costs while enhancing  customer experiences. In recent years, both insurtech companies  (recently established companies bringing technology-enabled innovations  to the insurance industry) and established insurers have begun to use  technologies, such as artificial intelligence (AI), to explore ways in which  to improve operations and functions such as risk assessment, marketing,  and product development. As consumers, and millennials in particular,  have become well-versed in new technologies and taken a more hands- on approach to purchasing insurance, insurtechs have emerged to offer  customized insurance products and streamlined customer experiences.

At the same time, some stakeholders have expressed concerns that  certain uses of technology could create risks for consumers, including  potential misuse of data. Some stakeholders also have said the current  insurance regulatory system slows technological innovation. As we noted  in recent reports on data, analytics, and AI, the technologies have  produced benefits such as reduced cost and increased accuracy in some  areas of business, but also can pose privacy and civil liberties risks and  their use could result in undesirable or unexpectedly biased outcomes.

You asked us to provide an overview of insurtech activities in the  property/casualty and life insurance sectors. Specifically, this report (1)  identifies uses of technologies and the benefits and challenges they might  present for insurers and their customers, and (2) discusses what  stakeholders identified as key challenges that could affect the adoption of  new technologies, and actions that have been taken to address those  challenges.

To address both objectives, we examined insurtech activities in the  property/casualty and life sectors of the U.S. insurance market, including  information on personal and commercial insurance where available. We  did not include the health insurance sector because of significant  differences between that sector and the property/casualty and life  insurance sectors in terms of products offered and methods by which they  are sold and regulated. We conducted background research and a  literature review to understand the most prominent, or key, technologies  being used in the insurance industry and to identify any analyses of  potential benefits and challenges that insurtech products and services  may pose. Because insurtech is a fairly new field, we found few academic  publications related to our objectives. We also conducted more than 35  semi-structured interviews with and reviewed documents provided by  knowledgeable stakeholders to identify and obtain information about (1)  current, in-development, and potential future uses of existing or new  technology in the insurance industry; (2) stakeholder views on the  potential benefits and challenges such technology presents to insurance  companies and consumers; (3) which challenges may affect insurers’  adoption of technology; and (4) actions the National Association of  Insurance Commissioners (NAIC) and selected state insurance regulators  have been taking or might consider to address these challenges. The  stakeholders included the Federal Insurance Office, NAIC, selected state  insurance regulators, associations representing state agencies,  academics, consumer groups, insurance providers and industry  associations, actuarial professional associations, consulting groups,  lawyers in the field, and technology providers. We identified potential  interviewees by conducting internet research, reviewing literature search  results, and reviewing recommended interviewees from our initial  interviews. Finally, we reviewed NAIC model laws and state laws to  identify any relevant to the development and implementation of insurtech.  See appendix I for more information on our scope and methodology.

We conducted this performance audit from April 2018 to June 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Insurance allows individuals and businesses to manage risk by providing  compensation for certain losses or expenses, such as those from car  accidents, fires, medical services, or inability to work. According to NAIC,  as of December 31, 2017, there were 2,509 property/casualty companies  and 852 life insurance companies in the United States and its territories.  In 2017, premiums written for the property/casualty sector totaled $602.2  billion in 2017 and premiums written for the life and health sector totaled  $683.2 billion.

As we have noted in recent reports, advances in technology and  widespread use of the internet have brought about significant changes in  the financial industry. For example, in recent years technology has  changed consumer expectations and preferences, with younger  consumers especially being well-versed in new technologies and looking  to take a more hands-on approach to managing their finances. Similarly,  over the last 5 years, established insurers and insurtech companies have  used technology to offer simpler insurance products and streamlined  customer experiences. Insurtech companies have been playing a variety  of roles in the U.S. insurance market. Key players in insurtech include the  following:  Insurtech companies (typically startups) that are licensed  insurance companies. Insurtech startups offer innovative products  and services and are active in all major insurance products and all  lines of business, with concentrations in the property/casualty  business. For example, according to its website, Lemonade Insurance  Company is a property/casualty insurer that sells products exclusively  through mobile applications (apps) and its website. It offers renters,  condominium, and homeowners insurance in several states. Another  example is Root, which describes itself as an automobile insurance  company that uses a smartphone app to understand individual driving  behavior. Customers can download the Root app to their  smartphones, obtain a personalized quote after a 2–3 week test drive,  and purchase and manage their policy entirely within the mobile app.

Insurtech companies that do not provide insurance themselves,  but offer technology solutions for insurers. For example,  according to the website for Groundspeed Analytics, they use AI and  data science methods to provide information for the commercial  property/casualty insurance industry to help identify potential areas of  profit and enhance the customer experience. According to the website  for Habit Analytics, they use real-time consumer data, sourced from  smartphones and connected devices in homes, to create behavioral  profiles that enable insurance companies to provide input for their risk  models. Many established insurers have been acquiring such  companies.

Established insurers that use technologies or partner with  insurtech companies. For example, the insurer Nationwide notes on  its website that it created Nationwide Ventures to invest in startups,  pilot new technologies, and test new solutions and business models  by exploring topics that range from analytics and automation  technology to new insurance and financial services platforms.

According to analysis by the Deloitte Center for Financial Services and  data collected by research firm Venture Scanner, as of mid-2018 there  were more than 1,000 insurtech firms established in more than 60  countries, with more than half of those launched in the United States  since 2008.

State Licensing Regulation for Admitted and Nonadmitted Insurance Markets

Insurance companies are regulated principally by the states and are  licensed under the laws of a single state, known as the state of domicile.  Companies may conduct business in multiple states, but the state of  domicile serves as an important regulator. State regulators license  insurance agents, generally review and approve insurance products and  premium rates, and examine insurers’ financial solvency and market  conduct. As we have previously reported, state regulators typically  conduct financial solvency examinations every 3–5 years, while market  conduct examinations are generally done in response to specific  consumer complaints or regulatory concerns. To help ensure that  policyholders continue to receive coverage if their insurer becomes  insolvent or unable to meet its liabilities, states also have guaranty funds  (separate for life and property/casualty insurance), which are funded by  assessments on insurers doing business in those states.

Individuals who wish to sell, solicit, or negotiate insurance in the United  States must generally be licensed as producers, a term including  insurance agents and insurance brokers. Insurance agents typically  represent only one insurance company. Insurance brokers represent  multiple insurance companies and are free to offer a wider range of  products to their clients. Brokers can search the market and obtain  multiple price quotes to fit their clients’ needs. Producers must comply  with state laws and regulations governing their activities. NAIC notes that  as of September 2018, more than 2 million individuals and more than  200,000 business entities were licensed to provide insurance services  across all lines of insurance in the United States.

