New Hampshire — NHID Bulletin Docket #INS 24-011-AB (NAIC AI Model, BIDIRECTIONALLY Edited) + Statutory Predictive-Model Rate Filing (RSA 412:16, II) + Credit-Scoring-Model Standards (RSA 412:15, III) + 10-Working-Day Production Duty (RSA 400-A:16, II) + Prior-Authorization Rewrite (RSA 420-J:6, SB 561 / 2024 ch. 172) + Aerial Imagery Inspection Bulletin 25-016-AB + Prior-Authorization Reporting Bulletin 25-001-AB: AI Compliance Requirements

All insurers authorized to do business in New Hampshire are EXPECTED to develop, implement and maintain a written program (an "AIS Program") for the responsible use of AI Systems that make, or support decisions related to, regulated insurance practices. New Hampshire kept the NAIC model's "are expected to" and did not downgrade it to a recommendation. The programme must be designed to mitigate the risk of Adverse Consumer Outcomes — defined here as a decision by an insurer, which is subject to insurance LAWS AND regulatory standards enforced by the Department, that adversely impacts the consumer in a manner that violates those laws — including at a minimum the statutory provisions set out in Section 1 (RSA 417, RSA 401-D and RSA 412:15). READ THE PROPORTIONALITY SENTENCE CLOSELY, because this is where New Hampshire departs from every other adopter in the vein. The NAIC model requires controls "commensurate with the INSURER'S OWN ASSESSMENT OF the degree and nature of risk posed to consumers". New Hampshire deletes those five words: controls must be "reflective of, and commensurate with, the degree and nature of risk posed to consumers by the AI Systems that it uses". The insurer's own risk rating is therefore not the measure — the Department can find the programme disproportionate on its own view of the risk, and an insurer cannot defend a thin control set by pointing to its internal low-risk classification. Five factors are weighed: the nature of the decisions being made, informed or supported using the AI System; the type and Degree of Potential Harm to Consumers; the extent to which humans are involved in the final decision-making process; the transparency and ARTICULABLE outcomes to the impacted consumer (the model says "explainability" — New Hampshire substituted "articulable", and the substituted term is not defined in Section 2); and the extent and scope of the insurer's use or reliance on data, Predictive Models and AI Systems from Third Parties. The programme must span the whole insurance life cycle (product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, fraud detection) and the whole AI life cycle (design, development, validation, implementation of both systems and business, use, ongoing monitoring, updating, retirement), and must cover AI Systems whether developed in-house or by a Third-Party vendor. It may sit inside or outside the enterprise risk management programme and may adopt or rely upon a third-party framework such as the NIST Artificial Intelligence Risk Management Framework, Version 1.0. Guideline 1.9 requires the programme to include processes providing NOTICE to impacted consumers that AI Systems are in use, with access to appropriate levels of information based on the phase of the insurance life cycle involved. One honest caveat on normativity: New Hampshire inserted a lead-in the model does not contain — "To help ensure compliance with the above-mentioned statutory requirements (RSA 417, RSA 412:15, & RSA 400-A:16 &37), insurers should consider the following guidelines" — so the numbered guidelines are framed as considerations even though the AIS Program expectation above them is not.

Vest responsibility for the development, implementation, monitoring and oversight of the AIS Program — and for setting the insurer's strategy for AI Systems — with SENIOR MANAGEMENT. Record what is missing, because it is a deliberate deletion and it changes who is on the hook: the NAIC model reads "with senior management ACCOUNTABLE TO THE BOARD OR AN APPROPRIATE COMMITTEE OF THE BOARD", and New Hampshire removed that clause. Guideline 1.3 as issued in New Hampshire stops at senior management, with no board reporting line. An insurer aligning to the model rather than to the New Hampshire text will over-comply here rather than under-comply, which is the safe direction — but a New Hampshire examiner has no bulletin hook to demand board-level AI accountability. The board is not out of the picture entirely: it re-enters through the Corporate Governance Annual Disclosure Act, which the bulletin names as its second authority and which requires the CGAD to be signed by the chief executive officer or corporate secretary attesting that a copy has been provided to the board or the appropriate board committee (RSA 401-D:3, II). The governance framework itself should prioritise transparency, fairness and accountability in the design and implementation of AI Systems, recognising that proprietary and trade secret information must be protected, and the insurer may adopt new internal governance structures or rely on existing ones. It should address: the policies, processes and procedures, including risk management and internal controls, to be followed at each stage of an AI System life cycle from proposed development to retirement; the requirements adopted by the insurer to DOCUMENT compliance with the AIS Program policies, processes, procedures and standards, with the express instruction that documentation requirements "should be developed with Section 4 in mind" — a pointed instruction in New Hampshire, because the state retained Section 4's itemised production list in full AND attached a ten-working-day statutory production clock to it; and the internal AI System governance accountability structure, covering the formation of committees drawn from business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance and legal (New Hampshire dropped the model's "centralized, federated, or otherwise constituted" qualifier), scope of responsibility and authority, chains of command and decisional hierarchies, the independence of decision-makers and lines of defence at successive stages of the AI System life cycle, monitoring, auditing, escalation and reporting protocols, and ongoing training and supervision of personnel. Specifically as to Predictive Models, the framework should cover the processes and procedures for designing, developing, verifying, deploying, using, updating and monitoring them, including a description of the methods used to detect and address errors, performance issues, outliers or unfair discrimination in the insurance practices resulting from the model's use.

