COMMENTS

OF

AMERCIAN PROPERTY CASUALTY INSURANCE ASSOCIATION

ON

SECOND DRAFT NIST AI RMF

The American Property Casualty Insurance Association represents more than 1200 (re)insurers providing 

critical financial security and risk management throughout the U.S. and world. Our members both create 

and use the products of third-party vendors that involve AI for a range of important functions such as risk 

assessment, risk reduction and management, underwriting and claims settlement. We much appreciate the 

work of NIST and recognize the need for proportionate, realistic, pro-competitive and voluntary standards to 

help guide the use of AI.

Attributes of the AI RMF

We are in strong agreement with the attributes in the shaded section on page 4 of the RMF and urge that 

they be maintained as written. Particularly important are that the RMF is: 

• risk-based, resource-efficient, pro-innovation, and voluntary,

• a provider of common language, 

• easily usable and fits well with other aspects of risk management,

• outcome-focused and non-prescriptive,

• law-and regulation-agnostic, and

• a living document.

There is a need for generally accepted and practical guidance with the RMF’s attributes. However, we wish 

to raise some questions and issues so as to make the next draft of the RMF more usable, more consistent 

with the stated attributes and ultimately more beneficial for all AI users and the public we serve.

Challenges and Questions

The RMF should be balanced by more clearly acknowledging that AI can greatly benefit consumers and the 

general public. As written and without that acknowledgement, the impression is created that the more 

limits and demands that are placed on the use of AI, the more consumers and the general public are 

benefited. The reality is far more complex and nuanced. A good example would be catastrophe risk models 

that assist insurers with fair and accurate pricing but even more importantly, assist the public to better 

understand and act to prevent human tragedies and widespread economic loss. There are many other 

examples of beneficial uses of AI such as the use of search engine information to identify health 

risks/outbreaks by region. 

The RMF sets forth an ambitious set of recommendations throughout the document. Yet, there appears to 

be little linkage to some of the key attributes, including the concepts of “resource-efficient and proinnovative.” For example, there is a wide range of resources and expertise represented in the insurance 

sector from large global players to small one state/one product companies providing coverage to farms or to 

oil rig workers, for example. For all insurers, as well as other industries, proportionality is critical. We 

therefore urge the RMF to better recognize and address proportionality. 

While common definitions are important, the concept of “harm” needs to be better defined and expanded. 

For example, consider a system that would help consumers better understand their risk, but the creation of 
2 

which is overburdened by compliance with the RMF, and/or the transparency as envisioned by the RMF 

would invariably result in loss of competitive advantage and even litigation. If that AI envisioned system is 

not deployed, should that result also be included in the definition of “harm” to be avoided? 

Another challenge for the RMF lies in the application of the attribute of “pro-innovation.” The RMF 

provides an extraordinary set of concepts, including transparency. Yet, if a business is to be encouraged to 

innovate, it needs to be able to protect its investment in AI from competitors. There is intellectual property 

embedded in these innovations. And the need for transparency should be tempered by the need to keep 

aspects of the innovation confidential and proprietary. Principles of transparency and explainability, on 

their own, do not contemplate the business’s need to avoid providing information that could be used to 

reverse engineer the concepts being described. However, the RMF does not appear to address this critically 

important concern. Further, entities adopting and using the RMF should be considered for a safe harbor. 

In addition, very practical questions remain: for whom should the algorithms be transparent and how can

complicated models and algorithms ever be truly explainable? The practical application of transparency to 

the stakeholder community raises many issues such as what is the definition of stakeholder community and 

how can disclosure to them be accomplished in the context of protecting intellectual property? What level 

of information would be sufficient without becoming too technical or confusing for stakeholders with 

different levels of understanding of algorithms?

Another challenge is presented by the attribute of “non-prescriptive.” In fact, the document seems to be 

increasingly prescriptive, adding ever more detail to its general principles, in part through the tables. The 

tables do not consider that many industries, like insurance, are already highly regulated and can leverage 

existing frameworks in place to manage risks around use of AI, such as model risk, privacy and data security. 

We therefore urge that the RMF be clearer as to how existing governance can be leveraged for AI and that 

the tables are just suggestions, at most, and do not expand the RMF’s narrative. 

We also believe that the RMF should address: (a) how risks that are difficult to measure could be handled 

under the framework; and (b) whether there is sufficient flexibility to allow for measuring certain emerging 

risks/difficult to measure risks qualitatively rather than quantitatively. 

Conclusion

There is a need for generally accepted and practical standards and common language with the attributes set 

forth for the RMF (consistent with the comments offered above). While the RMF is long on details that 

would restrict and condition the use of AI, it seems short on recognizing the business necessities relating to 

AI and the value to consumers and the general public of innovation and competition in businesses’ use of AI. 

It would improve the RMF if the next draft would more clearly and consistently align with its attributes, by, 

for example, discussing proportionality and how best to encourage and support innovation and competition 

by a wide range of business sizes and models. 

Respectfully submitted, 

David F. Snyder

Vice President International and Counsel 

American Property Casualty Insurance Association