Traditional insurers, sometimes referred to as admitted insurers, can be  licensed to sell several lines or types of coverage to individuals or  families, including personal lines—such as homeowners, renters, and  automobile insurance—and commercial lines—such as general liability,  commercial property, and product liability insurance. Admitted insurers  can sell insurance in one or more states but, according to NAIC, must be  licensed to operate in every state in which they sell coverage. To help  ensure adequacy and fairness in pricing and coverage, state regulators  oversee the insurance rates and forms of admitted insurers. State  regulators also may require admitted insurance companies to maintain  specific levels of capital to continue to conduct business.

The surplus lines insurance market, also known as the nonadmitted  market, can provide insurance coverage for risks that traditional insurers  are unwilling or unable to cover. The risks covered can include potentially  catastrophic property damage and liability associated with high-hazard  products, special events, environmental impairment, and employment  practices. In the absence of the surplus lines market, NAIC notes that  some insureds in those markets would be unable to secure coverage.

In most states, surplus lines insurers cannot write insurance coverage  that is available from admitted insurers and only may write coverage  rejected by a number of admitted insurers, according to NAIC.  Furthermore, in those states, the surplus lines insurance broker must  conduct a “diligent search” of the admitted insurance market to determine  if comparable coverage is available. The broker can write coverage only if  a specified number of admitted insurers have declined to offer such  coverage.

According to NAIC, new and innovative insurance products for which  there is no loss history may be difficult to appropriately price. According to  stakeholders we interviewed, the nonadmitted market is therefore a  common entry point into the insurance market for insurtech firms that  want to sell insurance products. NAIC notes that, after a new coverage  has generated sufficient data, the coverage often eventually moves to,  and is sold by, insurers in the admitted market. For example, private flood  insurance was developed and first offered in the nonadmitted market but  now also is offered in the admitted market.

The nonadmitted market is generally regulated somewhat differently than  the admitted market. According to NAIC, surplus lines insurers are  subject to regulatory requirements and are overseen for solvency by their  domiciliary state or country, but surplus lines transactions are regulated  through the licensing of surplus lines brokers. NAIC states these brokers  are responsible for ensuring that the surplus lines insurer meets eligibility  criteria to write policies in the state and is financially sound. Furthermore,  NAIC notes surplus lines brokers and producers must be licensed to sell  surplus lines insurance in each state in which they operate. State  insurance departments may have authority to suspend, revoke, or not  renew the license of a surplus lines broker or producer. Unlike admitted  insurers, surplus lines insurers may not have access to state guaranty  funds that are available to help pay claims in the event of an insurer  insolvency. In addition, according to NAIC, surplus lines insurers  generally have more freedom to change policy coverages and premium  rates than admitted insurers. NAIC stated that state regulators require  both nonadmitted and admitted insurance companies to maintain specific  levels of capital to continue to conduct business. According to NAIC, most  state insurance regulators also can use their authorities under state  statues such as an unfair trade practices act to ensure consumers are  protected (for example, to ensure that claims are paid and insurers or  brokers do not misrepresent policy terms) and to remedy other bad  conduct.

Other Participants in the Regulatory Framework for Insurance

NAIC assists state regulators with various oversight functions. While  NAIC does not regulate insurers, it provides services designed to make  certain interactions between insurers and regulators more efficient. These  services include providing detailed insurance data to help regulators  understand insurance sales and practices; maintaining a range of  databases useful to regulators; and coordinating regulatory efforts by  providing guidance, model laws and regulations, and information-sharing  tools.

The Federal Insurance Office was established in the Department of the  Treasury (Treasury) by the Dodd-Frank Wall Street Reform and  Consumer Protection Act. The office is headed by a director appointed  by the Secretary of the Treasury. The Federal Insurance Office monitors  all aspects of the insurance industry (including by identifying issues or  gaps in insurance regulation that could contribute to systemic risk in the  insurance industry), and helps develop federal policy on international  insurance matters, but is not a regulatory agency itself. The office also  serves as an information resource for the federal government and  coordinates with federal regulators, state insurance regulators, and NAIC.  The Federal Insurance Office also represents the United States in the  International Association of Insurance Supervisors and coordinates  federal efforts in international insurance matters.

Emerging Use of Technologies Can Reduce Insurance Costs and Expand Product Choices but Creates Privacy and Other Challenges

In recent years, the insurance industry has begun to adopt several types  of technology that are designed to provide a range of benefits to insurers  and consumers (policyholders), including improved risk monitoring,  reduced costs, and improved underwriting. However, the use of these  technologies also can create challenges for insurers and potential risks  for consumers, including changed business models, pricing fairness, and  privacy issues.

Insurance Industry Increasingly Using Mobile Apps, Big Data, and Other Technologies

Based on our literature review and interviews with stakeholders, we  identified six key technologies that have seen increased use in the  insurance industry in recent years and one technology (blockchain) that  has seen limited adoption and which the industry has been exploring for  wider use.

Mobile apps. A mobile app is software designed to run on a mobile  device, such as a smartphone or tablet computer. Insurance industry  stakeholders told us that several insurers have adopted mobile apps  to make their products and services available on mobile devices. For  example, insurers have adopted mobile apps that allow consumers to  purchase products online. An increased number of insurers in recent  years also have adopted mobile apps that allow customers to  complete tasks online such as submitting insurance claims and  turning on-demand insurance coverage on or off. Insurers also have  been using mobile apps to capture consumer data and usage patterns  (behaviors).

AI, algorithms, and machine learning. AI is the development of  computer systems to perform tasks and make decisions that  historically have required human intelligence to perform. Machine  learning is a subset of AI and focuses on the ability of machines to  receive a set of data and learn for themselves, changing algorithms as  they learn more about the information they process. (Algorithms are  sets of rules that a computer or computer program follows to compute  an outcome.) In the insurance industry, AI includes applications that  provide specific expertise or allow for task completion. For example,  AI provides on-line “chatbots” (sometimes called robo-advisory  services) that answer questions specific to an insurance product or  service. When a consumer communicates with a chatbot, the  chatbot takes the information the consumer provided and enters it into  an algorithm. Based on protocols outlined in the algorithm, the chatbot  provides a response to the consumer’s question. As the conversation  moves forward, the chatbot will adapt to answer more questions using  machine learning in real-time. According to insurance industry  stakeholders, insurers have been using algorithms to analyze  information obtained from other technology sources to determine what  a consumer’s risk profile is and then determine the consumer’s  premium rate based on their risk profile.