The AIS Program should document the insurer's risk identification, mitigation and management framework and internal controls for AI Systems generally and at each stage of the AI System life cycle. Guideline 3.0 asks that these address: the oversight and approval process for the development, adoption or acquisition of AI Systems "with constraints and controls on automation and design TO MITIGATE RISKS THAT WOULD BE INCONSISTENT WITH THE ABOVE-MENTIONED STATUTES" — a New Hampshire rewrite of the model's vaguer "to align and balance function with risk", and a tightening, because it makes the named statutes the yardstick rather than an internal balancing exercise; data practices and accountability procedures including data currency, lineage, quality, integrity, UNFAIR bias analysis and minimization, and suitability; management and oversight of Predictive Models and the Algorithms used within them, covering inventories and descriptions, detailed development and use documentation, and assessments such as interpretability, repeatability, robustness, regular tuning, reproducibility, traceability, Model Drift and the auditability of those measurements; validating, testing and retesting as necessary to assess the generalization of AI System outputs upon implementation, including the suitability of the data used to develop, train, validate and audit the model, with validation permitted to take the form of comparing model performance on unseen data available at development time against performance observed post-implementation, measuring performance against expert review, or other methods; protection of non-public information, particularly consumer information, including unauthorized access to the Predictive Models themselves; data and record retention; and, specifically for Predictive Models, a narrative description of the model's intended goals and objectives and how it is developed and validated to ensure the AI Systems relying on it correctly and efficiently predict or implement those goals. TWO NEW HAMPSHIRE EDITS THAT NARROW THIS OBLIGATION, recorded because a compliance programme built to the NAIC text will not match the New Hampshire text. First, the model instructs the Department to encourage testing methods "to identify errors AND BIAS in Predictive Models and AI Systems, as well as the potential for unfair discrimination"; New Hampshire deletes "and bias", leaving "to identify errors in Predictive Models and AI Systems to limit the potential for unfair discrimination" — while simultaneously upgrading "also encourages" to "STRONGLY encourages". Second, wherever the model says "bias analysis and minimization" New Hampshire says "UNFAIR bias analysis and minimization", at all four occurrences (Guideline 3.2 and Section 4 items 1.1(e)(i)(2), 1.3(b) and 1.3(c)(ii)(2)). The practical effect is that measured bias which the insurer characterises as actuarially justified sits outside the literal wording, whereas the model's plain "bias analysis" would have captured it. MODEL DRIFT remains a defined term in Section 2 — "the decay of a model's performance over time arising from underlying changes such as the definitions, distributions, and/or statistical properties between the data used to train the model and the data on which it is deployed" — and Section 4 warns that documentation of validation, testing and auditing "including evaluation of drift" will be requested, so drift monitoring is not optional in practice even though the guideline voice is "should". Note that Section 4 uses the lower-case "drift" rather than the defined term. An honest caution inherited from the NAIC model: New Hampshire de-capitalised "Data Currency" to "data currency" throughout, which removes the model's implication that it was a defined term — it was never defined in either document.

Each AIS Program should address the insurer's process for acquiring, using or relying on (i) Third-Party data to develop AI Systems and (ii) AI Systems developed by a Third Party. New Hampshire kept the NAIC model's narrower definition of "Third Party" — "an ORGANIZATION other than the Insurer that provides services, data, or other resources related to AI" — and did not follow Rhode Island in broadening "organization" to "entity". The guidelines contemplate: due diligence and the methods employed by the insurer to assess the Third Party and its data or AI Systems, so that decisions made or supported by them which could lead to Adverse Consumer Outcomes "will comply with statutes and regulatory standards" — note that New Hampshire substituted "statutes and regulatory standards" for the model's "the legal standards imposed on the Insurer", which is a narrowing of the referent but leaves the principle intact that the insurer answers for the vendor's model; where appropriate and available, the inclusion of contract terms providing audit rights and/or entitling the insurer to receive audit reports by qualified auditing entities, and requiring the Third Party to cooperate with the insurer regarding regulatory inquiries and investigations related to the insurer's use of the Third Party's product or services; and the actual PERFORMANCE of those contractual audit rights and other activities to confirm the Third Party's compliance with contractual and regulatory requirements. TWO TIGHTENINGS TO NOTE. New Hampshire deleted "as appropriate" from the model's clause on establishing standards, policies, procedures and protocols for third-party arrangements, and deleted "where applicable" from the model's "compliance with contractual and, WHERE APPLICABLE, regulatory requirements" in Guideline 4.3 — so on the New Hampshire text the confirmation activity is directed at contractual and regulatory compliance without the escape hatch. Read the remaining qualifier honestly, though: the audit-rights and cooperation clauses are still conditioned on being "where appropriate and available", so no specific contract clause is mandated. Section 4 item 2.2 tells insurers that vendor CONTRACTS will be requested in a Department action, including terms relating to representations, warranties, data security and privacy, data sourcing, intellectual property rights, confidentiality and disclosures, and cooperation with regulators — so the contractual position is discoverable, and in New Hampshire it is discoverable on a ten-working-day clock under RSA 400-A:16, II.

