Delaware — Domestic and Foreign Bulletin No. 148 (NAIC AI Model VERBATIM, but the Market-Conduct Authority DELETED and the Rating Limb BROADENED to "All Forms of Insurance") + a Rate Chapter That Reaches HEALTH (18 Del. C. § 2502(a)(4)) + Mandatory Insurance-Scoring MODEL FILING (18 Del. C. § 8309) + Price-Optimization Prohibition (Bulletin No. 78) + Physician-Only Denials (18 Del. C. § 6410(a)) + Pre-Authorization Reform Act of 2025 (SB 12 / 85 Del. Laws c. 176, applies after 31 Dec 2026) + Aerial Imagery Bulletin No. 150: AI Compliance Requirements

Bulletin 148 replaces the NAIC model's property-and-casualty line-list with the words "with respect to ALL FORMS OF INSURANCE", and retitles the bullet from "Property and Casualty Model Rating Law (#1780)" to "Delaware Rate Making Laws", citing 18 Del. C. Chs. 25 and 26. Test that against the chapters and it is very largely earned — and it BREAKS the accident-and-health exclusion that held in every prior state in this vein. 18 Del. C. § 2502(a) provides that Chapter 25 applies to (1) casualty insurance and all forms of motor vehicle insurance on risks or operations in the State, (2) surety insurance, (3) fire, marine and inland marine insurance on risks located in the State, (4) "HEALTH INSURANCE, GROUP HEALTH INSURANCE, BLANKET HEALTH INSURANCE, MEDICARE SUPPLEMENT INSURANCE AND HEALTH SERVICE CORPORATIONS", and (5) title insurance. Health is expressly IN, where New Hampshire's RSA 412:2, II(b) expressly excludes accident and health. § 2502(b) excludes reinsurance (except joint reinsurance under § 2523), ocean-marine and aviation risks, workers' compensation and employers' liability (which Chapter 26 covers at § 2601), and — the one real gap in the Bulletin's "all forms of insurance" claim — LIFE INSURANCE at § 2502(b)(3). A life carrier therefore takes nothing from the rating limb and is reached only through the UTPA at § 2304(13)a. THE SUBSTANTIVE STANDARD is § 2503(a)(2), "rates shall not be excessive, inadequate or unfairly discriminatory", with due consideration under § 2503(a)(3) to past and prospective loss experience within and outside the State, conflagration and catastrophe hazards, a reasonable margin for underwriting profit and contingencies, dividends and unabsorbed premium deposits, past and prospective expenses, and "all other relevant factors". § 2503(a)(5) is the classification provision an AI rating model must live inside: "Risks may be grouped by classifications for the establishment of rates and minimum premiums. Classification rates may be modified to produce rates for individual risks in accordance with rating plans which establish standards for measuring variations in hazards or expense provisions or both. SUCH STANDARDS MAY MEASURE ANY DIFFERENCES AMONG RISKS WHICH MAY HAVE A PROBABLE EFFECT UPON LOSSES OR EXPENSES" — the probable-effect-on-losses-or-expenses test is the boundary a high-dimensional model has to stay inside, and § 2503(b) preserves classifications "based upon size, expense, management, individual experience, purpose of insurance location or dispersion of hazard or any other reasonable considerations provided such classifications and modifications apply to all risks under the same or substantially similar circumstances or conditions". THE FILING DUTY is § 2504(a): "Every insurer shall file with the Commissioner ... every manual, minimum, class rate, rating schedule or rating plan and every other rating rule, and every modification of any of the foregoing which it proposes to use", stating the proposed effective date and indicating the character and extent of coverage; § 2504(b) lets the Commissioner demand the supporting information where a filing arrives without it, and provides that "a filing and supporting information shall be open to inspection by parties in interest after the filing becomes effective". HONEST NEGATIVE ON PREDICTIVE MODELS: unlike New Hampshire's RSA 412:16, II — which names "every manual, PREDICTIVE MODEL or TELEMATICS MODEL or other model that pertains to the formulation of rates" — a string scan of the entirety of Chapter 25 this session returned ZERO occurrences of "predictive", "algorithm", "artificial intelligence", "machine learning" or "automated". A predictive model is a filing event in Delaware only insofar as it IS a rating plan, a rating rule, or a modification of one; Delaware's express model-filing mandate lives in Chapter 83 instead (see the scoring-model requirement). THE CLOCK is § 2506(c): filings must be submitted not less than 60 days before the proposed effective date, and are deemed to meet the statutory requirements at the expiration of that 60-day period UNLESS, within 45 days of receipt, the Commissioner either disapproves the filing or notifies the insurer that additional time is needed; on such a notice the review extends up to 90 days after receipt (or longer by agreement), and the filing cannot take effect until approval or expiry of the extended period. § 2507 gives a disapproval procedure with a hearing on written request within 20 days and a final order within 60 days of the record closing, and provides that a filing scheduled for a formal hearing may not become effective until a final order issues. CURRENCY BOUNDARY, verified rather than assumed: delcode carries TWO versions of § 2503, marked [Effective until Jan. 1, 2027] and [Effective Jan. 1, 2027]. Both were pulled and diffed this session, and the change is narrow — the health-benefit-plan unit-price-growth cap at § 2503(a)(12) keeps its substance while the "Core CPI" definition drops the Philadelphia-Camden-Wilmington regional index in favour of the national CPI-U less food and energy, and the Commissioner's annual March-31 determination and § 312(c) communication duties at (a)(12)c and d are REPEALED. Nothing in the AI-relevant classification, filing or disapproval machinery moves on 1 January 2027.

Domestic/Foreign Insurers Bulletin No. 78 (1 October 2015, Commissioner Karen Weldin Stewart), addressed to all property and casualty insurers writing personal lines policies in Delaware, rating organizations and the Delaware Insurance Guaranty Association, is the most directly operative instrument Delaware has on machine-driven pricing — and unlike Bulletin 148 it speaks in prohibition. It defines the target: price optimization "generally refers to an insurer's practice of varying rates based on factors other than the risk of loss in order to charge each insured the highest price that they will tolerate without shopping for alternative coverage (such as the likelihood that policyholders will renew their policies and the willingness of certain policyholders to pay higher premiums than other policyholders)", noting that "insurers use sophisticated analytics that cover not only risk of loss, but such things as how happy an individual is with their insurance company" and that the practice "can result in two policyholders receiving different premium increases even though they have the same loss history and risk profile". It then states the rule: "To the extent that price optimization involves gathering and analyzing data related to numerous characteristics specific to a particular policyholder and unrelated to risk of loss or expense, INSURERS MAY NOT USE PRICE OPTIMIZATION TO RATE POLICIES IN DELAWARE." The authorities cited are 18 Del. C. § 2503(a)(5) (classification standards may measure "any differences among risks which may have a probable effect upon losses or expenses"), § 2503(b) (permitted classification bases), § 2304(15)c ("no such insurer shall make or permit any unfair discrimination between insureds or property having life insuring or risk characteristics, in the premium or rates charged"), and § 2503(a)(2), for which the Bulletin supplies a working definition worth keeping: "A rate will be considered unfairly discriminatory if price differentials fail to reflect equitably the differences in expected losses and expenses for different classes of policyholders." THE SAFE HARBOUR IS THE PART A MODEL BUILDER NEEDS. The Department expressly does not intend the Bulletin "to prohibit or restrict such practices as capping or transitional pricing when applied on a group basis", instructs that "insurers should group individual policyholders into justifiable, supportable, risk-based classifications and treat similarly situated policyholders the same with respect to insurance pricing", and states that "the use of sophisticated data analysis to develop finely tuned methodologies with a multiplicity of possible rating cells is not, in and of itself, necessarily a violation of rating laws AS LONG AS THE CLASSIFICATIONS ARE BASED STRICTLY ON EXPECTED LOSSES, EXPENSES, OR OTHER JUSTIFIABLE, SUPPORTABLE RISK CHARACTERISTICS." So model dimensionality is not the problem; the model's TARGET is. A gradient-boosted rating model with ten thousand cells is fine if every cell is justified by expected loss or expense; a model whose objective function includes elasticity, retention propensity, price tolerance or shopping behaviour is not. The Bulletin required any insurer then using price optimization to submit a compliant SERFF filing no later than 15 December 2015 with effective dates no later than 1 April 2016 for new business and 1 July 2016 for renewal business, identifying the SERFF tracking number of the filing being replaced or corrected, and warned that failure "may result in administrative action". Those transition dates are spent, but the prohibition is not: the Bulletin closes "This Bulletin shall be effective immediately and shall remain in effect unless withdrawn or superseded by subsequent law, regulation or bulletin", and it still stands unwithdrawn on the Department's live bulletin index. VERIFICATION NOTE: this bulletin is a 2015 photocopier scan with no text layer at all; it was rendered to images at 200 dpi and read visually this session rather than paraphrased from a secondary description.