Big data. Big data are large volumes of data (often aggregated from  multiple sources to develop data sets). As we have noted in other  work, big data are frequently analyzed using predictive analytics,  machine learning, and data mining to identify trends, patterns and  characteristics. The insurance industry uses big data in several  ways, including analyzing consumer information, identifying risk  patterns and pricing risk, and analyzing information related to risk  pooling. Insurers also use big data to streamline and more accurately  underwrite products. For instance, an insurer may use big data to  determine whether consumers are high- or low-risk based on factors  identified from extensive datasets such as what they purchase online  or how they shop for insurance online. This is similar to lenders’  usage of big data. In a previous report, we noted that lenders were  using big data to evaluate risk and make lending decisions using real- time nontraditional information gathered from social media sites.

Internet of things. The internet of things refers to semi-autonomous  and internet-capable devices (such as machinery, home appliances,  thermostats, and smartphones) that have sensors that interact with  the physical environment and typically contain elements for  processing and communicating information. Some insurers stated  that the internet of things could be used in the insurance industry to  track and reduce risk, detect problems, and mitigate potential claims.  For example, a homeowner could have a smart home thermostat that  sends alerts when the power goes off and indoor temperature  decreases. With the homeowner able to address the issue in real  time, the homeowner could mitigate the risk of frozen pipes bursting  and potentially prevent a loss and an insurance claim. According to  CBInsights, insurers have partnered with insurtech firms that provide  this technology to offer real-time monitoring.

Drones. Drones are remotely piloted aircraft systems. Insurers have  been using drones for a variety of purposes in the insurance industry.  For example, insurers use drones to obtain aerial footage over a  disaster area to determine the amount of damage to a house or crop  field. Insurance companies also use drones to verify information  submitted by a policyholder in a claim or help determine the risk  presented by difficult-to-reach areas of a property, such as a roof.

Telematics. Telematics combines telecommunications and  information processing to send, receive, and store information related  to specific items such as automobiles or water heaters. Telematics  often uses sensors to relay information such as global positioning  system location, speed, and water levels. For example, sensors in an  automobile can provide data on a driver’s behavior (such as speed,  hard braking, and turning radius). The insurer may use that  information to determine the driver’s risk profile and help determine  the premium rate for that driver.

These technologies can be used together. For example, a telematics  device can be used to provide data to a mobile app, which can then send  the information to an AI algorithm to determine whether a claim should be  paid. See figure 1 for examples of the types of technologies that insurers  may use to automate the claims process.

Blockchain/ distributed ledger technology and smart contracts.

The insurance industry has been studying whether blockchain  technology could be used to improve insurance processes.  Blockchain refers to a type of distributed ledger technology—in which  multiple entities and locations share and synchronize datasets—that  facilitates and permanently records virtual transactions. Information is  uploaded and recorded in a series of secured blocks; the information  uploaded cannot be modified or erased once uploaded into the  blockchain (thus providing an accurate history of specific transactions  and information). According to insurers, blockchain could be used by  the industry to track insurance coverage history, expedite the claims  process, provide an audit trail of insurance transactions, and address  cybersecurity issues. For instance, a blockchain could expedite the  claims process by allowing agents, policyholders, and repair  companies immediate, secure access to certain data that are part of  the claim only as the data are needed. “Smart contracts” include  provisions for contract performance that can be executed by a  computer algorithm (for instance, on a blockchain). For example, an  insurer stated that a smart contract for homeowners insurance might  stipulate that if an earthquake of a specific size occurred in a  policyholder’s residential area, a claim payment for damage in a  specified dollar amount automatically would be made from the insurer  to the policyholder. According to NAIC, adoption of blockchain  technology in insurance is limited at this time.

Technologies Can Create Benefits but Also Present Risks to Insurers and Consumers

According to stakeholders with whom we spoke and literature we  reviewed, the use of technology in the insurance industry creates  potential benefits but also can create risks for both insurers and  consumers. We present stakeholder views on the benefits and challenges  technology presents in the primary areas they identified as being affected  by technology, which include (1) pricing and risk evaluation, (2) consumer  protection, (3) business operations and risk monitoring, and (4) product  offerings. See figure 2 for a summary of the potential benefits and  challenges we discuss.

According to stakeholders we interviewed and literature we reviewed, the  use of technology for determining insurance pricing and coverages  creates several benefits and risks for insurers and consumers:  Increased underwriting accuracy. Insurers and others told us that  insurers have been using technologies that provide enhanced analytic  capabilities or data from previously unavailable sources to increase  the accuracy of underwriting. These technologies allow insurers to  make new connections between policyholder characteristics and risk.  That is, insurers are using big data, AI, and algorithms to obtain and  analyze more information about consumers than they previously had  been able to obtain. For instance, a property/casualty insurer could  collect data on when consumers set their home alarms and use this  and other risk information to refine risk determinations for those  individuals. Another example is when insurers use data collected from  telematics devices in automobiles to inform the insurer about the  policyholder’s risk of being involved in an accident. A better  understanding of the risk presented by policyholders can help insurers  more accurately and effectively price and manage risks.

More individualized pricing. Insurers also have been using  technologies to underwrite policies in a way that results in more  individualized pricing, which benefits insurers and could benefit some  consumers. That is, big data can allow an insurer to use factors for  which traditional underwriting typically has not accounted. According  to stakeholders we interviewed, doing so allows an insurer to place an  individual in a smaller risk pool than if traditional underwriting factors  were used and to price coverage for that individual more in line with  the risk that individual presents. This can help an insurer better  manage its level of risk by offering lower prices to lower-risk  customers, charging more for higher-risk customers, or even declining  to offer coverage to consumers it considers high-risk.

Some stakeholders told us that technologies allow consumers to receive  more individualized premium rates, based on their risk characteristics,  than had been possible. For example, some insurers have been using  telematics devices to obtain information on policyholder driving habits and  the risk level they present and adjust premium rates based on this  information. As a result, consumers who engage in safer driving practices  receive the benefit of lower premiums. Policyholders also could use such  information to take actions that will lower their risk level and therefore  their premiums. For instance, consumers could seek to reduce specific  driving behaviors, such as fast stops or starts, which negatively affect  their premium rate. However, consumers with higher-than-average risks  could end up paying more or perhaps be declined coverage.

Stakeholders including an industry representative and a law firm in the  field indicated that insurers also might use data to exclude high-risk  consumers from marketing. For example, an insurer might not choose to  market to high-risk consumers to discourage them from buying their  insurance. This approach, in theory, helps insurers decrease the number  of high-risk policyholders they insure but could create difficulties for some  seeking coverage.

Two industry representatives and an academic in the field indicated that  the potential for decreased risk pooling creates a difficult question about  the minimum extent of pooling that is socially desirable. For example,  these stakeholders stated that when insurance underwriting becomes too  individualized, it might no longer serve an insurance function; that is,  there is very little pooling of risk. They stated it may be a desirable social  benefit to have a certain level of risk pooling to allow more people to  effectively manage their risk. In a November 2018 issue paper, the  International Association of Insurance Supervisors noted the potential  effect of more individualized underwriting on the fairness of consumer  outcomes. Among other findings, the paper noted the collection of more  data on policyholders may enable a more specific risk categorization that  could affect risk pooling principles and lead to issues around affordability  of certain insurance products or even availability (the potential for  exclusion). The association noted that insurance supervisors should  monitor whether such negative consumer impacts become a trend and, if  so, raise awareness at the appropriate policy and political level(s).

