NYDFS Circular Letter 7 is New York’s rulebook for insurers that let a model or outside data shape who gets coverage and at what price. The New York State Department of Financial Services issued Insurance Circular Letter No. 7 on July 11, 2024, after publishing a proposed version on January 17, 2024. It sets out what the Department expects when insurers use artificial intelligence systems and external consumer data in underwriting and pricing: fairness testing, governance, vendor oversight and specific notices to applicants.

Insurtech startups, data brokers and model vendors that sell into New York underwriting feel its terms through their customers’ contracts. This explainer covers scope, the three-step discrimination test, documentation and applicant notices.

Who and what the letter covers

The letter is addressed to all insurers authorized to write insurance in New York, Article 43 corporations, health maintenance organizations, licensed fraternal benefit societies and the New York State Insurance Fund. A footnote excludes Child Health Plus, Essential Plan and Medicaid managed care coverage.

It defines two terms that run through every section:

  • AIS (artificial intelligence system): any machine-based system designed to perform functions associated with human intelligence, such as reasoning, learning and self-improvement, used in whole or in part to supplement or stand in for traditional underwriting or pricing, or to identify “lifestyle indicators.”
  • ECDIS (external consumer data and information sources): data used for the same purposes. The definition excludes an MIB Group member information exchange, a motor vehicle report, prescription drug data and a criminal history search.

The Department kept these definitions so the letter covers AI systems whether or not they use external data. The letter applies only to underwriting and pricing, not to claims or other stages of a policy’s life. DFS says it may examine an insurer’s use of these tools in regular or targeted examinations under Insurance Law § 309, or through a special report request under § 308.

Fairness starts with the data

Before any model runs, the letter asks two things of external data. First, actuarial validity: insurers should be able to show the data are supported by generally accepted actuarial standards and have “a clear, empirical, statistically significant, rational, and not unfairly discriminatory relationship” with the risk being priced.

Second, a proxy assessment. Insurers should evaluate whether a data source correlates with membership in a protected class. That correlation can be measured with data the insurer holds or inferred with accepted statistical methods. If a correlation appears, the insurer should consider whether a legitimate business necessity requires the data.

An insurer may not use outside data or a vendor model to collect or use information it would be barred from collecting directly, and it “may not rely solely on a third-party’s claim of non-discrimination.”

The three-step comprehensive assessment

The core of the letter is a minimum test for whether an underwriting or pricing guideline built on AI or external data discriminates unfairly or unlawfully:

  1. Disproportionate adverse effect. Check whether the use produces worse outcomes for similarly situated insureds or for a protected class, for any class that can be identified from available data or reasonably inferred. If there is no prima facie showing, the evaluation can stop here.
  2. Explanation. If there is such an effect, assess whether a legitimate, lawful and fair rationale accounts for it. If not, modify the model or data and start again at Step 1.
  3. Less discriminatory alternative. If a rationale exists, search for and document an alternative variable or method that would meet the business need with less disparity. If one exists, adopt it and retest from Step 1. If none exists, continue model risk management and repeat Step 3 at least annually.

Testing should happen before an AI system goes into production, on a regular cadence afterward and whenever the data or model changes materially. The letter encourages several statistical metrics and lists examples: adverse impact ratios, denial odds ratios, marginal effects, standardized mean differences, z-tests and t-tests, and drivers of disparity estimated with methods such as Shapley values or regression coefficients. Insurers are not expected to collect extra data about individuals to run these tests.

Numbers alone do not satisfy the letter. Its qualitative assessment requires being able to explain “at all times” how the AI system works and the logical link between each variable and an applicant’s risk.

Governance, documentation and complaints

The letter ties AI oversight to the corporate governance rule in 11 NYCRR Part 90. The board keeps responsibility for overall outcomes, while senior management runs day-to-day implementation, for example through a cross-functional committee drawing on legal, compliance, risk, product, underwriting, actuarial and data science staff.

Written policies on AI and external data should be reviewed and approved at least annually. They should include training for relevant staff. The documentation the Department may request includes:

  • an up-to-date inventory of AI systems in use, under development or recently retired;
  • a description of how each system works, its inputs and their sources, its purpose and its restrictions;
  • a change log with the reasons for each change and who approved it;
  • at least annual testing of model outputs, including drift from machine learning or other automated updates;
  • a data lifecycle process covering acquisition, storage, sharing, archiving and destruction.

Internal audit should cover the framework, including data accuracy and potential bias. Insurers must also be prepared to receive and answer consumer complaints about these tools and keep those records.

Vendors do not take the responsibility

Insurers “retain responsibility” for tools and data supplied by third parties. The letter asks for written standards for acquiring vendor data and models, a way to report incorrect data back to the vendor and a process to remove it from the insurer’s own systems. Where appropriate and available, contracts should give the insurer audit rights or audit reports and require the vendor to cooperate with regulatory inquiries.

What applicants must be told

When an insurer uses AI or external data, its notice to the applicant should disclose whether it uses AI in underwriting or pricing, whether it uses data about the person from external vendors, and that the person can ask for the specific data behind the decision, with contact details for doing so. After a declination, limitation, rate differential or other adverse decision, the reasons should include the information relied on and its source.

The letter is blunt on vendor secrecy: an insurer “may not rely on the proprietary nature of a third-party vendor’s algorithmic processes” to justify vague reasons. Failure to disclose the material elements of an AI system and its data sources may be an unfair trade practice under Insurance Law Article 24.

It also clarifies Circular Letter No. 1 (2019) for accelerated underwriting. Eligibility criteria for an AI-based process, such as age or coverage limits, should be disclosed in advertising and application materials. An applicant moved out of that process into traditional underwriting should get written reasons within 15 days and a way to review the data that disqualified them.

Where it fits for fintech and AI teams

Cybersecurity expectations for the same firms come from DFS’s separate AI cybersecurity guidance. The credit side has its own reason-giving duty, covered in our explainer on AI credit denials and adverse action notices. For larger banks, SR 26-2 model risk management sets validation expectations.

As of October 18, 2026, Circular Letter 7 appears in DFS’s list of circular letters issued from 2021 to 2024 and not on its list of withdrawn circular letters.

This article explains published regulatory guidance. It is not legal or compliance advice for any particular insurer or vendor.

Sources