This is the requirement that distinguishes New Hampshire from every other NAIC-model adopter in this vein, and it exists precisely BECAUSE New Hampshire filled a citation bracket the model left blank. Section 4 of the bulletin retains the model's itemised production list IN FULL — New Hampshire is on the District of Columbia side of that divide, not the West Virginia side. Regardless of the existence or scope of a written AIS Program, "in the context of a Department action" (the model says "an investigation or market conduct action") an insurer can expect to be asked about its development, deployment and use of AI Systems, or any specific Predictive Model, AI System or application and its outcomes including Adverse Consumer Outcomes, plus any other information the Department deems relevant. The itemised list covers: the written AIS Program itself; documentation relating to its ADOPTION; the scope of the programme including any AI Systems and technologies NOT included in or addressed by it; how the programme is tailored to and proportionate with the insurer's use and reliance on AI Systems, the risk of Adverse Consumer Outcomes and the Degree of Potential Harm to Consumers; policies, procedures, guidance and TRAINING MATERIALS; processes for development, adoption or acquisition including identification of constraints and controls on automation and design, and data governance and controls covering lineage, quality, integrity, unfair bias analysis and minimization, suitability and data currency; processes for management and oversight of Predictive Models including measurements, statutes and regulatory standards, or thresholds adopted or used by the insurer; protection of non-public information including unauthorized access to the models themselves; pre-acquisition and pre-use diligence, monitoring, oversight and auditing of Third-Party data or AI Systems; documentation of the formation and ongoing operation of the insurer's coordinating bodies for AI oversight; MODEL INVENTORIES and descriptions of the Predictive Models and AI Systems used to make or support decisions that can result in Adverse Consumer Outcomes; and, as to any specific Predictive Model or AI System, documentation of compliance with programme policies, information about the data used including source, provenance, lineage, quality, integrity, unfair bias analysis and minimization, suitability and currency, information on techniques, measurements, thresholds and similar controls, and documentation of validation, testing and auditing including evaluation of drift. New Hampshire deleted the model's limiting phrase "that is the subject of investigation or examination" from the per-model item, so the demand is not on its face confined to the model under investigation. THE CLOCK. Because Section 1 routes the Department's oversight through RSA 400-A:16 (Investigations) and RSA 400-A:37 (Examinations) by express citation, the production is not open-ended: RSA 400-A:16, II provides that any individual or entity transacting insurance in the state or otherwise subject to the commissioner's authority "shall, upon request of the commissioner, provide the commissioner with all documents and information relevant to any investigation under this section within 10 working days, or shall request within the 10 working-day period, for good cause shown, additional time to respond". Ten working days is not enough time to assemble a model inventory, lineage records and validation evidence that do not already exist — which is the operational reason to build the Section 4 artefacts in advance rather than on request. RSA 400-A:16, III makes material furnished to the Department confidential and privileged, not subject to RSA 91-A, not subject to subpoena, and inadmissible in private civil actions, which is the countervailing comfort. RSA 400-A:37, I(a) supplies the examination arm: the commissioner may examine any company as often as he or she deems appropriate and must examine each domestic insurer at least once every five years, with scope set by reference to the NAIC Market Regulation Handbook — which the bulletin's closing paragraph names explicitly.