Validating consumer data and models. Insurers and insurtech firms  increasingly have been using AI and data collection algorithms to  gather data through mobile, wearable, and other internet-connected  devices and from online sites. According to two academics in the field,  collecting consumer data in large quantities and from multiple  disparate sources, including social media, poses challenges for  insurers in relation to validating those data. Insurers and insurtech  firms also face challenges associated with validating models that use  the data. Although AI and machine learning can help insurers and  agents underwrite risk more accurately, these stakeholders said that  these tools and processes can increase risk because the collected  information may be inaccurate or inappropriately used in determining  premium rates. For example, while models may indicate that certain  factors developed by AI from social media and other sources are  associated with increased policyholder risk, it may be difficult or  impossible for insurers to validate the accuracy of such data.

In addition, it can be a challenge for insurers to ensure that the use of  such data and models does not result in the use of prohibited factors in  determining premium rates, such as race or sex. For example, several  stakeholders told us that certain factors, while not specifically disallowed  by insurance regulations, could end up serving as a proxy for a  disallowed factor. One example cited by a stakeholder was the use of  information on consumer magazine subscriptions, which are not  prohibited on their own, but could serve as proxies for factors that are  prohibited.

Finally, it can be a challenge for insurers to document and explain to  regulators how rating models that use AI and machine learning work and  provide assurance that the rates produced by the models are not unfairly  discriminatory toward policyholders.  For example, some industry  stakeholders we interviewed said that these models are often developed  by data scientists and not actuaries, as had been the case in the past.  Unlike actuaries, they said data scientists who develop rating models may  not fully understand insurance-specific requirements, such as setting  premium rates that are not unfairly discriminatory, and may struggle to  measure the impact of new variables used in the models. Furthermore,  data scientists may be unfamiliar with insurance rules and regulations and  may not understand how to communicate their work to state insurance  regulators. One regulator described to us how one insurance company  was unable to explain how one of the factors that it entered into its  advanced risk model—proximity of a home to a day care center—related  to the risk that a consumer posed. An actuarial group suggested a greater  collaboration between actuaries and data scientists could provide greater  assurance that such rating models meet regulatory requirements.

Quality of data used in pricing. According to some stakeholders,  insurers’ use of nontraditional data and AI to develop insurance  pricing models creates two potential risks for consumers that parallel  some of the risks for insurers. First, as previously mentioned, insurer’s  use of nontraditional data and AI can create a risk that factors  unrelated to the risk presented by a consumer could be used to set  his or her premium rate. Stakeholders including a regulator said that  algorithms or big data may allow insurers to correlate certain factors  with higher claim rates, although the factors do not actually relate to  risk and may even act as a proxy for a prohibited factor such as race  or sex. As a result, some stakeholders noted that using such  information to determine a premium rate could be unfairly  discriminatory. Some stakeholders also said that such factors  unintentionally could become proxies for prohibited rating factors— such as race. For example, using information on a consumer’s  purchase history could serve as a proxy for race.

Second, some stakeholders indicated that when insurers use AI to  generate information on consumers, it is difficult to ensure these data are  accurate. Because the data were not explicitly provided by the consumer,  the consumer does not have a chance to correct or dispute the data. For  example, if an insurer uses AI to pull data from a consumer’s social media  accounts, those data could be incorrect or outdated, but the consumer  would not know the data were being used as a factor in determining his or  her premium rate. This would prevent the consumer from correcting the  information if it was wrong. Some stakeholders indicated that if an insurer  has difficulty understanding the factors and algorithms being used to price  the insurance product, the consumer most likely will not be able to  understand them.

According to stakeholders with whom we spoke and literature we  reviewed, some uses of technology can pose risks in terms of the  protection of consumer data. In addition, the use of the nonadmitted  market by insurtech companies and insurers may result in more limited  financial protections for consumers.

Cost of protecting consumer data. As noted earlier, insurers collect  and use consumer data in large quantities and from multiple disparate  sources, including social media, posing challenges for protecting  those data. For example, according to representatives of one  property/casualty industry association we interviewed, it can be  expensive to maintain the appropriate level of cybersecurity (including  technical and organizational measures) to prevent any unauthorized  access or use of the additional volumes and types of customer  information used in recent years.

Consumer privacy concerns. Stakeholders noted that insurers’  expanded use of consumer data raises concerns about the privacy of  such data. For example, an automobile insurer may collect data on a  consumer using a telematics device installed in the consumer’s  vehicle. While an insurer may use data on the consumer’s driving  habits for the purpose of adjusting premium rates, the device also  may collect information on where and when a consumer drives. This  is information consumers may not wish others to possess.

One academic also said there is concern about the ownership of the  data collected through telematics and other technologies, such as AI,  for the purposes of insurance. For instance, if an insurer obtained  data from a policyholder’s automobile with a telematics device, a  question exists about whether policyholders would have the right to  take those data to another insurer if they switched insurers or whether  the data belong to the first insurer. As we have described in other  work, this presents a larger privacy issue as it may not be possible for  a consumer to know exactly what is collected, or when and how the  data are used. This lack of knowledge reduces the consumer’s  control over their personal information and limits their ability to track  what data belong to them.

Some stakeholders mentioned concerns about insurers collecting  information from social media and other sources that consumers did  not explicitly consent to provide to insurers. The European Union (EU)  General Data Protection Regulation, which includes regulations  governing consumer consent, had an entry into force and application  date of May 25, 2018. According to an industry analyst, the General  Data Protection Regulation applies to insurance companies around  the world, including those in the United States, that process the  personal data of EU residents, regardless of the nationality of the  person in question or the location of the company. Furthermore, the  analyst notes that the regulation strictly defines legal uses of  individuals’ data and requires companies to ensure individuals can  explicitly and individually consent to other uses of their data. In prior  reports, we also noted data privacy concerns in relation to lender use  of financial technology.

Consumer protection concerns due to use of the nonadmitted  market. The nonadmitted market is a common entry point for  insurtech firms because of that market’s usefulness for innovative  insurance products with little loss history. However, the sale of  consumer insurance through nonadmitted insurers raised concerns  among several stakeholders. As we noted in a prior report,  nonadmitted insurers may face fewer regulatory constraints than  traditional insurers in the prices they can charge and their ability to  create and offer new products. While data do not exist on the  number of insurtechs using the nonadmitted market, industry  representatives told us that because of this greater regulatory  freedom, a number of insurtechs choose to operate as nonadmitted  insurers or as brokers selling policies through nonadmitted insurers.  As described in the Background, when consumers purchase  insurance from nonadmitted insurers, they do not have some of the  same consumer protections they would have if they purchased  coverage from an admitted insurer. For example, regulators conduct  limited reviews of the prices charged and the products sold by  nonadmitted insurers. And as noted earlier, if nonadmitted insurers  became insolvent, state guaranty funds may not be available to help  pay policyholder claims.