Delaware named algorithms and models in its insurance code long before the AI bulletin existed. 18 Del. C. § 8303(8) defines "Insurance score" as "a number or rating that is derived from AN ALGORITHM, COMPUTER APPLICATION, MODEL, OR OTHER PROCESS that is based in whole or in part on credit information for the purposes of predicting the future insurance loss exposure of an individual applicant or insured", and § 8309(a) then imposes the filing duty: "Insurers that use insurance scores to underwrite and rate risks MUST FILE THEIR SCORING MODELS WITH THE COMMISSIONER. A third party may file scoring models on behalf of insurers. A filing that includes insurance scoring may include loss experience justifying the use of credit information." This is Delaware's analogue to New Hampshire's RSA 412:16, II and in one respect it is better aimed: it names the MODEL rather than the rating plan, and it expressly contemplates the vendor filing on the carrier's behalf — so a bought scoring model is on the Commissioner's desk by statute rather than only on request. § 8309(b) protects it: any filing relating to credit information is considered proprietary or trade secret under 29 Del. C. § 10002(o)(2), or on the request of the insurer or owner of the document, and is subject to the confidentiality provisions of 18 Del. C. § 321(g). § 8304(a) then constrains what the model may contain and how it may be used. § 8304(a)(1) is a statutory PROXY-VARIABLE BAN: an insurer may not "use an insurance score that is calculated using INCOME, GENDER, SEXUAL ORIENTATION, GENDER IDENTITY, EDUCATION, ADDRESS, ZIP CODE, RACE, ETHNIC GROUP, RELIGION, MARITAL STATUS, OR NATIONALITY of the consumer as a factor" — the inclusion of ADDRESS and ZIP CODE is the provision most models fail, because geographic features are routinely engineered into credit-derived scores as neighbourhood aggregates. § 8304(a)(2) and (a)(3) bar denial, cancellation, non-renewal or renewal rating SOLELY on credit information "without consideration of any other applicable underwriting factor independent of credit information"; (a)(4) bars adverse action solely because the consumer has no credit card account; (a)(5) governs no-hit and no-score consumers, requiring the insurer either to treat them as approved by the Commissioner on evidence that the absence relates to risk, or to treat them as having neutral credit information as defined by the insurer, or to exclude credit information entirely; (a)(6) bars requesting credit information at renewal unless the consumer asks, requires a rerate on request giving the benefit of any improvement, permits recalculation no more than once in a 12-month period, and provides that "no adverse underwriting decision may result from a rerating conducted pursuant to this paragraph" — a one-way ratchet that a retraining pipeline must honour; (a)(7) lists eleven items that may not be used as a NEGATIVE FACTOR in any insurance scoring methodology, including consumer-initiated and insurance-related credit inquiries, medically-coded collection accounts, clustered home-mortgage or automobile-lending inquiries within 30 days of one another, bankruptcies more than 5 years old, suits and judgments more than 5 years old or beyond the limitation period, collections or charge-offs more than 7 years old, arrest/indictment/conviction records more than 7 years from disposition, any other adverse item more than 7 years old, and the total available line of credit (though outstanding debt in relation to available credit may be considered); and (a)(8) bars adverse action on a homeowners policy based solely on the credit information of a non-owner, non-applicant spouse. § 8305 requires the insurer, on written request, to provide "reasonable exceptions" to rates, rating classifications, company or tier placement or information directly influenced by an EXTRAORDINARY LIFE CIRCUMSTANCE — a declared catastrophic event, serious illness or injury to the consumer or an immediate family member, death of a spouse, child or parent, divorce or involuntary interruption of alimony or support, identity theft, involuntary unemployment of 3 months or more, overseas military deployment, or other events determined by the insurer — with the insurer permitted (but not required) to demand independently verifiable documentation, to require the request within 60 days of application or renewal, and to require a demonstration of direct and meaningful impact; the insurer must notify consumers that exceptions are available, and must inform the consumer of the outcome within 30 days of receiving sufficient documentation. § 8306 requires re-underwriting and rerating within 30 days where an FCRA dispute under 15 U.S.C. § 1681i(a)(5) establishes that credit information was incorrect or incomplete, with a premium refund back to the shorter of the last 12 months of coverage or the actual policy period. § 8311 bars a consumer reporting agency from selling lists derived from insurance credit inquiries, including policy expiration dates.

Where an insurer takes an adverse action based upon credit information — defined at § 8303(1) as "a denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount of, any insurance, existing or applied for, in connection with the underwriting of personal insurance" — 18 Del. C. § 8308 imposes a set of notice duties that function as a statutory explainability mandate for a machine-produced score, and it is materially harder than the AI bulletin's notice EXPECTATION at Guideline 1.9. (1) § 8308(1): notify the consumer that an adverse action has been taken, in accordance with the federal Fair Credit Reporting Act, 15 U.S.C. § 1681m(a). (2) § 8308(2) is the operative one: notify the consumer "explaining the reason for the adverse action. THE REASONS MUST BE PROVIDED IN SUFFICIENTLY CLEAR AND SPECIFIC LANGUAGE SO THAT A PERSON CAN IDENTIFY THE BASIS FOR THE INSURER'S DECISION TO TAKE AN ADVERSE ACTION. Such notification shall include a description of UP TO 4 FACTORS THAT WERE THE PRIMARY INFLUENCES of the adverse action. The use of generalized terms such as 'poor credit history,' 'poor credit rating,' or 'POOR INSURANCE SCORE' does not meet the explanation requirements of this paragraph." Read the third example carefully: "poor insurance score" is the answer a black-box model gives by default, and the statute names it as insufficient. A model that cannot decompose its output into up to four consumer-legible primary influences cannot be used to take an adverse action in these lines. The statute does supply a practical route through: "Standardized credit explanations provided by consumer reporting agencies or other third-party vendors are deemed to comply with this section" — so a vendor reason-code set carries the burden, which is a strong argument for procuring the reason codes with the score rather than building them afterwards. (3) § 8308(3): where the adverse action is a denial, notify the applicant that they may inquire further about the credit information on which the denial is based and obtain a free copy of the credit report by written request to the insurer or another identified party, made no more than 30 days after the notice of refusal was mailed. (4) § 8308(4): state that the consumer reporting agency that supplied the credit information did not make the denial decision and cannot provide the specific reasons for it. (5) § 8308(5) is the retention rule and it names the score itself: where the adverse action is a denial, "the notice of denial shall be retained by the insurer and A RECORD OF THE INSURANCE SCORE, related notice and correspondence with the applicant shall be maintained by the insurer OR THEIR VENDOR for a minimum of 3 years from the date of the denial notification" — so the model OUTPUT for every denied applicant is a three-year retention item, and the duty follows the vendor. Pair this with Bulletin No. 150's parallel rule for imagery-driven underwriting: non-specific reasons such as "claims experience", "underwriting judgment" or "increase in hazard" are "unacceptable as they do not provide sufficient notice for the insured to address the underlying issue". Between § 8308(2) and Bulletin 150, Delaware has said the same thing twice in two different technology settings — a machine-driven adverse decision has to be explained in terms the consumer can act on.