The bulletin speaks in expectations; this does not. RSA 412:16, II provides that "Every insurer shall file with the commissioner every manual, PREDICTIVE MODEL OR TELEMATICS MODEL or other model that pertains to the formulation of rates and/or premiums, minimum premium, class rate, rating schedule or rating plan and every other rating rule, and every modification of any of the foregoing which it proposes to use." New Hampshire's rate-filing statute names predictive models expressly and as a filing obligation — so a property or casualty insurer that deploys a machine-learning rating model in New Hampshire has a statutory duty to file the model itself, not merely the rates it produces, and to file every MODIFICATION of it before use. For personal lines the filing must also include the underwriting rules used to determine the applicable rate or premium for an individual insured or applicant. Information in the underwriting rules that does not pertain to rate or premium formulation may be identified by the filer as proprietary, in which case it is kept confidential by the Department and is not subject to RSA 91-A. RSA 412:16, III requires the insurer to file, at the same time as the rate, all supplementary rating and supporting information used in support of or in conjunction with the rate; RSA 412:16, IV provides that where a filing is not accompanied by the supporting information the commissioner may require it, and until it is provided "the filing shall not be considered complete and may be subject to possible disapproval". TIMING, which is what makes this operational: under RSA 412:16, VII(a) personal-risk rates and supplementary rating information must be filed AT LEAST 30 DAYS BEFORE the effective date; under VII(b) commercial-risk rates (other than for large commercial policyholders) are filed for informational purposes only WITHIN 30 DAYS OF the effective date; under VII(c) filing requirements do not apply at all to policies issued to large commercial policyholders as defined in RSA 412:3, XI, though the insurer must keep classifications, rules and rates available for the commissioner's inspection and the policy must carry a conspicuous disclaimer in at least 10-point bold-faced type plus a signed and dated policyholder acknowledgment. In a NONCOMPETITIVE market, RSA 412:16, VIII imposes a 30-day waiting period before a filing becomes effective, extendable by the commissioner for a further period not exceeding 60 days on written notice within the waiting period; a filing is DEEMED to meet the chapter's requirements unless disapproved within that window; failure by the insurer to provide requested information within the window is deemed a request to withdraw the filing; and "Neither the insurer nor the commissioner may waive the timeliness requirements". SCOPE LIMIT, stated honestly: RSA 412:2, II excludes accident and health insurance, life insurance and annuities, reinsurance, ocean marine, title (with exceptions) and aircraft hulls from the chapter entirely, and RSA 412:16, I excludes financial guaranty, employment practices liability, commercial inland marine, directors and officers liability, boiler and machinery, commercial credit insurance products, surety bonds, mortgage guaranty and fiduciary liability from this section specifically. A health insurer's AI model is not filed under this section.

New Hampshire regulated algorithmic scoring in insurance long before it addressed AI, and the scoring rules are statutory where the AI rules are guidance. THREE PROVISIONS INTERLOCK. First, RSA 412:15, III(a): "The use of any information from credit reports, credit histories, and CREDIT SCORING MODELS for underwriting and rating purposes for homeowners insurance and private passenger automobile insurance shall be based upon objective, documented, and measurable standards and shall be used in a manner which provides for appropriate consumer protections, including adequate and clear consumer notice, procedures to promptly correct and adjust underwriting or rating decisions based on incorrect credit information, and confidentiality protections." Every element of that sentence is testable against a model: objective, documented and measurable standards; consumer notice that is both adequate and clear; a working correction-and-adjustment path when the underlying credit data is wrong; and confidentiality. Second, RSA 412:15, III(b) requires the commissioner to adopt rules under RSA 541-A regulating insurers' obligations in using such information, and provides that "Information that explains and justifies underwriting rules, credit scoring models or rating plans that rely upon credit reports, credit histories, or credit scoring mechanisms shall be included in the rate filing required pursuant to RSA 412:16" — so the justification for a credit-derived scoring model is not something held internally against a possible examination, it is a mandatory component of the rate filing itself. Third, RSA 417:4, VIII(g) makes it an unfair method of competition and an unfair or deceptive act in the business of insurance to charge "a higher premium for private passenger automobile or homeowner insurance SOLELY on the basis of information obtained from a credit rating, a credit history, or a credit scoring model". Read that limitation precisely: it is a sole-basis ban, not a prohibition on using credit as one input among several — but an AI rating model in which credit dominates to the point of being the operative basis for a surcharge sits squarely in its path, and the burden of demonstrating that other factors were operative falls on the insurer's own documentation. Note the coherence of the perimeter: all three provisions are confined to homeowners and private passenger automobile insurance, the same two personal lines, and none of them uses the words "artificial intelligence" — they bite on the mathematical object regardless of what it is called.

This is the statute the bulletin actually names as its third authority, and the bulletin's own gloss on it is that the standards "apply regardless of the methodology that the Insurer used to develop rates, rating rules, and rating plans" — meaning an insurer is responsible for assuring that rates developed using AI techniques and Predictive Models relying on data and Machine Learning do not produce excessive, inadequate or unfairly discriminatory rates. The statutory content: RSA 412:15, I provides that rates shall not be excessive, inadequate or unfairly discriminatory, with the excessiveness test qualified by market structure — a rate in a COMPETITIVE market shall not be disapproved for being excessive, while a rate in a NONCOMPETITIVE market is excessive if it is likely to produce a profit that is unreasonably high for the insurance provided or if expenses are unreasonably high in relation to services rendered. Inadequacy under I(c) requires that the rate be unreasonably low AND either endanger the insurer's solvency or have the effect of substantially lessening competition or tending to create monopoly. The unfair-discrimination test at I(d) is the one that a model must be engineered against, and it is stated as an actuarial standard rather than a protected-class standard: "Unfair discrimination exists if, after allowing for practical limitations, price differentials fail to reflect equitably the differences in expected losses and expenses." A rate is not unfairly discriminatory merely because it is averaged broadly among persons insured under a group, franchise or blanket policy or a mass marketed plan. THE HARD CLASSIFICATION BAN sits at RSA 412:15, II(b): risks may be grouped by classifications and classification rates may be modified by rating plans measuring variations in hazards or expense provisions, and "Such standards may measure any differences among risks that can be demonstrated to have a probable effect upon losses or expenses" — but "No risk classification, however, may be based upon race, creed, national origin or the religion of the insured." Two tests therefore run simultaneously on any AI classification system: every learned feature must be demonstrably probative of losses or expenses, and none may be based on the four named characteristics. The "demonstrated to have a probable effect" standard is a documentation burden that a black-box model satisfies only if the insurer can articulate the relationship. RSA 412:15, II(a) lists the criteria the commissioner weighs — past and prospective loss experience within and outside the state, conflagration and catastrophe hazards, a reasonable margin for profit and contingencies, dividends and returned premium, past and prospective expenses, special assessments and all other relevant factors. RSA 412:15, IV caps schedule rating for commercial risks (other than workers' compensation, governed by RSA 412:34) at "no greater than plus or minus 40 percent of the insurer's base rates", requires such ratings to be based on the insured's management, safety and loss control policies and record and on policy administration expenses, and requires insurers to RETAIN SUPPORTING DOCUMENTATION for such ratings — a hard numeric bound and a retention duty that an automated commercial rating tool must respect.

