EU AI Act vs the NYDFS AI Circular Letter: AI Underwriting Obligations Compared

What changed since the original framing

Two points in the common framing of this comparison are out of date. First, the EU AI Act's high-risk rules were originally due to apply on 2 August 2026. The Digital Omnibus on AI, proposed by the Commission on 19 November 2025, entered into force on 27 July 2026 and moved the dates. High-risk AI systems now have until 2 December 2027 for stand-alone systems and 2 August 2028 for systems embedded in products. The Commission cited delayed availability of standards as the reason. Any compliance plan built around August 2026 needs to be rebased.

Second, the NYDFS document that addresses AI in underwriting is titled 'Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing'. As of November 2026 it is published as a proposed circular letter, with no final number or effective date shown. The 2023 Circular Letter No. 7 is a different document, covering accident and health form and rate review, and does not address AI. This page therefore refers to the NYDFS AI letter as proposed expectations, not settled requirements.

Legal status and enforcement differ in kind

The EU AI Act is Regulation (EU) 2024/1689, a binding regulation described by the Commission as the first comprehensive legal framework on AI. Enforcement is shared between the Commission's AI Office, the European Data Protection Supervisor and national competent authorities designated by Member States. The headline penalty figures in the Commission's material, up to €35 million or 7% of worldwide annual turnover, apply to prohibited AI practices. They should not be read as the penalty for high-risk underwriting obligations.

The NYDFS document is different. It states DFS expectations for how authorized insurers, licensed fraternal benefit societies and the New York State Insurance Fund develop and manage their use of external consumer data and information sources (ECDIS), AI systems and other predictive models in underwriting and pricing insurance policies and annuity contracts. It is supervisory in character. Treating the two as equivalent frameworks produces a false mapping: one sets statutory obligations on defined roles, the other signals how a state regulator expects carriers to behave and may change before it is final.

Side-by-side comparison

The table covers only the dimensions that can be stated with confidence for each instrument as of November 2026.

• Instrument: EU AI Act: binding EU regulation. NYDFS: proposed circular letter stating DFS expectations.
• Who is addressed: EU AI Act: obligations on defined roles, including deployers who must assign human oversight. NYDFS: authorized insurers, licensed fraternal benefit societies and the New York State Insurance Fund.
• Scoping test: EU AI Act: classification as a high-risk AI system, with the Annex III list open to revision by delegated act. NYDFS: definitions of AI system (AIS) and ECDIS.
• Scope breadth: EU AI Act: scoped by high-risk classification. NYDFS: AIS used in whole or in part, as a supplement or proxy for traditional underwriting or pricing, or to establish 'lifestyle indicators'.
• Risk and governance: EU AI Act: a risk management system must be established, implemented, documented and maintained for high-risk systems. NYDFS: expectations to develop and manage use of AIS and ECDIS.
• Human oversight: EU AI Act: deployers assign oversight to people with competence, training, authority and support. NYDFS: addressed through its management expectations.

Where the regimes overlap and where they diverge

The clearest overlap is the expectation that a carrier knows what AI it uses in underwriting and pricing and manages it deliberately. Both instruments also reach the data going into those systems. The NYDFS letter addresses ECDIS alongside AIS and other predictive models, so external data inputs are within its scope. The AI Act's risk management and oversight duties apply to the high-risk system as a whole.

The divergence is in how each decides what is covered. The NYDFS definition is broad. Because it covers systems used in whole or in part, as a proxy or supplement, and for lifestyle indicators, the inventory reaches beyond the primary scoring model to enrichment tools and upstream data products. The AI Act uses a classification test, so some underwriting-adjacent tools may fall outside high-risk while still falling inside the NYDFS definition. A single inventory of underwriting and pricing AI systems and external data sources, tagged separately against each test, is the practical way to avoid maintaining two parallel lists.

The instruments also differ in stability. The AI Act is settled law with moving dates and a revisable high-risk list. The NYDFS letter may change before it is final, so mapping controls to it as fixed requirements risks rework.

What runtime enforcement can and cannot evidence

The following is analysis, not a statement of what either regime requires or what a regulator will accept. Controls that act on individual AI interactions and tool calls map most naturally to the input-governance and human-oversight themes. A policy in the execution path can restrict which data an underwriting assistant or agent may send to a model, redact sensitive attributes before they reach it, block disallowed actions, and escalate a decision for human approval. Each enforcement decision can be recorded as evidence of what the system was allowed to do and what it did.

The limits matter as much. An approval step can show that a named person reviewed a decision. It cannot show that the reviewer has the competence, training and authority the AI Act text requires of assigned overseers. Runtime logs can evidence part of a risk management system, but establishing, documenting and maintaining it sit in governance processes. Runtime policy also cannot substitute for bias testing, model validation or documentation of model lineage.

One design practice helps an examiner or auditor: keep a policy-version history alongside runtime records, so it is clear which rule was in force at the time of each decision. This is a suggestion, not a requirement in either instrument.

Where Trussed fits

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, with actions to allow, redact, block, rate limit or escalate for human approval. Enforcement happens at runtime, not in review after the fact, and it produces audit-ready evidence mapped to NYDFS and the EU AI Act. That evidence is relevant to the input-control and oversight-escalation questions above. Trussed does not replace bias testing, model validation or documentation of model lineage, and it does not show that an overseer is competent. Those remain with the carrier's governance and testing processes.