The Bulletin's first authority is the Unfair Trade Practices Act, 18 Del. C. Ch. 23, and two features of it decide how an AI-driven decision is actually prosecuted in Delaware. FIRST, THE SUBSTANTIVE HOOKS. § 2303 prohibits any person from engaging in any unfair method of competition or unfair or deceptive act or practice in the business of insurance. § 2304(13) supplies the unfair-discrimination limbs that the rating chapter does not reach: (a) bars unfair discrimination "between individuals of the same class and equal expectation of life in the rates charged for any contract of life insurance or of life annuity or in the dividends or other benefits payable thereon, or in any other of the terms and conditions of such contract"; (b) bars unfair discrimination "between individuals of the same class and of essentially the same hazard in the amount of premium, policy fees or rates charged for any policy or contract of ACCIDENT OR HEALTH INSURANCE or in the benefits payable thereunder, or in any of the terms or conditions of such contract, OR IN ANY OTHER MANNER WHATEVER". § 2304(15)c supplies the property/casualty/surety limb, barring unfair discrimination "between insureds or property having life insuring or risk characteristics, in the premium or rates charged for insurance, or in the dividends or other benefits payable thereon, or in any other of the terms and conditions of the insurance". Note the complementarity, which is the practical map for a multi-line AI programme in Delaware: LIFE is outside the rating chapter under § 2502(b)(3) but inside § 2304(13)a; HEALTH is inside BOTH the rating chapter (§ 2502(a)(4)) and § 2304(13)b; property, casualty and surety are inside both the rating chapter and § 2304(15)c. There is no line in Delaware on which an unfairly discriminatory model output is unreachable. § 2304(22) adds a separate express prohibition on discrimination "because of the insured's race, color, religion, sexual orientation, gender identity, military status, or national origin", reaching both the writing of any policy and the classification of or reference to any individual on those bases. SECOND, THE PROCEDURAL TRAP, which is easy to misread and changes the shape of the exposure. § 2307(a) lets the Commissioner proceed against any unfair method of competition or unfair or deceptive act or practice "WHETHER OR NOT DEFINED IN § 2304 OR § 2305", on a statement of charges and a hearing set not less than 10 days after service. But § 2308(a) makes the monetary penalty available only "IF THE ACT OR PRACTICE IS A VIOLATION OF § 2304 OR § 2305". So for a novel AI-driven practice that is unfair but not enumerated — and the enumerated list is a 1960s-vintage catalogue that says nothing about models — the first-instance outcome is a bare cease and desist order with no fine attached, and money arrives only if the order is then violated, under § 2311, at not more than $11,500 per act. The corollary is that a carrier facing a first-instance UTPA action on an unenumerated theory has more room than the headline penalty suggests, and a carrier that ignores a resulting order has far less. § 2312(a) lets the Commissioner promulgate regulations identifying specific prohibited practices but expressly forbids regulations that "enlarge upon or extend the provisions of § 2304 or § 2305" — which is precisely why Bulletin 148 could not have created a new enforceable AI duty even if it had tried to, and is a second reason its footer disclaims legal duties. § 2313 preserves all other enforcement powers, and § 2308(f) provides that no order relieves anyone of any other liability, penalty or forfeiture.

This is the hardest clinician reservation recorded in this vein, it predates every AI instrument by decades, and it is one sentence. 18 Del. C. § 6410(a), in Chapter 64 (Regulation of Managed Care Organizations), provides: "A managed care organization shall have a medical director. The medical director shall be licensed to practice medicine in Delaware in accordance with § 1702 of Title 24. The medical director's duties shall include, at a minimum, those specified in regulations promulgated by the Department pursuant to the authority granted. The medical director may assign duties to other physicians and nonphysician personnel employed by, or under contract to, the managed care organization, provided, however, that THE MEDICAL DIRECTOR SHALL RETAIN RESPONSIBILITY FOR ASSIGNED DUTIES. ANY DECISION TO DENY A COVERED SERVICE SHALL BE RENDERED BY A PHYSICIAN." Measure it against the bars recorded so far. The District of Columbia bars the adverse determination itself from being made by an AI system. Rhode Island requires the determination to be made, documented and signed by a clinician of the same licensure. New Hampshire requires a "licensed or certified health care provider" (RSA 420-E:4, II) or a "qualified health care provider" under a Delaware-equivalent medical director's clinical direction (RSA 420-J:6, III), and expressly disclaims a specialty match at first review. Delaware narrows the class of permissible decider further than any of them: not a clinician, not a licensed health-care provider, but A PHYSICIAN. There is no AI carve-out because there is no need for one — a model is not a physician, and the sentence is unqualified as to method, technology or claim type. Two further points make it usable rather than merely rhetorical. First, the medical director "shall retain responsibility for assigned duties", so delegating a denial pipeline to a vendor or to non-physician staff does not move the responsibility off the Delaware-licensed medical director. Second, § 6410(b) requires that no managed care organization delivering health-care services in the State may contract with or employ, for the delivery of such services, "any person who does not hold a Delaware license to practice the profession for which such person is engaged or employed, if such practice requires a license" — a licensure gate on the delivery side that sits alongside the physician gate on the denial side. HONEST NEGATIVE, WITH METHOD: Chapter 64 was string-scanned in full this session for "artificial intelligence", "algorithm", "machine learning", "automated" and "predictive model" and returned ZERO occurrences. Delaware has no AI-specific utilization-review statute. It does not need one for this purpose, and a compliance programme should treat § 6410(a) as the operative rule rather than waiting for an AI-labelled provision — but the negative should be stated accurately: an AI system may lawfully support, triage, flag or recommend, and what it may not do is render the denial.

