This is what an insurer receives after an AQE assessment: a certificate with a verdict, and an evidence book showing every answer and finding behind it. The example is a digital small-commercial carrier about to launch an AI model that automatically declines submissions outside its appetite, ahead of expanding into two further states. A CLEARANCE sample shows the check on the AI the same carrier already has live, and a UK insurance sample is also available.
The automated decline model should not go live until the governance conditions are resolved. A named owner and full control do not offset weak governance on a system that decides on its own about applicants.
Reference AQE-29A9B47D · US jurisdiction · Framework 2.0.4 · Rules 2026-02-US
Exposure: high. The model declines applicants on its own, with underwriters reviewing after the fact, across the underwriting department.
Control: full. A named owner can stop the system and the board has sight of its risk profile.
Named accountable owner: Dana Whitfield, Chief Underwriting Officer (fictional).
The verdict comes from six answers. The same answers, assessed under the same framework version, always produce the same verdict.
| Question | Answer |
|---|---|
| Is someone officially in charge of this AI system? | Yes |
| Can that person stop or pause it if something goes wrong? | Yes |
| Does senior leadership or the board know about it? | Yes |
| How much does the AI decide on its own? | Decides on its own, reviewed after |
| How widely will it be used? | Department |
| Deployment-blocking governance signals found | None |
24 questions across five areas, each scored out of 10. An area passes without conditions at an average of 7 or above. Data, process and tooling are scored at the pass level of 7 once rounded, so they carry no conditions. Governance is deficient: oversight of AI in decisions about applicants is the lowest-scoring answer, and that alone stops qualification.
The dark line on each bar marks the pass level of 7.
Findings point to the obligations they relate to. They are not legal advice and are not a finding that the carrier is in breach of anything.
| Framework | What it covers | Status |
|---|---|---|
| NIST AI RMF. GOVERN | Organizational accountability, risk tolerance, and AI governance policy | Gap |
| NIST AI RMF. MANAGE | Ongoing risk response, monitoring, and incident management for deployed AI | Gap |
| State AI Laws (CO, CA, TX) | Automated decision-making affecting individuals; algorithmic transparency obligations | Gap |
| Sector Regulator Expectations (SEC / FINRA / OCC / HHS) | Model risk management, explainability, and audit trail requirements by sector | Gap |
| ISO/IEC 42001:2023 | AI management system standard, increasingly referenced in US procurement and enterprise procurement | Not assessed |
AQE uses fixed, version-controlled rules. There is no AI model and no assessor judgement in the decision, so the same inputs always give the same verdict.
Each report carries two fingerprints. The first identifies the exact ruleset used, and the second the decision it produced. Recomputing them from the inputs confirms nothing was changed.
Ruleset 68f1741f0e8b622f…
Decision aeb4ad5f997fd569…
Both documents are marked as samples on every page.