Compliance requirement library32 requirements
Jurisdiction inventory
Maintain every state, line of business, legal entity, license, and AI use that may trigger an obligation.
Requirement interpretation
Translate each bulletin, regulation, law, examination request, and order into specific operating obligations.
Applicability and gap assessment
Compare current controls and evidence with applicable requirements and document gaps.
Regulatory change management
Monitor proposed, adopted, amended, and withdrawn materials and route them to owners.
Written AIS program
Maintain a risk-based program governing development, acquisition, use, monitoring, and retirement of AI systems.
Board and senior management accountability
Define oversight, reporting, decision rights, resources, and escalation for AI risks.
AI system inventory
Maintain models, applications, agents, vendors, purposes, decisions, owners, tiers, versions, and status.
Policies training and internal controls
Align policy, procedures, training, testing, access, monitoring, incident, and audit controls to risk.
Adverse consumer outcome prevention
Identify and control inaccurate, unfair, inaccessible, delayed, or discriminatory outcomes.
Unfair discrimination testing
Test relevant groups, proxies, inputs, outputs, errors, and decision policies.
Complaint appeal and correction analysis
Link complaints, appeals, disputes, overrides, corrections, and recourse to AI-influenced decisions.
Affected-case remediation
Identify and correct consumers, records, decisions, notices, payments, or offers affected by a material failure.
Intended use and system description
Document business purpose, users, affected parties, decisions, scope, exclusions, authority, and dependencies.
Data provenance and suitability
Document source, rights, lineage, transformations, quality, representativeness, retention, and restrictions.
Model methodology and limitations
Document method, assumptions, features, training, thresholds, performance, limitations, and uncertainty.
Traceability and recordkeeping
Retain versions, inputs, outputs, retrieval, actions, approvals, overrides, monitoring, and incidents.
Predeployment validation
Test performance, robustness, fairness, security, workflow, oversight, and consumer impact before use.
Independent review
Use qualified challenge independent of primary development for higher-risk systems.
Production monitoring
Monitor quality, drift, fairness, overrides, complaints, incidents, security, cost, and business outcomes.
Change and revalidation
Assess changes and repeat affected testing and approvals before release.
Consumer notice
Determine when and how to disclose AI use, data, decision role, or material process information.
Specific and accurate reasons
Ensure explanations reflect the actual decisive factors and are understandable, timely, and reviewable.
Human review and recourse
Provide qualified review, correction, appeal, complaint, accessibility, and escalation paths.
Regulator explanation package
Prepare plain-language and technical explanations for purpose, method, data, controls, results, limitations, and outcomes.
Third-party due diligence
Assess governance, data, testing, security, fairness, resilience, subcontractors, and regulatory cooperation.
Contractual rights and obligations
Require data restrictions, change notice, audit, evidence, incidents, performance, deletion, cooperation, and exit.
Ongoing provider oversight
Monitor service, model or data changes, incidents, findings, concentration, and unresolved evidence.
Regulatory access and exit readiness
Ensure the insurer can obtain evidence, respond to regulators, preserve records, and substitute or terminate.
Regulatory request intake
Log the request, authority, scope, deadline, confidentiality, owners, and response plan.
Evidence index and quality review
Map each question to responsive, approved, consistent, and reproducible evidence.
Demonstration and interview readiness
Prepare owners to explain purpose, controls, results, limits, decisions, incidents, and remediation.
Findings commitments and closure
Track findings, management response, commitments, due dates, evidence, validation, and regulator closure.