The Delaware Pre-Authorization Act of 2025 — Senate Bill 12 as amended by Senate Amendment No. 1, signed 25 August 2025, 85 Del. Laws c. 176 — rewrote 18 Del. C. § 3372 and produced the strictest FIRST-INSTANCE reviewer qualification in this vein. VERIFY THE VEHICLE BEFORE CITING IT: Senate Bill 6 of the same session, also titled a Delaware Pre-Authorization Act of 2025, was STRICKEN on 15 May 2025 and is not law; secondary summaries conflate the two. The enacted provisions read as follows. § 3372(e)(1): where a clean pre-authorization request is submitted by a physician or a physician's representative, the insurer, health-benefit plan, health-service corporation or utilization review entity "must ensure that any adverse determination is made by A PHYSICIAN" who satisfies both (a) "any compensation paid to the physician IS NOT CONTINGENT UPON THE OUTCOME OF THE REVIEW", and (b) at least one of: the physician "is licensed in any United States jurisdiction with appropriate training, knowledge, or experience IN THE SAME OR SIMILAR SPECIALTY that typically manages or consults on the health-care service in question"; or the physician is licensed in any United States jurisdiction and acts "in consultation with an appropriately qualified third-party health-care provider licensed in the same or similar medical specialty as the requesting physician, or a health-care provider with experience related to the covered person's associated condition", that consultant's compensation also being non-contingent. Delaware is therefore the FIRST state in this vein to attach a same-or-similar-specialty requirement at the first determination rather than only on internal appeal — New Hampshire went the other way and expressly disclaimed it at RSA 420-J:6, X — and the first to add a compensation-independence rule, which is the provision that most directly reaches a utilization review entity whose economics reward denial volume. § 3372(e)(2): an appeal from an adverse determination on a physician-submitted request must be reviewed and determined by a physician who meets everything in (e)(1) AND holds "a current, unrestricted license in good standing to practice medicine in any United States jurisdiction", "was NOT DIRECTLY INVOLVED in making the adverse determination under appeal", and "reviews and considers ALL CLINICAL ASPECTS of the health-care service under appeal, including all medical records of the covered person submitted as part of the pre-authorization process" — a completeness duty an automated appeal triage cannot satisfy by sampling. § 3372(e)(3): where the request came from a health-care provider who is not a physician, the adverse determination or appeal review must be made by a provider "licensed in the same or similar profession as the health-care provider submitting the request", or by a licensed provider in consultation with an appropriately qualified third-party provider in the same or similar medical specialty, again on non-contingent compensation. § 3372(e)(4): the utilization review entity must notify the covered person and the submitting provider of the appeal determination WITHIN 15 DAYS of receipt; if it cannot decide within that window because additional information, documentation or medical records are needed, it must say so in writing within the 15 days specifying exactly what is required, and then has 15 days from receipt of that material. The written notification must include "a summary of the findings supporting the determination made in the appeal", "THE QUALIFICATIONS OF ANY REVIEWER involved in making the determination in the appeal, INCLUDING ANY LICENSE, CERTIFICATION, OR SPECIALTY DESIGNATION of any reviewer", and "the relationship between the covered person's diagnosis or disease being treated and the review criteria used as the basis for the determination in the appeal, including the specific basis for the determination made" — a clinical-rationale duty that a criteria-matching model must be able to render in prose. Note the shape of the disclosure honestly: it is QUALIFICATIONS, not the reviewer's name, and it attaches on APPEAL, not at first determination — narrower on both axes than New Hampshire's RSA 420-E:4, V(b)(3)(A) "name and credentials ... including board status and the state or states where the person is currently licensed" at first determination. § 3372(e)(5) adds the availability rules: the utilization review entity must perform utilization review on weekends, provide access to a medical director or other clinical decision maker Monday to Friday between 7:00 a.m. and 7:00 p.m. and during reasonable business hours Saturday and Sunday, maintain procedures for appeals submitted in writing, electronically or by telephone, and allow a minimum of 30 days from the date of an adverse determination for an appeal to be submitted. APPLICATION DATE — a live 2027 boundary: 85 Del. Laws c. 176, § 4 applies the Act to health insurance policies, contracts or certificates "issued, renewed, modified, altered, amended, or reissued in this State AFTER DECEMBER 31, 2026", as the Department confirmed in its own implementation instrument, Domestic and Foreign Bulletin No. 163 (3 November 2025). HONEST NEGATIVE: Chapter 33 subchapter II, including every SB 12 amendment, contains ZERO occurrences of "artificial intelligence", "algorithm", "machine learning", "automated" or "predictive" — string-scanned in full this session. These are species-of-decider rules, and they bind an AI-assisted pre-authorization pipeline because of what the decider must BE, not because of what the statute says about AI.

The same Act supplies a timing regime whose deadlines an automated pre-authorization pipeline must be built around, and a forfeiture rule that makes missing them expensive. 18 Del. C. § 3373 sets the clocks, all running from receipt of a CLEAN pre-authorization (defined to include the results of any face-to-face clinical evaluation or second opinion that may be required): (a) a pharmaceutical, submitted through the § 3377 electronic route — 2 BUSINESS DAYS; (b) a health-care service NOT submitted electronically — 5 BUSINESS DAYS; (c) a health-care service submitted electronically — 3 BUSINESS DAYS; (d) an URGENT health-care service submitted electronically — 24 HOURS; (f) an urgent health-care service not submitted electronically — 48 HOURS; (e)(1) a PATIENT TRANSFER submitted electronically — 24 HOURS; (g) a patient transfer not submitted electronically — 48 HOURS. § 3374 routes emergency services to §§ 3349 and 3565. § 3373(e)(2) adds a substantive carve-out that a transfer-review model must encode: where the insurer has determined that a lower level of care at a health-care facility is clinically appropriate, it "may not require pre-authorization for medically necessary interfacility transport of the covered person". THE CRITERIA-CHANGE RULE IS THE ONE MOST DIRECTLY AIMED AT MODEL UPDATES, even though it never mentions models. § 3372(c)(2): where an insurer, health-benefit plan, health-service corporation or utilization review entity "changes UTILIZATION REVIEW TERMS, SUCH AS CLINICAL CRITERIA, for a health-care service, the change in utilization review terms DOES NOT APPLY TO COVERED PERSONS WITH AN EXISTING AUTHORIZATION for the health-care service, and will apply only upon RE-AUTHORIZATION", and notice must be given to covered persons "AT LEAST 6 MONTHS BEFORE any changes to utilization review terms", unless the change is due to clinical guideline status changes, recalls, market withdrawals or relevant FDA published safety information. A continuously-retrained or vendor-updated criteria model therefore cannot silently move underneath an existing authorization, and a criteria change that is not attributable to one of the four named clinical triggers carries a six-month lead time. § 3372(b) separately bars implementing a new or amended pre-authorization requirement until the website has been updated to reflect it, and § 3372(c)(1) requires 60 days' written notice of a new or amended requirement to currently authorized covered persons and all contracted providers. § 3372(a) requires current requirements and restrictions to be readily accessible on the website in clear, easily-understandable language, with clinical criteria "described in language easily understandable by a health-care provider practicing in the same clinical area" — an explainability standard pitched at the clinical peer, not the consumer. § 3372(d) imposes a REPORTING duty that will surface a model's behaviour without anyone examining the model: insurers, health-benefit plans and health-service corporations using pre-authorization must report de-identified statistics on approvals, denials and appeals to the Delaware Health Information Network at least TWICE ANNUALLY in the format and frequency it requests, and the Department may request the data at any time; for denials the aggregated reasons (medical necessity, incomplete submission), and for appeals the practitioner specialty, the medication or diagnostic test or procedure, the indication offered, the reason for the underlying denial, and "the number of denials OVERTURNED UPON APPEAL". § 3375 bars retrospective denial: a utilization review entity "may not revoke, limit, condition or restrict a pre-authorization on ground of medical necessity after the date the health-care provider received the pre-authorization", and any contract language purporting to disclaim payment on the basis of medical-necessity changes for pre-authorized and delivered services "shall be null and void". § 3376 fixes the effect and length of a pre-authorization and deems all other covered in-network services in a bundled-payment group approved where the group is pre-authorized. AND THE FORFEITURE RULE, § 3378: "ANY FAILURE by a utilization review entity to comply with the deadlines and other requirements specified in this subchapter will result in any health-care services subject to review to be AUTOMATICALLY DEEMED PREAUTHORIZED." § 3379 makes the subchapter non-waivable by contract issued or renewed after 1 January 2017 and voids any conflicting contractual arrangement.