As we previously reported, some regulations serve to push potential  policyholders toward the admitted market because of the better  financial protections it provides (such as rate approvals and access to  state guaranty funds). For example, as noted earlier, a broker  placing coverage with a nonadmitted insurer generally must conduct a  diligent search for available coverage in the admitted market every  time a potential policyholder requests coverage in the nonadmitted  market. This helps ensure coverage is purchased from an admitted  insurer as often as possible.

Stakeholders offered differing assessments on the extent of any  related risks to consumers resulting from insurtech use of the  nonadmitted market. For example, an industry representative said the  nonadmitted market is not appropriate for most consumer products  because of the lower consumer protections as compared with the  admitted market. Two insurtech firms also have raised questions  about the ability of insurtech companies and other market participants  to properly comply with diligent search requirements. For example, an  industry representative told us it does not seem possible to satisfy the  diligent search requirement when products are sold on-demand  through a mobile app. Furthermore, the representative raised the  question of how a broker could legitimately search the admitted  market for coverage in cases in which an insurer offers immediate  coverage as soon as consumers complete applications on their  smartphones.

Conversely, some insurers, regulators, and NAIC said that  nonadmitted insurers are appropriately regulated and consumers are  not necessarily at any greater risk than when purchasing coverage  from admitted insurers. Also, several states have eliminated the  diligent search requirements. However, a consumer advocate noted  that such deregulation raises further consumer protection issues in a  market where less regulation is already a concern for consumers.

According to the literature we reviewed and stakeholders we interviewed,  insurers have been using various technologies to reduce their operating  costs but may face risks that affect their operations and business models.

Reduced costs. Stakeholders described how adopting various  technologies has led to reduced costs in four operational areas for  insurers:  Communicating with customers. Insurers have been using mobile  apps and chatbots to reduce the cost of providing information to  potential customers. For example, a consumer might be shopping  online for an insurance policy late in the evening. The insurer can use  a chatbot to interact with that consumer and answer questions about  insurance products. In the past, this might not have been possible if  an agent was not available to work nonstandard business hours or  insurers might have needed to hire and retain more agents to work  evenings and weekends.

Underwriting. Insurers have been using technology to reduce the  cost of underwriting insurance. For example, according to two  insurtech firms and one industry representative we interviewed, some  insurers review multiple sources of data with AI to automatically  review the information in a consumer’s insurance application, rather  than incurring the costs of hiring staff to do so. Through the industry  article review and stakeholder interviews, we found that insurers also  use the internet of things to obtain data from smart home alarms to  monitor consumer usage of alarm systems and thereby assess  consumer risk levels. This reduces the costs associated with  determining and analyzing risk factors.

Claims processing. According to some stakeholders we interviewed,  insurers now have the capability to digitally collect and automatically  analyze claim evidence, thereby reducing staffing needs and realizing  cost savings. For example, consumers can use their smartphones to  take photographs of their vehicles after an accident and send the  photographs and other information to their insurers through mobile  apps. On receipt of the photographs, insurers can use AI algorithms to  verify the damage shown—decisions that historically required human  intelligence to perform—and automatically start the claims process for  the consumer.

Fraud. Insurers are able to detect fraud, or decide which claims need  to be investigated further by employees, with information verified  using big data, the internet of things, and telematics. For instance,  an insurer may verify information provided in a claim against  information obtained from a smart device to determine if the  information provided by the policyholder was accurate. An insurer also  might identify a false burglary claim by verifying whether an alarm was  set during the time frame identified in the claim and reviewing video  from home security cameras.

Connecting to legacy computer systems. Some industry  stakeholders and association representatives we interviewed stated  that established insurers face significant challenges using new  technologies because they first have to replace legacy computer  systems or customize their systems to interface with new technologies  properly. According to industry stakeholders, legacy computer  systems were, in some ways, built around satisfying regulatory  requirements rather than enhancing the consumer experience or  providing more desirable products. They noted it can be costly and  difficult to replace such systems or to modify them to interface with  more consumer-centered systems, such as those being developed by  insurtech companies.

Changing roles for insurers and agents. According to some  insurance industry stakeholders, emerging uses of key technologies  and innovative business models could lead to changes in insurers’  roles and products. For example, with the advent of self-driving  vehicles, the liability for accidents could shift from the driver to the  vehicle maker or the company that produced the self-driving system.  In such cases, they said insurance coverage primarily would be sold  to those entities rather than the consumer, and the demand for and  amount of consumer automobile coverage sold could decrease  substantially. This could cause a shift in demand for products from  consumers to commercial lines, resulting in the potential loss of  business for some agents and insurers. Some industry stakeholders  we interviewed also told us that as more technologies (such as  telematics or other smart devices) were adopted to help consumers  mitigate risk, insurers likely would have to shift their business model.  That is, they would have to move from a model focused on sales of  policies, in which agents play a central role, to a model focused on  providing consulting services to consumers to help them prevent and  mitigate risk and loss.

Risk monitoring. Insurers have been using big data with data  aggregation and mining to improve monitoring of insured risks. More  specifically, several stakeholders told us that these tools and  analytical methods can help insurers quickly analyze volumes of data  from many sources in or near real time. For example, several  stakeholders gave the example of an insurance company using  sensors or other devices to continuously collect verified data on  movements of insured ships and their cargo. Such data can be useful  to insurers for understanding the risks associated with providing  insurance coverage and even can be used to provide the ship  carrying the cargo the appropriate insurance documentation required  for the port of entry. Several stakeholders also told us that some  insurtech companies have been using telematics to collect real-time  data on driver behavior, which they combine with other information  such as credit scores, to develop a fuller and more accurate picture of  the risk presented by a given policyholder. Insurers then can use  these risk profiles to determine whether to change a policyholder’s  rates or continue to insure them. Several stakeholders indicated that  such real-time information is likely more accurate than previous risk- assessment methods.

According to stakeholders we interviewed and literature we reviewed, the  use of various technologies to create new product offerings has created  several benefits for insurers and consumers.

