This article is for informational purposes only and does not constitute financial or legal advice. You should consult with a qualified professional before making any decisions about the use of AI in your firm.
What Third-Party AI Data Assurance Should Insurers Conduct for Discrimination Risk?
Before using third-party data in an underwriting model, check where it came from, which customers it represents and whether its use produces unfair outcomes. Ask the supplier for documented limitations and test the data against the insurer's actual use case.
Third-party credit scores, postcode data and behavioural data need checking against the underwriting task. Ask how the supplier collected the data, which customers it represents and what limitations could affect a pricing or eligibility decision.
The Proxy Problem: Hidden Discrimination
A dataset can exclude an explicit ethnicity field and still contain variables associated with a protected characteristic. Use the table as a set of possibilities to investigate in the relevant data and customer population, not as a finding that each variable always acts as a proxy.
| Proxy Variable |
What it Could Be a Proxy For |
| Postcode |
Ethnicity, socioeconomic status, level of education |
| Shopping habits |
Age, gender, lifestyle choices |
| Job title |
Gender, socioeconomic status |
| Credit score |
Socioeconomic status, past financial hardship |
If postcode affects the model’s risk estimate, test whether the resulting decisions disadvantage particular customer groups and investigate why. A postcode relationship alone does not establish discrimination; examine the data, model and outcomes together.
The Assurance Gap: Why Standard Data Contracts Are Not Enough
Review whether the data contract covers the intended underwriting use and the evidence needed to assess fairness. A general accuracy warranty may leave questions about collection, representativeness or limitations unanswered.
Ask the data supplier for evidence that can be checked against the insurer’s model and customer population. Record what the supplier can establish and what still needs testing by the insurer.
A Framework for Third-Party Data Assurance
Use the five areas below to organise the supplier review and identify tests for the proposed underwriting use.
1. Data Source and Collection Transparency
- Where did this data come from? Ask for the original sources, collection methods and subsequent changes to the dataset.
- Was it collected ethically and legally? Ask for collection and permitted-use evidence, then have the relevant privacy or legal reviewer assess it for your proposed use.
2. Data Composition and Representativeness
- What is actually in this dataset? Obtain a data dictionary describing the fields, how they were derived and any known limitations.
- Is the data representative of the UK population? First identify the population relevant to the underwriting decision. Check which groups are over- or under-represented and whether a UK-wide comparison is appropriate for that use.
3. Bias and Fairness Auditing
- What bias testing have you conducted? Request the supplier’s methods, tested population and results. Check whether those tests address the customer groups and decision the insurer is evaluating.
- Can we test it ourselves? Agree access and safeguards for independent testing before integration, where needed to assess the data in the insurer’s own model.
4. Data Quality and Accuracy
- How do you ensure the data is accurate and up-to-date? Review the supplier’s validation, update process and handling of corrections.
- What is the error rate? Ask which errors have been measured, how they were assessed and which limitations remain unknown.
5. Contractual Accountability
- Does your contract include specific warranties about bias? Ask legal to assess what the wording covers, what evidence supports it and what remedies are available if the data is unsuitable.
- What is the liability in the event of a regulatory breach? Review the allocation of responsibilities and liability with legal, including the insurer’s obligations when using the data.
The Bottom Line: You Own the Data Risk
The insurer’s decision should draw on supplier evidence and tests relevant to its own underwriting use. Record the data limitations and whether they require a restriction, further investigation or rejection.
Keep that assessment with the model record so reviewers can see how data quality and discrimination risks were considered. Revisit the decision when the supplier data or its use changes.
Take the Next Step
If you are ready to move from theory to action, I can help. My AI Audit gives you a comprehensive assessment of your firm's AI readiness, identifying the gaps in your governance, the risks in your current tooling, and a clear roadmap to get you where you need to be.
Book a Discovery Call → or learn more about the AI Audit.
Need to use AI without increasing regulatory or client-outcome risk?
Map where AI can improve decisions, service and operations while keeping Consumer Duty, SM&CR, model-risk and client-data controls visible.