All insurance carriers authorized to do business in Delaware are EXPECTED to develop, implement and maintain a written program (an "AIS Program") for the responsible use of AI Systems that make or support decisions related to regulated insurance practices. The programme must be designed to mitigate the risk of Adverse Consumer Outcomes — defined verbatim from the NAIC model as a decision by an insurance carrier "that is subject to insurance regulatory standards enforced by the Department that adversely impacts the consumer in a manner that violates those standards" — including at a minimum the statutory provisions set out in Section 1 (the UTPA at 18 Del. C. Ch. 23, the UCSPA at 18 Del. C. § 2304(16), CGAD at 18 Del. C. Ch. 85 with CGAD-R at 18 DE Admin. Code § 307, and the rate making laws at 18 Del. C. Chs. 25 and 26). READ THE PROPORTIONALITY SENTENCE, because Delaware is on the opposite side of it from New Hampshire: the controls and processes "should be reflective of, and commensurate with, THE INSURANCE CARRIER'S OWN ASSESSMENT OF the degree and nature of risk posed to consumers by the AI Systems that it uses" — Delaware kept the model's five words granting the carrier the measuring rod, where New Hampshire deleted them so the Department could substitute its own view of the risk. A Delaware carrier may therefore defend a thin control set by pointing to a documented internal low-risk classification in a way a New Hampshire insurer cannot; the corollary is that the classification itself must be documented and defensible, because Section 4 item 1.1(d) makes "how the AIS Program is tailored to and proportionate with the insurance carrier's use and reliance on AI Systems, the risk of Adverse Consumer Outcomes, and the Degree of Potential Harm to Consumers" an express production item. Five factors are weighed: the nature of the decisions being made, informed or supported using the AI System; the type and Degree of Potential Harm to Consumers; the extent to which humans are involved in the final decision-making process; "the transparency and EXPLAINABILITY of outcomes to the impacted consumer" (Delaware kept the model's "explainability" where New Hampshire substituted the undefined "articulable"); and the extent and scope of reliance on data, Predictive Models and AI Systems from third parties. The programme must span the whole insurance life cycle (product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, fraud detection) and the whole AI life cycle (design, development, validation, implementation of both systems and business, use, ongoing monitoring, updating, retirement), and must cover AI Systems whether developed in-house or by a third-party vendor. It may sit inside or outside the enterprise risk management programme and may adopt or rely upon a third-party framework such as the NIST Artificial Intelligence Risk Management Framework, Version 1.0. Guideline 1.9 requires processes providing NOTICE to impacted consumers that AI Systems are in use, with access to appropriate levels of information based on the phase of the insurance life cycle involved. Delaware did NOT insert New Hampshire's "insurers should consider the following guidelines" lead-in, so the guidelines here carry the model's own voice. Weigh all of it against the footer, though: the Bulletin states on its face that it "is not intended to set forth legal rights, duties, privileges", which is why the enforceable content of this requirement is the statutes it points at rather than the guidelines themselves.

Vest responsibility for the development, implementation, monitoring and oversight of the AIS Program — and for setting the carrier's strategy for AI Systems — with "senior management ACCOUNTABLE TO THE BOARD OR AN APPROPRIATE COMMITTEE OF THE BOARD". Record that Delaware kept this clause, because New Hampshire deleted it and the two states therefore hand an examiner different leverage: a Delaware examiner has a bulletin hook to ask who on the board hears about AI and how often, and a New Hampshire examiner does not. The board tie is reinforced from the second authority the Bulletin names: the Corporate Governance Annual Disclosure Act, 18 Del. C. Ch. 85, and the Bulletin states expressly that "the requirements of CGAD and CGAD-R apply to elements of the insurance carrier's corporate governance framework that address the insurance carrier's use of AI Systems to support actions and decisions that impact consumers" — so for a Delaware-domiciled carrier the AI governance structure is a CGAD disclosure item, not merely a bulletin expectation. The governance framework should prioritise transparency, fairness and accountability in the design and implementation of AI Systems, recognising that proprietary and trade secret information must be protected, and the carrier may adopt new internal governance structures or rely on existing ones. It should address: the policies, processes and procedures, including risk management and internal controls, to be followed at each stage of an AI System life cycle from proposed development to retirement; the requirements adopted to DOCUMENT compliance with the AIS Program policies, processes, procedures and standards, with the express instruction that "documentation requirements should be developed with Section 4 in mind" — which in Delaware means the full itemised production list, retained without cuts; and the internal AI System governance accountability structure, covering the formation of "centralized, federated, or otherwise constituted" committees drawn from business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance and legal (Delaware kept the model's qualifier that New Hampshire dropped), scope of responsibility and authority, chains of command and decisional hierarchies, the independence of decision-makers and lines of defence at successive stages of the life cycle, monitoring, auditing, escalation and reporting protocols, and ongoing training and supervision of personnel. Specifically as to Predictive Models, the framework should cover the processes and procedures for designing, developing, verifying, deploying, using, updating and monitoring them, including a description of the methods used to detect and address errors, performance issues, outliers or unfair discrimination in the insurance practices resulting from the model's use.

The AIS Program should document the carrier's risk identification, mitigation and management framework and internal controls for AI Systems generally and at each stage of the AI System life cycle. Guideline 3.0 asks that these address: the oversight and approval process for the development, adoption or acquisition of AI Systems, "as well as the identification of constraints and controls on automation and design to align and balance function with risk" (Delaware kept the model's formulation; New Hampshire rewrote it to make the named statutes the yardstick); data practices and accountability procedures including data currency, lineage, quality, integrity, "BIAS ANALYSIS AND MINIMIZATION", and suitability; management and oversight of Predictive Models and the algorithms used within them, covering inventories and descriptions, detailed development and use documentation, and assessments such as interpretability, repeatability, robustness, regular tuning, reproducibility, traceability, model drift and the auditability of those measurements where appropriate; validating, testing and retesting as necessary to assess the generalization of AI System outputs upon implementation, including the suitability of the data used to develop, train, validate and audit the model, with validation permitted to take the form of comparing model performance on unseen data available at development time against performance observed post-implementation, measuring performance against expert review, or other methods; protection of non-public information, particularly consumer information, including unauthorized access to the Predictive Models themselves; data and record retention; and, specifically for Predictive Models, a narrative description of the model's intended goals and objectives and how it is developed and validated. TWO EDITS DELAWARE DID NOT MAKE, recorded because they are the ones New Hampshire did make and a multi-state programme has to reconcile them. First, the Section 3 verification paragraph here reads that the Department "also encourages the development and use of verification and testing methods to identify errors AND BIAS in Predictive Models and AI Systems, as well as the potential for unfair discrimination" — Delaware retained "and bias" and did not upgrade "also encourages" to "strongly encourages". Second, Delaware says plain "bias analysis and minimization" at all four places it appears (Guideline 3.2 and Section 4 items 1.1(e)(i)(2), 1.3(b) and 1.3(c)(ii)(2)) where New Hampshire inserted "UNFAIR" at every one. The practical effect is that measured bias which a carrier characterises as actuarially justified sits INSIDE the literal Delaware wording and outside the literal New Hampshire wording — a programme built to the New Hampshire text will under-comply in Delaware. "Model Drift" is defined at Section 2 as "the decay of a model's performance over time arising from underlying changes such as the definitions, distributions, and/or statistical properties between the data used to train the model and the data on which it is deployed", and Section 4 items 1.3(d) and 2.4 warn that documentation of validation, testing and auditing "including evaluation of Model Drift" will be requested — using the capitalised defined term in Section 4 where Guideline 3.3(c) uses lower-case "model drift", exactly as the NAIC model does.