Ability to offer on-demand products. Technologies have been  helping insurers tailor products to specific consumer needs and  expand offerings to niche markets. Some insurtech companies have  started offering on-demand insurance (insurance that policyholders  can turn on and off as needed). For example, one regulator and an  academic said that market research data demonstrated that  consumers want to be able to turn on insurance for their drones when  the drones are in use and turn it off when the drones are idle. Insurers  also have been developing similar on-demand products for drivers  working for rideshare companies such as Lyft and Uber and for Airbnb  and VRBO rentals (to cover the gaps that traditional homeowners  insurance, which generally provides coverage on a long-term basis,  might have in relation to short-term rentals of homeowners’  properties). On-demand products allow insurers to diversify their  product lines and attract more consumers, which is discussed later in  this report.

Increased convenience. With some insurers providing mobile apps  and chatbots, consumers are able to access insurance products and  information 24 hours a day. For example, consumers can use mobile  apps to get immediate quotes and underwriting decisions from some  insurers. In the past, consumers likely would have had to visit an  insurance agent or fill out a lengthy application and wait much longer  for an underwriting decision. And as previously discussed, some  insurers allow their policyholders to submit claim information and  photographs of damage through a mobile app without speaking with  an agent.

Increased consumer choice. According to NAIC and an insurtech  firm, consumers can benefit from the increased choice that comes  from insurers using technology to offer additional products and  services. For example, consumers obtain the ability to purchase  insurance for certain time periods for certain items such as drones  and action cameras, home sharing, or mile-based automobile  insurance. NAIC and the insurtech firm said that some insurers that  offer insurance to rideshare operators allow the policyholders to turn  the coverage on when they are working and off when they are not.  This can reduce premium rates for policyholders who only  occasionally work as rideshare drivers.

According to the industry articles we reviewed and the stakeholders with  whom we spoke, insurers’ use of technology also has benefitted  consumers by leading to the development of aggregator websites that  bring together quotes from multiple insurers and allow consumers to  comparison shop for insurance products. Some insurers said technology  may soon give consumers the added ability to further customize their  insurance policies by allowing them to select among various available  coverages and terms and essentially create a policy that best suits their  needs.

NAIC and State Regulators Initiated Actions to Address Challenges That Stakeholders Said Could Affect Adoption of Technologies

NAIC, state regulators, and others have initiated a number of actions  intended to monitor and address industry and regulator concerns  associated with insurtech, including any insurance rules and regulations  that could affect insurers’ adoption of technologies. These actions  address challenges in areas including (1) evaluation of underwriting  methodologies, (2) approvals for new insurance products, (3) customer  notification methods and time frames, (4) anti-rebating laws, (5)  cybersecurity, and (6) regulator skillsets and resources.

NAIC and State Regulators Have Taken Actions Designed to Monitor Insurtech Concerns and Maintain Insurer Oversight and Consumer Protection

NAIC and state regulators have initiated a number of actions intended to  monitor concerns that regulations could affect insurers’ adoption of  innovative technologies while maintaining oversight of consumer  protection issues. First, to monitor technology developments that may  affect the state insurance regulatory framework and to develop regulatory  guidance, as appropriate, NAIC created an Innovation and Technology  Task Force. According to NAIC, this task force provides a forum for  regulator education and discussion of innovation and technology in the  insurance sector. For example, the task force has held discussions on the  collection and use of data by insurers and state insurance regulators—as  well as new products, services, and distribution platforms—to educate the  regulators on how these developments affect consumer protection,  privacy, insurer and producer oversight, marketplace dynamics, and the  state-based insurance regulatory framework. In addition, the task force  has held forums on emerging issues related to companies or licensees  leveraging new technologies. Areas discussed included developing  products for on-demand insurance purposes, reviewing new products and  technologies affecting the insurance space, and potential implications for  the state-based insurance regulatory structure.

In addition, in 2012 the EU-U.S. Insurance Dialogue Project was formed,  in which EU and U.S. insurance regulators discuss emerging technology  issues in the international insurance industry. During the project’s sixth  forum in November 2018, the regulators and representatives from  industry and consumer organizations discussed challenges and  opportunities relating to issues including cyber risks, the use of big data,  and AI. According to a project publication, the dialogue project enhanced  mutual understanding of respective regulatory frameworks and initiatives  between the United States and European Union, which will help ensure  effective coordinated supervision of cross-border insurance groups for the  benefit of policyholders. In 2018, the project published an issues paper  on big data. The paper discusses data collection, portability, quality, and  availability and how insurers and third parties use data in marketing,  rating, underwriting, and claims handling. Future work by the project may  include discussion of insurers’ use of third-party vendors, disclosures to  applicants, and insurers’ use of AI models.

NAIC and State Regulators Initiated Actions to Address Specific Insurtech Challenges

NAIC and state regulators have initiated a number of actions intended to  address industry and regulator concerns about certain insurance rules  and regulations that a number of them said could affect insurers’ adoption  of technologies.

Evaluating Underwriting Methodologies That Use Technology

Stakeholders, including regulators, told us that regulators can face  challenges in assessing new underwriting methodologies, such as those  that use predictive analytics or AI. Reviewing predictive analytics can be a  challenge for regulators because of the amount of data used to develop a  model, the complexity of techniques, and limited staff resources  (discussed in more detail later in this section). In addition, insurers  employ different technological approaches, and their documentation and  explanation of the methods and approaches differ. Finally, the data and  models insurers use dynamically change and may have to be re- submitted for review even before regulators have an opportunity to review  the original submission.

One state regulator and an industry stakeholder also told us that while an  insurer may know the universe of factors from which an AI system pulls,  the insurer may not know, or be able to describe for regulators, how the  system uses those factors to determine a premium rate. In turn, this may  prevent regulators from understanding the system or validating the  insurer’s assertions about the system. For example, one state regulator  told us that after presenting a rate scheme based on nontraditional  factors, an insurer was unable to provide assurances or explanation to  the regulator that the resulting premium rates were not unfairly  discriminatory.

In 2018, NAIC’s Casualty Actuarial and Statistical Task Force began  developing a white paper on best practices state regulators can use when  reviewing predictive models and analytics filed by insurers to justify rates  and guidance they can use for their review of rate filings based on  predictive models. NAIC officials told us the Casualty Actuarial and  Statistical Task Force will receive comments on the white paper and then  evaluate how to incorporate best practices into the Product Filing Review  Handbook and recommend such changes to other NAIC working groups.

Insurtech firms and other stakeholders told us that working through other  regulatory processes, such as the insurance product filing and approval  process, often can be inefficient and time consuming because insurers  must file in every state in which they wish to sell a product and state  requirements can vary. We have noted such difficulties in the insurance  market in general. These challenges can be exacerbated by rapid  technological evolution in insurer products and risk models. In addition,  some stakeholders noted that a lengthy product approval process can be  challenging for technology-oriented products. For instance, an insurtech  firm may develop a new product quickly to meet consumer demand but  might not be able to get the product to market quickly. Some also said  that products might become obsolete before the filing approval process  was completed. Some stakeholders told us that such challenges can  motivate insurtechs to sell insurance through nonadmitted insurers  because such insurers have more freedom in altering and selling new  products. As we have noted, doing so can bring risks for consumers.