The rating chapter stops at property and casualty. The Unfair Trade Practices Act does not, and this is the provision through which an AI system used in health, life or disability underwriting is regulated in New Hampshire. RSA 417:3 prohibits any person engaged in the business of insurance from engaging in any trade practice defined in RSA 417 as an unfair method of competition or an unfair or deceptive act, and "person" under RSA 417:2, I means any individual, corporation, association, partnership, reciprocal exchange, inter-insurer, Lloyd's insurer, fraternal benefit society or other legal entity engaged in the business of insurance, INCLUDING agents, brokers and adjusters. RSA 417:4, VIII then defines Unfair Discrimination in eight subparagraphs, of which these bear directly on model design: (a) unfair discrimination between individuals of the same class and equal expectation of life in the rates charged for any contract of LIFE insurance or life annuity, or in the dividends or other benefits payable, or in any other terms and conditions; (b) unfair discrimination between individuals of the same class and of essentially the same hazard in the amount of premium, policy fees or rates charged for any policy or contract of HEALTH insurance, or in the benefits payable thereunder, or in any of the terms or conditions, "or in any other manner whatsoever", with discrimination on the basis of GENDER IDENTITY as to the availability of any covered services, medications, supplies or durable medical equipment specifically prohibited; (c) any unreasonable distinction or discrimination between persons as to the policy, premiums or rates charged for policies upon the lives or health of such persons, "or in any other manner whatever", including demanding a greater premium than the insurer then requires from persons of the same age, sex, general condition of health and prospect of longevity; (d) any unfair distinction or discrimination in any contract of insurance or annuity contract — a residual clause with no line limitation at all; (e) refusing to insure risks SOLELY because of age (except in life, accident or health insurance), place or area of residence, race, colour, creed, national origin, ancestry, marital status or lawful occupation including military service (except in life, accident or health insurance), or solely because another insurer refused, cancelled or non-renewed, or solely because the insured does not place collateral personal lines with the insurer; (f) refusing or limiting coverage solely because the applicant has been or may become a victim of DOMESTIC ABUSE OR VIOLENCE, with an express carve-out preserving underwriting on physical or medical history or condition "regardless of the underlying cause of the condition"; (g) the credit-based premium prohibition addressed separately in this entry; and (h) for life, annuity or disability coverage, refusing, discontinuing or limiting coverage based on the applicant having filled a prescription for an OPIOID ANTAGONIST where the prescription is not relevant to the applicant's own health but is designed to promote the health of someone else — with an affirmative duty on the carrier to inquire as to the reason and a right to request verifying documentation before issuing an underwriting decision. Subparagraphs (e), (f) and (h) are proxy-variable traps for machine-learned models: each names a specific feature that must not drive the decision, and (h) goes further by requiring an affirmative human inquiry before the underwriting decision issues, which no purely automated pipeline satisfies.