Each AIS Program should address the carrier's process for acquiring, using or relying on (i) third-party data to develop AI Systems and (ii) AI Systems developed by a third party, which may include, as appropriate, the establishment of standards, policies, procedures and protocols relating to: due diligence and the methods employed to assess the third party and its data or AI Systems, "to ensure that decisions made or supported from such AI Systems that could lead to Adverse Consumer Outcomes will meet THE LEGAL STANDARDS IMPOSED ON THE INSURANCE CARRIER ITSELF" — Delaware kept the model's referent here, where New Hampshire narrowed it to "statutes and regulatory standards"; where appropriate and available, the inclusion of contract terms providing audit rights and/or entitling the carrier to receive audit reports by qualified auditing entities, and requiring the third party to cooperate with the carrier regarding regulatory inquiries and investigations related to the carrier's use of the third party's product or services; and the performance of those contractual audit rights and other activities to confirm the third party's compliance with contractual and, where applicable, regulatory requirements. Delaware kept BOTH qualifiers New Hampshire deleted — "as appropriate" on the standards-setting clause and "where applicable" before "regulatory requirements" in Guideline 4.3 — so on the Delaware text the confirmation activity is expressly softened, and no specific contract clause is mandated anywhere. "Third Party" remains defined at Section 2 as "an ORGANIZATION other than the insurance carrier that provides services, data, or other resources related to AI", the model's narrower noun, which Rhode Island broadened to "entity" and Delaware did not. What makes the third-party position discoverable rather than academic is Section 4 item 2.2, which tells carriers that vendor CONTRACTS will be requested in a Department action, "including terms relating to representations, warranties, data security and privacy, data sourcing, intellectual property rights, confidentiality and disclosures, and/or cooperation with regulators", alongside item 2.1 (due diligence conducted on third parties and their data, models or AI Systems), item 2.3 (audits and/or confirmation processes performed regarding third-party compliance) and item 2.4 (validation, testing and auditing documentation including evaluation of Model Drift). Note the cross-cutting point that the AI bulletin does not make but Delaware statute does: under 18 Del. C. § 8309(a) a THIRD PARTY MAY FILE SCORING MODELS ON BEHALF OF INSURERS, so where the vendor model is a credit-based insurance scoring model the vendor relationship is already visible to the Commissioner through a mandatory filing rather than only through a document request.

Regardless of the existence or scope of a written AIS Program, in the context of an investigation or market conduct action a carrier can expect to be asked about its development, deployment and use of AI Systems, or any specific Predictive Model, AI System or application and its outcomes. Delaware retained the model's itemised list without cuts, and the retained detail is what makes this a real obligation: item 1.1 covers information "related TO OR EVIDENCING" the AIS Program — the written programme itself, documentation evidencing its adoption, its scope including any AI Systems and technologies NOT covered by it, how it is tailored and proportionate, and the policies, procedures, guidance and training materials, broken down into development/adoption/acquisition processes (constraints and controls on automation and design; data governance and controls including lineage, quality, integrity, bias analysis and minimization, suitability and Data Currency), Predictive Model management including "measurements, standards, or thresholds adopted or used", and protection of non-public information including unauthorized access to the models themselves. Item 1.2 covers pre-acquisition and pre-use diligence, monitoring, oversight and auditing of third-party data or AI Systems. Item 1.3 covers implementation and compliance evidence — coordinating-body formation and ongoing operation, data practices, model and AI System inventories and descriptions, and, "as to any specific Predictive Model or AI System THAT IS THE SUBJECT OF INVESTIGATION OR EXAMINATION" (Delaware kept this qualifier), compliance documentation, data source/provenance/lineage information, and the techniques, measurements, thresholds and similar controls used — plus item 1.3(d), validation, testing and auditing documentation "including evaluation of Model Drift", with the note that the nature of that work "should be reflective of the underlying components of the AI System, whether based on Predictive Models or Generative AI". Item 2 adds the third-party set. NOW THE GAP, and it is the most consequential omission in Bulletin 148. The NAIC model carries a fifth authority bullet — the Market Conduct Surveillance Model Law (#693) — for states to fill with their own citation; New Hampshire filled it with RSA 400-A:16 and RSA 400-A:37 and thereby imported a ten-working-day production deadline, and Connecticut filled it with Conn. Gen. Stat. §§ 38a-15 and 38a-16. DELAWARE DELETED THE BULLET AND CITED NOTHING IN ITS PLACE. What survives is an uncited sentence, which Delaware nonetheless tightened by two words: a carrier's conduct "is subject to investigation OR EXAMINATION, including market conduct actions". The actual authority has to be supplied from elsewhere in Title 18 and it is undated: 18 Del. C. § 318 authorises examination of insurers; § 320(a) requires the Commissioner to conduct each examination "in an expeditious, fair, and impartial manner" following the NAIC Examiner's Handbook; § 320(b) permits examination under oath of any officer, agent or individual believed to have material information; and § 320(c) requires every person being examined, with "the person's officers, attorneys, employees, agents and representatives", to "make freely available to the Commissioner, or the Commissioner's examiners, the accounts, records, documents, files, information, assets and matters of such person, in the person's possession or control, relating to the subject of the examination and shall facilitate the examination" — with no time limit whatever. § 320(d) lets the Commissioner employ experts to reconstruct inadequate records AT THE CARRIER'S EXPENSE after written notice and a reasonable opportunity to correct, which is the practical sanction for an undocumented model. § 320(e) bars removal of originals without written consent or a court order but expressly permits copies. § 321(c) then gives the carrier a defined window on the way out: the examiner files a verified report within 60 days of completing the examination, and the Department must afford the carrier "a reasonable opportunity of not more than 30 days" to make a written submission or rebuttal, with a hearing on written request inside that 30 days. For UTPA matters § 2306 supplies a parallel and equally undated power to "examine and investigate the affairs of every person engaged in the business of insurance in this State".