In December 2017, the American Insurance Association proposed the  Insurance Innovation Regulatory Variance or Waiver Act (Proposed  Model Law) to NAIC. The proposed model law would urge allow  regulators to create regulatory “sandboxes,” wherein certain regulatory  requirements would be waived for insurers seeking to pilot innovative  products. Specifically, the proposed model law would authorize  insurance regulators to grant variances, waivers, or no-action letters with  respect to statutory or regulatory requirements that make it more difficult  to introduce new insurance technologies, products, or services. Under the  proposed model law, regulators also would be authorized to attach terms  and conditions meant to protect consumers to such variances or  waivers. Some stakeholders with whom we spoke believed that  regulatory sandboxes would not work in the U.S. state-based regulatory  framework. For example, some stakeholders told us it would be  inappropriate for a state to change legal or regulatory requirements for  some but not all insurers or grant exceptions to laws passed by a state  legislature to some insurers and not others, as it would no longer be a  level playing field.

State regulators generally told us they believe that the current regulatory  framework provides state regulators with enough flexibility to allow for  technology-based innovation. Accordingly, some states have been  promoting the use of innovation in the insurance industry by hosting  technology sandboxes, where technology companies meet regularly with  state regulators to improve companies’ knowledge of insurance  regulations and also educate regulators about how the technologies work.  According to stakeholders, these technology sandboxes are not the same  as regulatory sandboxes that have been established in other nations, as  they do not allow waivers of laws and regulations for insurtech companies  to test their products.

Insurtech firms we interviewed told us that regulations that require paper  notifications and U.S. mail delivery for certain processes can make it  difficult or more costly for them to offer products with features such as  immediate underwriting or on-demand policies. For example, according to  insurers and other industry stakeholders, some state laws require that  insurance policy cancellation notices be sent by U.S. mail rather than by  email. One insurtech firm told us that it would be very costly to meet  requirements for mail delivery of insurance policies and cancellation  notices because they would have to set up another delivery mechanism  (in addition to their electronic notification system).

Industry stakeholders also told us that certain laws and regulations that  require a minimum period of time before a consumer-initiated policy  cancellation takes effect can present challenges for products designed to  allow consumers to immediately turn certain coverage on or off. For  instance, if consumers used a mobile app to indicate they wanted to turn  their automobile insurance coverage off temporarily, it could be unclear if  this constituted an actual policy cancellation. Some stakeholders are  concerned that states may require an insurance company to give the  policyholder a written notice of cancellation at least 30 days before the  end of the policy term. Similarly, industry stakeholders told us that some  current state regulations could impede on-demand coverage because  policies usually must indicate that coverage begins at 12:01 a.m. on the  day after a policy is signed and approved. For instance, for on-demand  policies that allow on/off subscription at the consumer’s request, it can be  unclear whether they are covered the minute that they initiate the  coverage, or if they must wait until the following day for coverage to be  effective.

According to NAIC, many states have taken steps to work within or  modify existing laws and regulations to adapt to the increased use of  technology in the insurance industry. For example, to address concerns  that insurers are required to provide customers with a written, 30-day  notice of a policy cancellation, NAIC conducted an analysis in 2018 that  found that many states instead require “adequate” notice and that  approximately 44 states allow notices to be provided electronically.  However, some stakeholders in the insurance industry told us that state  cancellation notice requirements are still a barrier to innovation.

According to industry stakeholders, many states have anti-rebating laws  that generally prohibit insurers from providing consumers with anything of  value as an inducement to purchase insurance. NAIC Model Law 880  states that unless expressly provided by law, no insurer may knowingly  pay any rebate or incentive to an insured to induce them to purchase a  specific product. Insurers, industry stakeholders, and regulators  (including NAIC’s Innovation and Technology Task Force) told us that  anti-rebating laws can be a barrier to innovation because they could  preclude insurers from offering devices that could be used to help  insurers and consumers monitor risk. For example, if an insurer offered a  policyholder free use of a telematic device (to help insurers collect real- time data and potentially help the policyholder make driving habits safer),  it could be considered an inducement and violate anti-rebating laws. The  same possibility exists if an insurer were to provide a policyholder with a  device to monitor the operating conditions of a boiler to prevent potential  water damage should a problem arise. As a result, anti-rebating laws may  make it difficult for insurers to make use of certain technologies that could  benefit both insurers and policyholders.

In contrast to the consensus on the legitimacy of electronic  communications, there is little consensus among states on addressing  insurers’ concern that anti-rebating laws are a barrier to innovation.  According to NAIC, states vary widely on the types of items insurers are  allowed to provide for free to customers, with some states having dollar  limits on allowable items or allowing items that are specifically linked in a  policy. In other cases, it is unclear what is allowable. At NAIC’s fall 2018  meeting, participants noted that some of the NAIC bulletins related to the  anti-rebating model law have not addressed whether technologies such  as telematics that provide benefits to consumers are considered rebates.  According to NAIC, others noted that states typically have taken the  position that if a rebate or incentive reduces risk that is the most important  issue for all parties involved. NAIC officials noted during the fall 2018  meeting that they will continue to monitor the issues involved.

NAIC adopted a model law and states have passed new laws governing  cybersecurity and data protection to safeguard the increasing amount of  personal data used by insurers. In 2017, NAIC approved the Insurance  Data Security Model Law, which creates a legal framework for requiring  insurance companies to operate cybersecurity programs. The law outlines planned cybersecurity testing, creation of an information security  program, and incident response plans for breach notification procedures.  The NAIC model law is only a guideline until adopted by individual states,  but NAIC noted that in 2018 and 2019, Michigan, Ohio, Mississippi, and  Alabama adopted laws based on the NAIC model and additional states  have pending legislation. In an October 2017 report, Treasury endorsed  the model law and recommended that Congress consider preempting the  states if the law were not adopted over the next 5 years.

At the state level, New York’s Department of Financial Services noted it  was the first state agency to establish cybersecurity regulations, which  became effective March 1, 2017. In May 2018, South Carolina enacted  the South Carolina Department of Insurance Data Security Act, which  NAIC has characterized as an adoption of the model law. In December  2018, Michigan adopted a similar law. Separately, in June 2018 California  passed a law giving consumers more control over their personal  information. California’s law generally requires companies to report to  customers, upon their request, the categories of personal information they  collected about the customer, the business or commercial purpose for  collecting and selling such personal information, and what categories of  third parties received it.