STANDING SWEEP RESULT, STATED FIRST AND HONESTLY: neither RSA 420-E (Licensure of Medical Utilization Review Entities) nor RSA 420-J (Managed Care Law), read in their current post-2024 text, contains a single occurrence of "artificial intelligence", "algorithm", "automated", "machine learning" or "predictive model". Both full chapters were string-scanned this session. New Hampshire has NO AI-specific utilization-review statute. What it has is a clinician reservation of a distinctive shape. THE RESERVATION. RSA 420-E:4, II provides flatly that "Claim benefit determinations shall be made by a licensed or certified health care provider." RSA 420-J:6, III (as rewritten by 2024, ch. 172:5, effective 1 January 2025) requires that a health carrier conducting utilization review directly or through a contracted utilization review entity "shall ensure that all medical necessity determinations are made by a qualified health care provider", and that the reviewing provider (a) "Have appropriate medical and professional expertise and credentials to competently apply the health carrier's clinical review criteria" and (b) "Make the medical necessity determination under the clinical direction of one of the health carrier's own medical directors or one of the contracted utilization review entity's medical directors who is responsible for the review of health care services provided to covered persons who are residents of New Hampshire." RSA 420-J:6, IV requires each carrier conducting utilization review to employ one or more medical directors responsible for all utilization review techniques and methods and their administration and implementation, "who shall be licensed in New Hampshire under RSA 329". No AI system is a licensed or certified health care provider, so no AI system can make a claim benefit determination or a medical necessity determination in New Hampshire — the reservation operates as a hard human-in-the-loop rule for the DECISION, whatever the model contributes upstream. THE ATTRIBUTION DUTY, which New Hampshire has in place of a signature requirement and which is more consumer-visible than one. RSA 420-E:4, V(b)(3)(A) requires that where a claim denial rests on a determination that the claim is experimental, investigational, or not medically necessary or appropriate, the written or electronic denial notice must state "the name and credentials of the carrier or other licensed entity, the medical director, including board status and the state or states where the person is currently licensed", and adds: "If the person making the claim denial is not the medical director but a designee, then the credentials, board status, and state or states of current license shall also be provided for that person." The human decider is therefore identified BY NAME AND CREDENTIALS to the claimant in the denial itself, and the duty follows the decision down to a designee. RSA 420-E:4, V(b)(3)(B) additionally requires an explanation of the clinical rationale reciting the terms of the plan, policy, clinical review criteria or internal rule relied on and how they apply to the claimant's specific medical circumstances — a per-claimant reasoning duty that a template output does not satisfy. MEASURED AGAINST THE STRONGEST FORM IN THIS VEIN, honestly: Rhode Island requires the adverse determination to be made, DOCUMENTED AND SIGNED by a practitioner of the SAME LICENSURE STATUS as the ordering provider. New Hampshire has the "made by a clinician" element and a strong attribution element, but there is NO signature mandate in either chapter, and the same-or-similar-specialty rule attaches only at the internal appeal stage under RSA 420-J:5 — "The health care professional shall ... Be a practitioner in the same or similar specialty who typically treats the medical condition, performs the procedure, or provides the treatment at issue in the appeal" — not at the first determination. New Hampshire went further than merely omitting a specialty match at first review: RSA 420-J:6, X defines a "clinical peer" for peer-to-peer review as a health care professional with demonstrable expertise to review the case "whether or not the reviewing professional is in the same or a similar specialty as the provider" — an EXPRESS DISCLAIMER, the mirror image of Rhode Island's reservation, and a point on which a compliance programme calibrated to Rhode Island would mis-state New Hampshire law.

The 2024 rewrite of RSA 420-J:6 (2024, ch. 172:5, effective 1 January 2025) put hard, differentiated clocks on prior authorization, and attached a consequence that makes them self-enforcing against an automated pipeline. ELECTRONIC SUBMISSIONS (RSA 420-J:6, V): where a participating provider or facility submits through an electronic prior authorization process designated by the carrier, in NON-URGENT circumstances the carrier must approve or deny and notify both the covered person and the provider "within 7 CALENDAR DAYS of obtaining all information necessary to make the determination", and any request for additional information "shall be made within 7 calendar days of the prior authorization request date"; in URGENT circumstances the determination must be as expeditious as the medical condition requires and "not later than 72 HOURS after obtaining all information necessary", with any request for further information made as expeditiously as required to meet that 72-hour timeline assuming timely provider response. NON-ELECTRONIC SUBMISSIONS (RSA 420-J:6, VI): 14 CALENDAR DAYS in non-urgent circumstances (with the additional-information request still due within 7 calendar days of the request date) and the same 72 hours in urgent circumstances. RSA 420-J:6, VII provides that "all information necessary to make the determination" includes any information provided through a peer-to-peer review, so a carrier cannot stop its own clock by routing to peer review. THE DEEMER, which is the provision that most directly disciplines an AI-assisted queue: RSA 420-J:6, VIII states that "A prior authorization request shall be considered APPROVED if the health carrier fails to notify the covered person and the covered person's health care provider of the prior authorization determination within the timeliness standards for making a determination after obtaining all necessary information." A missed clock is not a fine — it is coverage. DURATION OF APPROVAL (RSA 420-J:6, IX(a)): a carrier "shall not revoke, limit, condition, or restrict a prior authorization if care is provided within 60 BUSINESS DAYS from the date the health care provider received approval", and IX(b) requires payment at the contracted rate for services provided under an authorization, subject to six exhaustively listed exceptions — material misrepresentation of the service in the request, the service no longer being a covered benefit on the day provided, the provider no longer being contracted on that date, failure to meet timely filing requirements, patient ineligibility on that date, or the carrier having no liability under the policy or provider contract. An automated retrospective-review tool that claws back an authorized service outside those six grounds violates IX(b) on its face. PEER-TO-PEER (RSA 420-J:6, X): where prior authorization is required the carrier must offer the provider the opportunity to request a peer-to-peer review — a direct conversational exchange with a medical director or designated clinical peer about the basis for the request — available before the determination or after a denial and before a formal grievance, and it "shall be made available by the health carrier within 2 BUSINESS DAYS of the request". Where requested after a denial, the carrier must treat it as a request for reconsideration external to the grievance process and provide a written determination stating the specific reasons with reference to the information provided in the peer-to-peer review, "within 7 BUSINESS DAYS of the peer-to-peer review". RSA 420-J:6, XI preserves external review rights under RSA 420-J:5-a and provides that, unless otherwise required by law, the chapter's prior authorization requirements "shall apply to all medical services and items".

