A fixed-scope AI vendor risk review for MGAs and MGUs: vendor register entry, risk tier, decision memo, conditions and an oversight calendar.
For CROs, CCOs and vendor-risk leads who need a documented decision on AI vendors before they sign or renew.
Every AI decision, with the evidence behind it.
See the illustrative decision memo below
MGAs & MGUs > Vendor Risk Review
An AI vendor risk review is a documented assessment of a third-party AI tool's intended use, data, decision impact, controls and contract position, ending in an accountable decision to approve, approve with conditions, remediate or reject it.
Your vendor security questionnaire tests the vendor's controls. An AI vendor risk review records the decision: who made it, what the AI is allowed to do, where people review its output, what conditions apply and when it gets looked at again. You need both.
AI Governance Advisors (AIGA) runs this review for MGAs and MGUs as the MGA AI Vendor & Procurement Risk Review Sprint.
Most Sprints start with one decision and a date attached.
New or renewing AI vendor
Carrier or capacity-provider request
Board directive
Exam, audit or control review
High-impact underwriting, claims or fraud use case
We record the vendor, the AI features in scope, the data going in and out, where the output enters the underwriting, claims or fraud file and who owns the tool on your side.
Output: vendor register entry.
We set the depth of review by the decision boundary: does the tool draft, recommend or decide? We weigh potential harm to policyholders or claimants, human review, explainability and how much you rely on the vendor's data and models, aligned with the NAIC bulletin's proportionality factors.
Output: risk tier with rationale.
We send the vendor written questions and evidence requests, built from our AI vendor review checklist for MGAs plus questions about the model provider behind the vendor. Then we run a decision session with your owners.
Output: decision memo.
We set conditions with named owners and due dates, a reassessment date and the events that trigger an earlier review: a model change, new data, a new line of business or a carrier request.
Output: conditions log and oversight calendar.
Many AI vendors build on a model from a third-party provider, so the Sprint asks about that provider too.
These questions are now on the public record. In October 2026 the New York City Council questioned AI developers under oath about safety. Its pending bills would require third-party validation and a human-operated shutdown capability for AI models sold or deployed in the city (Int. 1100), and 24-hour reporting of AI safety incidents by city contractors (Int. 1109). Both are in committee and aren't law.
Insurance: Does the vendor, and its model provider, carry coverage that would respond to an AI-related claim? Ask to see: a certificate or summary of coverage. Your broker and counsel judge whether it's adequate.
Independent evaluation: Has anyone independent of the provider evaluated the model, and can you see the results? Ask to see: who evaluated it, the scope, the date and any published summary. We record what exists. We don't validate models.
Shutdown and fallback: Can the AI feature be switched off quickly without stopping your workflow, and who can do it? Ask to see: the disable procedure and the manual fallback.
Incident reporting: What counts as an AI incident, how fast will you hear and does that include incidents at the model provider? Ask to see: incident definitions, notice timelines and a sample notice.
Sources: NYC Council hearing releases of October 5, 2026 and October 16, 2026 | Int. 1100-2026 | Int. 1109-2026.
Use them with the checklist on our MGA page. Last reviewed: October 19, 2026.
What it is: the record of the tool.
Contains: vendor, product and version, AI features, use case, data and owner.
Used by: vendor risk and compliance.
What it is: how much review and oversight the use needs.
Contains: the tier and the reasons for it.
Used by: the CRO or CCO.
What it is: the accountable decision.
Contains: the outcome (approve, approve with conditions, remediate or reject), the rationale, open items, residual risk and a signature block for your decision owner.
Used by: the executive sponsor and the board.
What it is: what must be true for the tool to stay in use.
Contains: for example, human review points, data limits, monitoring and contract asks routed to your counsel.
Used by: the business owner.
What it is: what happens after signature.
Contains: reassessment date, early-review triggers, condition check dates and carrier reporting dates.
Used by: compliance and carrier relationship leads.
A Sprint takes about 4 to 5 weeks and covers up to 3 AI vendors.
You keep risk acceptance and deployment authority, and every artifact stays with your team.
Illustrative example only. Fictional vendor and scenario. Not client work and not an outcome AIGA has delivered.
Northwind Claims Triage AI (fictional), used by a fictional specialty MGA to score and route new property claims. Recommends a queue. An adjuster makes every decision. Owner: Head of Claims.
Tier rationale: Tier 2, decision-supporting. Output affects how fast claimants are handled, so adjuster review is required before any claimant-facing action.
Decision: Approve with conditions.