Hiring and Retaining Staff with Technical Expertise

According to industry and regulatory stakeholders, the complexity and  evolving nature of the models and approaches used by insurers may  outpace the rate at which regulators can educate themselves on those  models and approaches. For example, regulators trained in the current  rating models may need to acquire new skills to understand and validate  advanced and evolving models.

In addition, stakeholders told us that new technologies used by insurers  can pose significant challenges to regulators partly because of the  resource requirements. For instance, regulators and other stakeholders  told us that regulators often do not have enough staff with technical  expertise, such as data analytics skills, and find it challenging to hire and  retain such staff due to limited resources.

NAIC has initiated actions to address concerns that state insurance  regulators may not have staff with the knowledge or skill sets to address  more complex predictive models. For example, in 2018 NAIC  management conducted a survey of states regarding the appropriate  skills and potential resources NAIC membership may need to deal with  big data. Subsequently, in April 2019, NAIC management made  recommendations to its Big Data Working Group to hire a technical staff  resource to provide technical support for state insurance regulators in the  review of actuarial models; develop a tool for state insurance departments  to share information on model reviews; and develop a training and  education program. NAIC officials told us they also plan to develop a  white paper to provide state regulators with guidance on the use of  chatbots and AI in the distribution of insurance and the regulatory  supervision of these technologies.

As many of the regulatory initiatives that NAIC and states have  undertaken to address challenges associated with the implementation of  new technologies are under development (or recently developed), the  impact of these actions on innovation and consumer protection is  unknown. It will be important for NAIC and state insurance regulators, as  well as the Federal Insurance Office, to continue monitoring  developments in these areas.

We provided a draft of this report to Treasury and NAIC for review and  comment. Treasury and NAIC provided technical comments that we  incorporated as appropriate.

We are sending copies of this report to the appropriate congressional  committees, the Secretary of the Treasury, the Chief Executive Officer of  the National Association of Insurance Commissioners, and other  interested parties. In addition, the report is available at no charge on the  GAO website at http://www.gao.gov.

If you or your staff have any questions concerning this report, please  contact me at (202) 512-8678 or ortiza@gao.gov. Contact points for our  Offices of Congressional Relations and Public Affairs may be found on  the last page of this report. GAO staff who made major contributions to  this report are listed in appendix II.

Appendix I: Objectives, Scope, and Methodology

This report (1) identifies uses of technologies and the benefits and  challenges they might present for insurers and their customers, and (2)  discusses what stakeholders identified as key challenges that could affect  the adoption of new technologies, and actions that have been taken to  address those challenges.

While insurance technology (insurtech) does not have a standard  definition, for the purposes of this report we defined it as the use of  emerging technologies by insurance companies. We focused on insurtech  activities in the property/casualty and life sectors of the U.S. insurance  market, including information on personal and commercial insurance  where available. We did not include the health insurance sector in our  scope because of significant differences between that sector and the  property/casualty and life insurance sectors in terms of the types of  products offered and the methods by which they are sold and regulated.

To identify technologies being used in the insurance industry and gain  insights about their (potential) benefits and challenges for insurers and  customers, we conducted a literature review of scholarly and peer- reviewed material, trade and industry articles, government reports,  conference papers, general news, association, nonprofit, and think tank  publications, hearings and transcripts, and working papers that described  these technologies and their uses. We conducted searches of the  ProQuest and HeinOnline databases to identify studies published from  January 2015 through June 2018 that were relevant to our research  objectives. Because insurtech is a fairly new field, we found few academic  publications related to our objectives. We also conducted background  research for examples of technologies being used in the insurance  industry and their associated benefits and challenges.

We also conducted semi-structured interviews with cognizant  stakeholders and reviewed documents provided by them to obtain  information on and descriptions of current, in-development, and potential  future uses of existing or new technology in the insurance industry. We  also obtained their views on the benefits and challenges experienced or  expected by insurance companies as well as the (potential) benefits and  challenges for consumers. We conducted more than 35 interviews with  representatives of regulatory organizations, including the Federal  Insurance Office; National Association of Insurance Commissioners  (NAIC); state insurance regulators in Arizona, California, Connecticut, and  Michigan; and the National Council of Insurance Legislators. We also  interviewed three academics, representatives of one consumer group, 13  traditional insurance and reinsurance providers and industry associations,  two actuarial professional associations, four consulting groups, two law  firms in the field, and seven insurtech firms. We identified potential  interviewees by conducting internet research, reviewing literature search  results, and reviewing recommended interviewees from our initial  interviews. We selected interviewees based on their relevance to the  scope of our review. Based on our literature review and interviews with  stakeholders, we identified seven recently used and emerging  technologies in the insurance industry: (1) mobile applications; (2)  artificial intelligence (AI), algorithms, and machine learning; (3) big data;  (4) internet of things; (5) blockchain/ distributed ledger technology and  smart contracts; (6) drones; and (7) telematics.

To obtain information about challenges that could affect the adoption of  innovative technologies, we identified relevant laws and regulations  pertaining to insurance technology innovation by reviewing prior GAO  reports on financial regulation, interviewing regulators and industry  participants, and analyzing relevant documents, including relevant NAIC  model laws and state laws and regulations. We also conducted semi- structured interviews with and reviewed documents provided by the key  stakeholders identified in the first objective to identify (1) any actions  NAIC and selected state insurance regulators were taking on new  insurance technologies, and what challenges, if any, insurers’ use of new  technologies creates for regulators; (2) what is known about the impact of  any actions taken by NAIC and state insurance regulators on innovation  among insurance companies and on consumer protection; and (3)  stakeholders’ views on the applicability of foreign regulatory actions for  U.S. insurtech markets.

We conducted this performance audit from April 2018 to June 2019 in  accordance with generally accepted government auditing standards.  Those standards require that we plan and perform the audit to obtain  sufficient, appropriate evidence to provide a reasonable basis for our  findings and conclusions based on our audit objectives. We believe that  the evidence obtained provides a reasonable basis for our findings and  conclusions based on our audit objectives.

Appendix II: GAO Contact and Staff Acknowledgments

In addition to the contact named above, Patrick Ward (Assistant Director),  Deena Richart (Analyst in Charge), Gina Hoover, Hadley Nobles, Akiko  Ohnuma, and Tyler Spunaugle made key contributions to this report. Also  contributing were Emei W. Li, Barbara Roesmann, Jena Y. Sinkfield,  Frank Todisco, and Helen Tulloch.

The innovative use of technology by insurance companies has the potential to improve customer experiences and lower costs. But it could also create risks for consumers and challenges for regulators.

For example, we found that some insurers have begun to use artificial intelligence to explore ways to reduce costs by automating information gathering and risk assessment. However, this could make it more challenging to ensure that factors like race are not being used in the models that determine premiums. We also found that how insurers collect and use consumer data raises questions about data accuracy, privacy, and ownership.