RSA 420-J:6, II (as rewritten by 2024, ch. 172:5) imposes three publication duties that constrain how a carrier may change an AI-assisted prior authorization regime. FIRST, PUBLIC CRITERIA: a health carrier conducting utilization review directly or through a contracted utilization review entity "shall make any current prior authorization requirements and restrictions readily accessible on its website to enrollees, health care professionals, and the general public. This includes the WRITTEN CLINICAL CRITERIA. Requirements shall be described in detail, but also in easily understandable language." Both halves of that sentence bite on a model-driven regime: the clinical criteria a model applies must be published, in detail, and simultaneously in language a lay enrollee can follow. SECOND, CHANGE CONTROL: where a carrier or its contracted utilization review entity intends to implement a NEW prior authorization requirement or restriction, or to AMEND an existing one, RSA 420-J:6, II(b) requires it to (1) ensure the new or amended requirement "is not implemented unless the health carrier's website has been updated to reflect" it, and (2) "Provide contracted health care providers of enrollees written notice of the new or amended requirement or amendment NO LESS THAN 60 DAYS BEFORE the requirement or restriction is implemented." A retrained model that changes which requests are approved is, in substance, an amended requirement or restriction — so a carrier operating continuous model updates has to reconcile that cadence with a 60-day advance-notice duty and a website that must be updated first. THIRD, A DATED METRICS DUTY: RSA 420-J:6, II(c) provides that "Effective MARCH 31, 2026, health carriers conducting utilization review directly, or indirectly through a contracted utilization review entity, shall make prior authorization metrics as specified in 45 C.F.R. section 156.223 available to the commissioner, and the commissioner shall display relevant corresponding data, in a carrier specific format, on a website maintained by the insurance department in a readily accessible format." That date has passed, so the duty is live: the metrics are reported to the commissioner and then published BY THE DEPARTMENT in carrier-specific form. This is the closest New Hampshire comes to an AI transparency obligation for insurers, and it arrives without using the word "artificial intelligence" — the published figures expose approval, denial and overturn rates whatever produced them. Separately, RSA 420-J:6, I(a) requires each health carrier conducting utilization review to have written procedures for its utilization review processes and to FILE those procedures with the commissioner "on or before APRIL 1 of each year", conforming to the standards of either the Utilization Review Accreditation Commission or the National Committee for Quality Assurance; RSA 420-J:6, I(b) requires those written procedures to describe the categories of health care personnel performing utilization review activities and whether or not they are licensed in New Hampshire, and to address prior authorization requirements, second opinion programs, pre-hospital admission certification, pre-inpatient service eligibility certification, concurrent hospital review and confidentiality; and RSA 420-J:6, I(c) requires the clinical review criteria to be IN WRITING, developed with input from appropriate actively practicing practitioners in the carrier's service area, updated at least biennially and as new treatments and technologies emerge, developed in accordance with the standards of national accreditation entities, based on current nationally accepted standards of medical practice, and evidence-based if practicable.

Bulletin Docket #INS 25-001-AB, "Guidance on Prior Authorization Reporting" (January 2, 2025, Commissioner David J. Bettencourt, addressed to all New Hampshire licensed health carriers), implements SB 561 — the act carried into the RSA as 2024, ch. 172 — and turns the statutory metrics duty at RSA 420-J:6, II(c) into a concrete filing. THE DUTY: "Beginning January 1, 2025, all health carriers offering managed care health plans are required to collect data relating to prior authorization and provide such data in a format developed by the New Hampshire Insurance Department." The Department publishes a mandatory reporting TEMPLATE and requires all data to be submitted using it. THE CLOCK: data for calendar year 2025 was due no later than 1 April 2026, and "Data for the year 2026 and every year thereafter shall be reported annually to the Department no later than April 1st of the following year" — a standing annual deadline, not a one-off. THE CONSEQUENCE, stated by the Department in terms: "All health carriers are required to file complete, accurate, and compliant prior authorization data with the Department no later than April 1, 2026, for calendar year 2025. The Department MAY TAKE ADMINISTRATIVE ACTION against any health carrier that fails to file compliant data by the deadline." Note that the standard is not merely timely filing but COMPLETE, ACCURATE AND COMPLIANT data — a carrier whose approval and denial counts are generated by an automated pipeline must be able to stand behind those figures. THE PUBLICATION: "The Department will use the annual data to display carrier specific prior authorization metrics on https://nhhealthcost.nh.gov." Record a small divergence honestly: RSA 420-J:6, II(c) says the commissioner shall display the corresponding data "on a website maintained by the insurance department", while the bulletin names nhhealthcost.nh.gov; the statute and the bulletin are describing the same publication duty at different levels of specificity. INTERIM REPORTING: carriers were "strongly encouraged" — not required — to file quarterly interim reports through 2025 so the Department could assess data quality before the first annual deadline, and those interim reports "shall not be displayed or publicly disclosed on the Department's website". The bulletin also flags that NHID intended to rewrite its utilization-review administrative rules to reflect SB 561, with rulemaking to begin in early 2025 — so the rule layer beneath this bulletin is a moving target that a compliance programme should re-check rather than assume settled.

