ISO/IEC 42001 and Adversarial Testing for a Commercial Underwriting AI Platform
Doctored broker submissions no longer steer risk rankings, and an AI management system is on track for its certification audit.
Client name withheld by agreement- Client
- Underwriting automation platform for commercial property and casualty insurers
- Region
- New York, New York
- Year
- 2026 · Ongoing
- Duration
- 20 weeks
- Scope
- 3 extraction and triage models · 1 underwriter assistant · 19 carrier integrations
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
An underwriting automation platform reads broker submissions, loss runs and inspection reports for commercial insurers, extracts the data and ranks each risk for an underwriter. Its carrier customers answer to state insurance departments that now expect documented governance of AI used in underwriting decisions.
Brokers control the documents the models read. A submission carrying hidden instructions or altered loss figures could push a risk up the queue or change a recommended premium, and the platform had never been tested for it.
What we did
The approach, step by step.
- 01
Models inventoried with their decisions
Three extraction and triage models, one underwriter assistant and 19 carrier integrations were cataloged with their purpose, training data, influence on decisions and an accountable owner.
- 02
Management system aligned to regulators
AI policy, impact assessments, model change control and bias monitoring were built to ISO/IEC 42001 and mapped to the NAIC model bulletin and New York guidance on AI in insurance underwriting.
- 03
Adversarial submissions crafted
Our testers built broker packets with hidden text, altered tables and embedded instructions, then measured how far each one moved extracted values and risk rankings.
- 04
Defenses in the pipeline
Documents are now flattened and sanitized before extraction, extracted figures are reconciled against source tables, and any ranking change above a set threshold goes to human review.
Outcomes
What changed, in numbers.
- 17
- document-based manipulation paths closed
- 4
- models under documented governance
- 19
- carrier integrations reviewed for data scope
- 100%
- of high-impact ranking changes routed to an underwriter
Carriers used to ask whether our models could be fooled. Now we show them how hard we tried.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Boston, Massachusetts · 16 weeks
AI, Cloud & Digital Trust · 2024SOC 2 Type II with Evidence Built into ServiceNow Change RecordsAn unqualified Type II report with zero exceptions, and change-management evidence that now collects itself.
-
Pittsburgh, Pennsylvania · 22 weeks
AI, Cloud & Digital Trust · 2025Multi-Cloud Security Guardrails for a Regional Health SystemClinical imaging and analytics in two clouds under one set of guardrails, with no change to how radiologists read studies.
-
Cleveland, Ohio · 22 weeks
AI, Cloud & Digital Trust · 2025CMMC Level 2 Certification for a Precision Machining SupplierCertified at the C3PAO assessment, keeping the supplier on two prime contractors’ approved lists.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.