Working Inside Someone Else’s Authority

Before Notch, I helped build and run an MGA. The arrangement there is one I still think about daily, now that most of my time goes to making sure regulated industries get what AI promises while also still staying inside the lines they’re already accountable to.

At an MGA, a carrier hands you a book of business and a set of limits. You then get to underwrite and bind within those limits on their behalf. You operate inside their authority and everything you do has to be provable as having stayed inside it because, at audit time, there needs to be proof that you’re doing things compliantly.

It's similar in banking, where a compliance officer works inside a risk-based approval policy the exact same way, clearing the clean cases and escalating what needs a judgment call. Different paperwork, same idea. You have a line, don't cross it, and be ready to show you didn't.

Long before AI entered the picture, a capacity provider used to ask once a year during audit season and everyone scrambled. A regulator used to ask after something went wrong. The difference now is that the tools doing the work are running 24/7 and a record can be generated in seconds rather than asking someone to reconstruct it later from memory, notes, and email threads.

That’s the part I think gets skipped when the industry talks about governance like it’s a new thing only AI created. Delegated authority in regulated industries has always required evidence. AI just removed the excuse for not being able to provide it continuously. If you’re an underwriter using an agent to process a submission, there’s no reason the evidence of your work should wait for an annual review. It can exist the moment the decision does and still be there in case a regulator asks to see it.

The NAIC has been creating guidance for state regulators on how insurance should use AI via its AI Systems Evaluation Tool. The CEO and incoming president will be speaking at an industry conference and likely share more about its progress and how it will affect the industry. Banking has its own version of this shift already in motion. For example, the EU’s incoming AMLR requirements move KYC reviews from a fixed calendar to continuous, event-triggered monitoring, and they take full effect in 2027.

When something operates inside limits you set, AI lets you actually see that it stayed inside those limits, instead of what we used to do: take its word for it. It can also help you stay inside those limits to begin with. You can build in AI guardrails tuned to the specific rules you’re operating under, so the system already knows what’s allowed on a personal auto claim in Texas isn’t automatically allowed on the same claim in California, rather than applying one answer everywhere and hoping it holds up.

When it comes to working inside someone else’s authority, I don’t think the answer is always a bigger rulebook. It’s closer to what good MGAs and credit teams already knew before AI ever entered the picture. Authority was always borrowed and showing you respected it was always part of the job, not a 21st century addition.