solutions · insurance
Wytness for insurance
Underwriting, claims, fraud. Every AI decision logged in a form your regulator can read.
the question every regulator asks
Can you produce the evidence?
The NAIC Model Bulletin (adopted by 20+ state DOIs), the Colorado AI Act, NY DFS Circular Letter 7, APRA CPS 230/234, and the EU AI Act (life and health pricing is Annex III §5(c) high-risk) all ask the same thing of an AI insurance decision: which model version, against which inputs, with which guardrails active, produced this adverse-action notice? The pricing engine has logs, the agent harness has traces, the claims platform has an audit table — none of them, alone, answers that. And shipping any of it to an observability SaaS is itself a disclosure and vendor-risk event.
a scenario
A syndicate audit, with and without
A Melbourne insurtech writes home cover through a Lloyd's binder and triages two thousand first-notice-of-loss claims a month with an agent — reading statements, policy schedules, and weather data, auto-progressing simple claims. The syndicate's audit lead asks: for last quarter, show every auto-progressed claim under $5,000, its exact tool calls, the policy version in force, and proof no claimant health information reached your model provider.
Without Wytness that's CloudWatch, an OpenAI record they can't export cleanly, and a claims warehouse of raw statements — no shared identity, no signatures. With it, one signed export: claimant tokens, tool calls, model and policy version fingerprints, auto-progress decision, adjuster flag, chain links — mapped to CPS 230 §47 and EU AI Act Article 12. The audit closes in one cycle, and the same export answers the ACCC a month later.
// Event identity:
// What the agent did:
// Parameters (PII tokenised before this row was sealed):
// Integrity proof (3-layer):
one auto-approved storm claim from the scenario — claimant identity arrives as tokens
the deliverable
What you can prove
- ✓Which agent produced which underwriting decision: input fields seen, model version, rating-engine output, supervising-actuary flag.
- ✓That a claims-triage agent stayed inside the perils and policy terms it was scoped to, and never paid out on an exclusion.
- ✓That a pricing agent's behaviour after a model upgrade matched pre-upgrade behaviour on a held-out sample your appointed actuary signs off on.
- ✓That no personal data — Medicare numbers, health conditions, claim photographs — left your environment in clear; only tokens reached Wytness.
- ✓That a state DOI examination asking 'show every adverse-action notice generated by an AI agent in Q3' can be answered in days, not as a discovery sprint.
how the surfaces map
Three surfaces, one product.
/product/ledger
Ledger
Every underwriting, claims, and broker-facing decision signed per event; personal information pseudonymised in your runtime. BYOS keeps the raw log in your tenancy; Evidence Packs map to SOC 2 CC7.2, EU AI Act Articles 12–13, ISO 27001 A.8.15.
/product/registry
Registry
Inventory of pricing models, claims agents, fraud agents, and broker assistants with model-version history and risk classification. Anomaly rules flag scope creep, off-hours adjudications, and decision-distribution shifts after an upgrade that need actuarial re-review.
/product/shield
Shield
Approval gates on declinations, large payouts, and rating-factor overrides, routed to the ServiceNow GRC queue your operational risk team already works.
for your auditor
Frameworks that matter here
SOC 2 Type II
Trust services criteria your reinsurer's vendor team already evaluates.
ISO 27001:2022
Information security baseline expected by every major carrier.
EU AI Act
Life and health pricing is high-risk under Annex III §5(c).
GDPR
Article 22 covers solely-automated underwriting and claims decisions.
APRA CPS 230 / 234
Operational risk and information security — control matrix in progress.
NIST AI RMF 1.0
MEASURE and MANAGE support via the signed trail — in progress.
NAIC Model Bulletin on AI
Framework alignment available on request.
FINMA Circular 2023/1
Framework alignment available on request.
the boundary
What Wytness does not do
- —We are not a policy administration system. Wytness records what your agents did against Guidewire, Duck Creek, or your own PAS; it does not replace the PAS.
- —We are not an actuarial model risk framework. We give your appointed actuary and MRM committee the evidence to apply SR 11-7 or the NAIC Model Bulletin to AI agents; the policy work is theirs.
- —We do not adjudicate fairness. Wytness logs the inputs, outputs, and decisions; whether a pricing pattern constitutes unfair discrimination under your state's law is a legal and actuarial judgement, not a vendor's call.