Bulletin 148 names the Unfair Claims Settlement Practices Act at 18 Del. C. § 2304(16) as its second authority, and Delaware's handling of it in the Bulletin is a genuine consolidation rather than a cut: the NAIC model carries the UCSPA as a separate bracketed bullet and asks the state to fill it, and Delaware folded it into a single clause because in Delaware the unfair claims settlement practices genuinely ARE an enumerated item inside § 2304 rather than a free-standing act. READ THE OPENING WORDS OF § 2304(16), because they set a threshold no other authority in this entry sets: "No person shall commit or perform WITH SUCH FREQUENCY AS TO INDICATE A GENERAL BUSINESS PRACTICE any of the following". A single mishandled claim is not a violation. This looks like a shield and is in fact the opposite for automated claims handling: a human adjuster's error is idiosyncratic and hard to aggregate into a general business practice, whereas a model applies the same logic to every claim it touches, so a single defect in a claims model produces the frequency the statute requires as a matter of construction rather than as a matter of proof. The enumerated practices most exposed to model-driven handling are: (a) misrepresenting pertinent facts or policy provisions relating to coverages at issue; (b) failing to acknowledge and act reasonably promptly upon communications about claims; (c) failing to adopt and implement reasonable standards for the prompt investigation of claims; (d) "refusing to pay claims WITHOUT CONDUCTING A REASONABLE INVESTIGATION BASED UPON ALL AVAILABLE INFORMATION" — the direct hook against a model that denies on a partial feature set; (e) failing to affirm or deny coverage within a reasonable time after proof of loss statements have been completed; (f) not attempting in good faith to effectuate prompt, fair and equitable settlements where liability has become reasonably clear; (g) compelling insureds to litigate by offering substantially less than the amounts ultimately recovered — the hook against a settlement-optimisation model tuned to expected litigation cost rather than to the claim's value; (h) attempting to settle for less than a reasonable person would have believed they were entitled to by reference to the advertising material accompanying the application; (i) settling on the basis of an altered application; (j) making claim payments unaccompanied by a statement of the coverage under which they are made; (k) making known a policy of appealing arbitration awards to compel acceptance of lesser settlements; (l) delaying investigation or payment by requiring a preliminary claim report and then formal proof of loss forms containing substantially the same information; (m) failing to settle promptly under one portion of coverage in order to influence settlements under another; and (n) "failing to promptly provide a REASONABLE EXPLANATION OF THE BASIS in the insurance policy in relation to the facts or applicable law for denial of a claim or for the offer of a compromise settlement" — the claims-side analogue of the § 8308(2) reason-code duty, and the provision an unexplainable denial model breaches directly. Note also § 2304(17), which makes failure to maintain a complete record of all complaints received since the last examination an unfair practice, the record to indicate the total number, classification by line, the nature and disposition of each complaint and the processing time — a dataset that will show a model's error pattern before any examiner asks for the model.

Where the internal process ends, 18 Del. C. § 6416 puts a medically-qualified stranger over the top of every medical-necessity denial, and the qualification standard at the external stage is stricter than the first-instance one in most states. § 6416(a) establishes the Independent Health Care Appeals Program in the Department of Insurance, whose final step is review by an Independent Utilization Review Organization ("IURO"), and supplies the statutory definition of medical necessity: "the providing of covered health-care services or products that a prudent physician would provide to a patient for the purpose of diagnosing or treating an illness, injury, or disease or its symptoms", in accordance with generally accepted standards of medical practice, consistent with the symptoms or treatment of the condition, and not solely for anyone's convenience. § 6416(b) makes any IURO determination BINDING on the health carrier; a determination for the carrier creates only a rebuttable presumption in later litigation, while a determination for the covered person may be appealed by the carrier to the Superior Court — where the Court appoints an independent attorney to defend the determination and assesses the expenses of the appeal, including that attorney's fees, AGAINST THE HEALTH CARRIER. § 6416(c) gives the covered person 4 MONTHS from the carrier's final internal decision to file the external request with the carrier, which must send an electronic copy to the Department on receipt. § 6416(d) has the Department assign an IURO, which notifies the covered person that additional information may be submitted WITHIN 7 DAYS of the notification. § 6416(e) imposes the carrier's production duty and it is the tightest clock in this entry: "WITHIN 7 CALENDAR DAYS after the date on which the health carrier receives notice of the IURO assigned, the health carrier shall provide to the assigned IURO ALL DOCUMENTS AND INFORMATION UTILIZED IN MAKING THE FINAL DECISION to deny, reduce or terminate benefits, as well as the final written decision from internal appeal." For an AI-assisted denial that phrase is the operative one — the model's inputs, criteria and outputs are "documents and information utilized in making the final decision", and they must exist and be retrievable within a week. § 6416(f) routes non-medical-necessity denials to the Department under § 332 instead, and § 6416(g) resolves ambiguity in favour of IURO review. § 6417 sets the IURO standards, and § 6417(c)(1) is the reviewer bar: expert reviewers must be physicians or other appropriate health-care practitioners who are "EXPERT IN THE TREATMENT of the covered person's medical condition, and KNOWLEDGEABLE ABOUT THE RECOMMENDED SERVICE OR TREATMENT THROUGH RECENT OR CURRENT ACTUAL CLINICAL EXPERIENCE treating patients with the same or similar medical conditions", hold a non-restricted licence in a State of the United States and, for physicians, "a current certification by a recognized American medical specialty board in the area or areas appropriate to the subject of review", with no history of disciplinary action or sanctions taken or pending. § 6417(c)(3) requires the absence of any material professional, familial or financial conflict of interest with the plan, its officers, directors or management, the proposing physician or practice, the institution, the manufacturer of the principal drug or device, the covered person, or any trade association of health benefit plans or providers. § 6417(c)(4)b sets the determination clocks: written determination within 45 DAYS of a completed application, and "in no event shall appeals involving an imminent, emergent or serious threat to the health of the enrollee, as determined by the treating health-care practitioner, exceed 72 HOURS", with review against "applicable, generally accepted practice guidelines developed by the federal government, national or professional medical practice societies, boards or associations AND ANY APPLICABLE CLINICAL PROTOCOLS OR PRACTICE GUIDELINES DEVELOPED BY THE CARRIER" — so the carrier's own criteria, including model-embodied criteria, are put in front of an independent same-condition expert. § 6417(b) makes the carrier responsible for ALL costs of the appeal regardless of outcome, reimbursable to the Department within 90 days of a final decision.

