This article is for informational purposes only and does not constitute financial or legal advice. You should consult with a qualified professional before making any decisions about the use of AI in your firm.

---

What Third-Party AI Data Assurance Should Insurers Conduct for Discrimination Risk?

The data you feed your AI underwriting model is its lifeblood. If that data is tainted by bias, your model will become a discrimination engine, systematically producing unfair outcomes for your customers. When the FCA comes knocking, blaming your third-party data provider will not be a defence. It will be an admission that you have failed in your due diligence.

The insurance industry has an insatiable appetite for data. From credit scores and postcode data to social media and behavioural analytics, insurers are increasingly relying on third-party data to enrich their AI models and gain a competitive edge. But this data comes with a hidden risk: it is often riddled with historical biases and proxies for protected characteristics.

The Proxy Problem: Hidden Discrimination

Your data provider will tell you that their data does not contain any fields for race or ethnicity. That is irrelevant. The data is full of proxies – seemingly innocuous data points that are highly correlated with protected characteristics.

Proxy Variable	What it Could Be a Proxy For
Postcode	Ethnicity, socioeconomic status, level of education
Shopping habits	Age, gender, lifestyle choices
Job title	Gender, socioeconomic status
Credit score	Socioeconomic status, past financial hardship

If your AI model learns that a certain postcode is a high-risk factor, it may be inadvertently penalising a specific ethnic group that is concentrated in that area. This is the "ethnicity penalty" that the FCA is so concerned about. You may not be intending to discriminate, but your AI is doing it for you.

The Assurance Gap: Why Standard Data Contracts Are Not Enough

Your standard contract with your data provider, with its generic warranties about data accuracy, is completely inadequate for the age of AI. You need a new, more rigorous approach to data assurance, one that is specifically designed to address the risk of algorithmic discrimination.

Your due diligence on a third-party data provider must now be as rigorous as your due diligence on an AI model vendor. You need to go beyond the surface and ask the tough questions.

A Framework for Third-Party Data Assurance

Here is a practical framework for conducting the level of data assurance that the Consumer Duty demands:

1. Data Source and Collection Transparency

• Where did this data come from? You need to understand the original source of the data and the methods used to collect it.
• Was it collected ethically and legally? You need to see evidence that the data was collected in compliance with GDPR and other relevant data protection laws.

2. Data Composition and Representativeness

• What is actually in this dataset? You need a detailed data dictionary that explains every field.
• Is the data representative of the UK population? Or does it over-represent certain demographic groups and under-represent others? A non-representative dataset is a recipe for bias.

3. Bias and Fairness Auditing

• What bias testing have you conducted? You need to see the results of the vendor's own fairness audits. They should be able to show you how they have tested the data for correlations with protected characteristics.
• Can we test it ourselves? You should have the right to conduct your own independent bias testing on the data in a secure sandbox environment before you integrate it into your models.

4. Data Quality and Accuracy

• How do you ensure the data is accurate and up-to-date? You need to understand the vendor's data quality management processes.
• What is the error rate? No dataset is perfect. The vendor should be transparent about the known error rates and limitations of their data.

5. Contractual Accountability

• Does your contract include specific warranties about bias? Your contract should include clauses that explicitly address the issue of algorithmic bias and provide you with recourse if the data is found to be discriminatory.
• What is the liability in the event of a regulatory breach? Your contract should be clear about who is responsible if the use of the data leads to a breach of the Consumer Duty or other regulations.

The Bottom Line: You Own the Data Risk

When you ingest third-party data into your AI models, you are inheriting its risks. You cannot simply trust your data provider to have gotten it right. You have an independent duty to assure yourself that the data is fit for purpose and that it will not lead to unfair outcomes for your customers.

The FCA expects you to be able to demonstrate that you have taken these reasonable steps. They expect you to have a story to tell about how you have managed the risk of discrimination in your data supply chain.

If your only story is "we trusted our vendor," then you do not have a story. You have a regulatory problem.

---

Take the Next Step

If you are ready to move from theory to action, I can help. My AI Audit gives you a comprehensive assessment of your firm's AI readiness, identifying the gaps in your governance, the risks in your current tooling, and a clear roadmap to get you where you need to be.

Book a Discovery Call → or learn more about the AI Audit.