Bulletin Docket #INS 25-016-AB, "Aerial Imagery and Refusal to Write or Renew" (February 19, 2025, Commissioner David J. Bettencourt, addressed to all property and casualty insurance companies), is the Department's response to complaints that "certain carriers are refusing to renew homeowners' policies, because of poor roof conditions MISTAKENLY identified in aerial photographs". It is the sharpest instrument NHID has issued on machine-assisted underwriting, and — unlike Bulletin INS 24-011-AB — it speaks in MUST, not in expectations. THE PERMISSION: "The Department does not seek to inhibit the use of aerial imagery. Insurers can freely employ this technology to evaluate a property's condition." THE LIMIT: "insurers must understand that aerial imagery, while useful, is not infallible and has its limitations. To safeguard consumers against unsupported underwriting decisions, insurers must implement appropriate CHECKS AND BALANCES when using aerial imagery." THE SUBSTANTIVE RULE: an insurer has the right to refuse coverage where clear evidence of property degradation or damage exists, but "insurers cannot justifiably decline coverage based solely on COSMETIC issues, such as roof discoloration, which do not fundamentally affect the structural integrity of the property". THE TWO INSPECTION TRIGGERS, which are the operative obligations. First, an evidentiary trigger: "If aerial imagery does not unequivocally demonstrate property degradation or damage warranting a refusal to write or renew, insurers MUST conduct a follow-up physical inspection to validate any suspected issues derived from aerial data." The threshold is UNEQUIVOCAL demonstration — anything short of that requires a human on site before declination. Second, and more absolute, a contest trigger: "Furthermore, if an applicant or insured contests the insurer's findings — EVEN IF THE INSURER BELIEVES IT HAS COMPELLING EVIDENCE — conducting a physical inspection of the property remains necessary." That second duty admits no evidentiary defence: the consumer's objection alone compels the inspection. For a model builder the consequence is architectural rather than documentary — an automated imagery-based non-renewal pipeline cannot be closed-loop in New Hampshire, because it must have a physical-inspection branch that fires both on model uncertainty and on consumer contest, and the contest branch must be reachable by an insured who disputes the finding. Record the scope honestly: the bulletin is addressed to property and casualty insurers, is written around homeowners non-renewal and refusal to write, and never uses the words "artificial intelligence", "algorithm" or "model" — it bites on the imagery-derived underwriting decision regardless of what produced it, which is exactly why it reaches AI systems that Bulletin INS 24-011-AB only sets expectations for.

The bulletin names the Corporate Governance Annual Disclosure Act as its second authority and states that "The requirements of CGAD apply to elements of the Insurer's corporate governance framework that address the Insurer's use of AI Systems to support actions and decisions that impact consumers." That converts the AI governance structure from something examined on request into something REPORTED annually. RSA 401-D:3, I requires an insurer, or the insurance group of which it is a member, "no later than JUNE 1 of each calendar year" to submit to the commissioner a CGAD containing the information described in RSA 401-D:5; where the insurer is a member of an insurance group the report goes to the LEAD STATE commissioner determined under the most recent NAIC Financial Analysis Handbook. RSA 401-D:3, II requires the CGAD to include "a signature of the insurer or insurance group's chief executive officer or corporate secretary attesting to the best of that individual's belief and knowledge that the insurer has implemented the corporate governance practices and that a copy of the disclosure has been provided to the insurer's board of directors or the appropriate committee of such board." This is where the board re-enters the New Hampshire AI picture after Guideline 1.3 removed the board-accountability clause the NAIC model contained: the AI governance elements are inside the CGAD, and the CGAD must be attested as having gone to the board. RSA 401-D:3, III empowers the commissioner to require a CGAD from an insurer not otherwise obliged to file one. RSA 401-D:3, IV permits the disclosure to be made at ultimate controlling parent level, intermediate holding company level or individual legal entity level depending on how governance is structured, and encourages filing at the level at which risk appetite is determined or at which earnings, capital, liquidity, operations and reputation are overseen collectively. SCOPE, stated precisely because it is narrower than the bulletin: RSA 401-D:1, III provides that "The requirements of this chapter shall apply to all insurers DOMICILED in this state" — so unlike the bulletin, which addresses all insurers licensed to do business in New Hampshire, the CGAD duty reaches New Hampshire-domiciled insurers only (plus any insurer the commissioner requests one from). RSA 401-D:1, II preserves the confidentiality rationale and provides that nothing in the chapter limits the commissioner's authority under RSA 400-A:37.