Domestic and Foreign Insurers Bulletin No. 150 (21 March 2025, Commissioner Trinidad Navarro), addressed to all property and casualty insurance companies, governs the use of aerial imagery captured by Unmanned Aircraft Systems in underwriting, claims handling and other insurance activities. It opens permissively — the Department "recognizes the role of UAS in the insurance industry", which have "proven to enhance efficiency in claim processing, loss assessments, and underwriting" — but it names the limitations that matter to an imagery-fed model: "image distortion, weather interference, and the inability to capture fine details, which may impact its accuracy and readability". The rules it lays down are hung on Chapter 41 rather than on the bulletin itself. Under 18 Del. C. § 4122(a), a written explanation of the SPECIFIC reasons for a declination must be provided to the applicant. Under § 4122(b), cancellation notices must be delivered or mailed at least 30 DAYS before the effective date — or 10 days where the cancellation is for non-payment of premium — and must include a written explanation of the specific reason. Under § 4123, for policies in effect more than 60 days or after the effective date of a renewal, the permissible cancellation grounds are limited to the circumstances that section identifies. Under § 4122(c), a non-renewal requires at least 30 DAYS' notice with a written explanation of the insurer's specific reason or reasons, and the Department "encourages insurers to provide as much advance notice as possible". THREE SUBSTANTIVE RULES CONSTRAIN THE MODEL. First, cosmetic findings do not support adverse action: "The Department maintains that cosmetic issues, such as discoloration and streaking, do not constitute valid grounds for cancellation" — a rule aimed squarely at roof-condition scoring, which is the dominant commercial use of insurance aerial imagery. Second, the SUBSTANTIALITY test: "Insurers must provide clear evidence of significant degradation or damage that increases the risk of loss to support a cancellation decision. An insurer must establish NOT ONLY THAT A RISK HAS INCREASED BUT ALSO THAT THE INCREASE IS SUBSTANTIAL." Third, the explanation rule, which is the imagery-side twin of § 8308(2): "Nonspecific reasons, such as 'claims experience,' 'underwriting judgment,' or 'increase in hazard,' are unacceptable as they do not provide sufficient notice for the insured to address the underlying issue." The Bulletin then invokes 18 Del. C. § 2303 and states three Department expectations: that statements about the accuracy or completeness of UAS imagery in policy decisions are "not deceptive or misleading"; that decisions based on UAS imagery are "consistent, objective, and do not lead to discriminatory underwriting practices"; and — the transparency duty — that insurers "maintain transparency by PROVIDING CUSTOMERS ACCESS TO UAS CAPTURED IMAGERY USED IN POLICY DETERMINATIONS". READ THE DISPUTE RULE HONESTLY, because Delaware is WEAKER here than New Hampshire and a multi-state programme should not assume otherwise: Delaware only "recommends that if a customer disputes a finding based on aerial imagery, the insurer SHOULD conduct a physical inspection to verify the accuracy of its assessment", where New Hampshire Bulletin 25-016-AB requires a follow-up physical inspection wherever imagery "does not unequivocally demonstrate property degradation or damage warranting a refusal to write or renew" and says that on a contested finding a physical inspection "remains necessary" even if the insurer believes it has compelling evidence. The Bulletin closes by naming its enforcement route explicitly — "Failure to comply may result in regulatory review and potential enforcement action as outlined in 18 Del. C. § 329" — and carries the same footer disclaimer as Bulletin 148.

Bulletin 148 names the Corporate Governance Annual Disclosure Act, 18 Del. C. Ch. 85, as its third authority and draws the connection expressly: "The requirements of CGAD and CGAD-R apply to elements of the insurance carrier's corporate governance framework that address the insurance carrier's use of AI Systems to support actions and decisions that impact consumers." The consequence is that for a Delaware-domiciled carrier the AI governance structure described in Guidelines 2.0 to 2.4 is not merely a bulletin expectation but content of an annual filing. § 8502(a) states the purpose: to provide the Commissioner a summary of the insurer or insurance group's corporate governance structure, policies and practices "to permit the Commissioner to gain and maintain an understanding of the insurer's corporate governance framework"; to outline the completion requirements; and to provide for confidential treatment of the disclosure and related information, which "will contain confidential and sensitive information related to an insurer or insurance group's internal operations and proprietary and trade secret information which, if made public, could potentially cause the insurer or insurance group competitive harm or disadvantage" — the provision a carrier relies on when the disclosure describes a proprietary model governance structure. § 8502(b) contains two limits worth reading together with the Bulletin. First, "nothing in this chapter shall be construed to prescribe or impose corporate governance standards and internal procedures BEYOND THAT WHICH IS REQUIRED UNDER APPLICABLE STATE CORPORATE LAW" — so CGAD is a disclosure regime, not a standard-setting one, and it cannot be used to manufacture an AI governance mandate that the substantive law does not impose. Second, and cutting the other way, "nothing in this chapter shall be construed to limit the Commissioner's authority, or the rights or obligations of third parties, under § 318 through § 321 of this title" — the examination powers, which is where the AI documentation actually gets produced. § 8502(c) fixes the scope: "the requirements of this chapter shall apply to all insurers DOMICILED IN THIS STATE." The form, content and filing requirements are in the Corporate Governance Annual Disclosure Regulation, 18 DE Admin. Code § 307, which the Bulletin cites by number. A Delaware-domiciled carrier should therefore expect the AI governance accountability structure — committee composition, chains of command, decision-maker independence, lines of defence, escalation and reporting protocols, and the board or board-committee accountability line that Bulletin 148 retained from the NAIC model — to be described in the CGAD rather than assembled for the first time when an examiner asks.

The Delaware Personal Data Privacy Act, 6 Del. C. Ch. 12D, effective 1 January 2025, sits alongside the insurance code and is routinely misdescribed as exempting insurers. IT DOES NOT. § 12D-103(b) lists the entities outside the chapter and they are: State and political-subdivision bodies (excluding institutions of higher education); "any financial institution or affiliate of a financial institution, all as defined in 15 U.S.C. § 6809, TO THE EXTENT THAT the financial institution or affiliate is subject to Title V of the Gramm Leach Bliley Act"; non-profits dedicated exclusively to preventing and addressing insurance crime; and registered national securities and futures associations. There is no free-standing insurer exemption, the GLBA exemption is conditional on being GLBA-subject and is bounded by "to the extent that", and § 12D-103(g) places the burden squarely on the carrier: "If a controller processes personal data pursuant to an exemption in this section, THE CONTROLLER BEARS THE BURDEN OF DEMONSTRATING that such processing qualifies for the exemption." Data-level exemptions at § 12D-103(c) do most of the practical work for an insurer — (c)(1) HIPAA protected health information, (c)(7) consumer-report information to the extent the activity is regulated by and authorized under the FCRA, (c)(11)a employment-context data, and (c)(14) "data subject to Title V of the Gramm Leach Bliley Act" — but they are data-scoped, not entity-scoped, so personal data an insurer processes for marketing, web analytics, lead scoring, agent-channel optimisation or product research outside GLBA, HIPAA and FCRA is not automatically outside the Act. WHAT THE ACT THEN REQUIRES OF A MODEL. "Profiling" is defined at § 12D-102(25) as "any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health, DEMOGRAPHIC CHARACTERISTICS, personal preferences, interests, reliability, behavior, location, or movements" — the inclusion of demographic characteristics makes this definition broader than most state analogues. § 12D-104(a) gives the consumer a right to opt out of "profiling in furtherance of SOLELY-AUTOMATED decisions that produce legal or similarly significant effects concerning the consumer", and § 12D-108(a)(3) triggers a data protection assessment where profiling "presents a reasonably foreseeable risk". Note the "solely-automated" qualifier: a genuine human decision-maker in the loop takes the decision outside the opt-out, which aligns the privacy analysis with 18 Del. C. § 6410(a)'s physician requirement and § 3372(e)(1)'s physician-reviewer requirement — a Delaware carrier that has built the human decider the insurance code demands has, incidentally, moved the same decision outside the DPDPA profiling opt-out. APPLICABILITY: § 12D-103(a) reaches persons conducting business in Delaware, or producing products or services targeted to Delaware residents, that in the preceding calendar year controlled or processed the personal data of not less than 35,000 consumers (excluding data processed solely to complete a payment transaction), or of not less than 10,000 consumers while deriving more than 20% of gross revenue from selling personal data. The 35,000 threshold is the lowest of any comparable state statute, so an insurer with a modest Delaware book can still be in scope for its non-exempt processing.