NAIC Fall Meeting Update: Third-Party Data And Models (H) Working Group Exposes Risk-Based Regulatory Framework For Third-Party Data And Model Vendors

On December 9, 2025, the Third-Party Data and Models (H) Working Group, which reports to the Innovation Cybersecurity and Technology (H) Committee exposed a draft Third-Party Data and Model Regulatory Framework (the "Framework"; available here). The proposed framework is targeted at increasing oversight of third-party data and model vendors contracted with insurers. The Framework would provide insurance regulators with access to third-party data and establish governance standards for vendors.

A key component of the Framework is the registration requirement of vendors with state departments of insurance before their materials and data could be used with insurers. Information regarding the vendor/entity, and model documentation would have to be provided at registration, and an annual attestation would have to be made as to adherence to third-party model vendor governance program requirements. Confidentiality for third-party model filings would be the same as for