Condition 1: Adjusters can override every routing score, and overrides are logged. Owner: Head of Claims. Due: before go-live.
Condition 2: The vendor confirms in writing that MGA claims data isn't used to train shared models. Owner: Vendor Risk Lead, with counsel. Due: before signature.
Open item: The vendor hasn't yet said whether its model provider's insurance would respond to an AI-related claim. Routed to the broker and counsel.
Residual risk: Routing scores may drift on claim types the vendor has seen less often. Monthly override rates are the watch signal.
Reassessment: 12 months after go-live, or sooner on a model change, new line of business or carrier request.
Go-live: confirm conditions 1 and 2 are closed.
Month 1 onward: monthly override-rate review.
Month 6: condition check and carrier update.
Month 12: full reassessment.
Illustrative example only. Fictional vendor and scenario. Not client work and not an outcome AIGA has delivered.
Timeline: about 4 to 5 weeks, covering up to 3 AI vendors.
We share fees after a short scoping call.
Our work doesn't mean a regulator, carrier or auditor has approved your program. See the full boundaries on our MGA page.
The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (adopted December 4, 2023) is addressed to insurers. Its guideline 4.0, "Third-Party AI Systems and Data," covers due diligence on third-party AI, contract terms on audit rights and regulator cooperation (where appropriate and available) and audits or other activities that confirm vendor compliance.
The NAIC implementation map (status as of October 8, 2026) lists 29 jurisdictions that have adopted the bulletin: 27 states, the District of Columbia and Puerto Rico. Draft questions in the NAIC AI Systems Evaluation Tool, piloted in 12 states from March to September 2026, ask insurers about oversight of AI used by service providers, including MGAs.
On October 15, 2026, the Financial Stability Board finalized 12 Sound Practices for Responsible Adoption of AI for financial institutions, including appropriate and effective human oversight and management of risks from third-party AI dependencies. They're guidance for firms to adopt, with no binding force.
Sources: NAIC Model Bulletin | NAIC implementation map | NAIC AI Systems Evaluation Tool pilot summary | FSB press release, October 15, 2026.
How these rules apply to your MGA is a question for your counsel. Last reviewed: October 19, 2026. More on the NAIC bulletin on our MGA page.
AI Governance Advisors (AIGA) is senior-led and platform-neutral. The founders, Todd Dietrich and Suzanne DiCicco, scope and deliver the work themselves. Each brings over 25 years of experience. About AIGA
Related: AI Insurability. For MGAs underwriting AI risk itself, see AI Insurability.
It delivers five working records: a vendor register entry, a risk tier with its rationale, a decision memo, a set of conditions with owners and due dates and an oversight calendar. Each one is written for the person who uses it, from vendor risk to the board, and all of them stay with your team after handover.
About 4 to 5 weeks, covering up to 3 AI vendors. The written scope names the vendors or use cases, the outputs and the assumptions. The timeline depends on how quickly the vendor answers our questions and when your owners can meet for the decision session. If your decision date is sooner, tell us on the scoping call.
Your security questionnaire tests the vendor's controls. The Sprint records your decision about the AI: what it may do, where people review its output, what conditions apply, who accepted the residual risk and when it gets reassessed. Use both. The questionnaire's results become one input to the decision memo.
Every Sprint ends in one of four recorded outcomes. Approve: the material questions are answered. Approve with conditions: the tool can be used once named conditions with owners and dates are in place. Remediate before use: specific fixes or contract terms must come first. Reject: an unresolved gap sits too close to underwriting, pricing or claims outcomes.
Yes. Existing deployments and renewals are in scope. A renewal is often the best moment to review, because you can still ask for contract terms, change notice and evidence before you commit again. The scope states which vendors and use cases are covered, so an existing tool is reviewed the same way as a new one.
No. The decision memo records your MGA's decision and the evidence behind it. It isn't legal advice, an audit, an attestation, actuarial work, security testing or model validation. Those stay with your counsel, auditors, actuaries, security team and qualified specialists. The decision and the risk acceptance stay with your MGA.
Bring the vendor name and use case, the proposal or draft contract, any vendor documentation or answers you already have, the carrier or capacity-provider request if there is one, your decision deadline and the name of the internal owner. If some of these are missing, the scoping call can still go ahead.
Book a trigger-qualification call. We'll come back with a fixed-scope Sprint proposal with named outputs, assumptions and exclusions.
Every AI decision, with the evidence behind it.
Senior-led. Platform-neutral. Principal-delivered.
MGA AI Vendor & Procurement Risk Review Sprint