AI evaluation records and insurance: what a timestamped criteria record can and cannot show
Insurers and brokers who assess AI-exposed risks may ask how an insured tested its AI systems. This page describes one technical record that can be part of that answer, and its limits.
What we are not claiming
We do not know of any insurer that requires an independently timestamped record of evaluation criteria. We make no claim about premiums, terms, exclusions, cover, claims outcomes, risk reduction or legal sufficiency. Whether a record like this is useful is for the insurer and the insured to decide.
What the record is
Before a test, whoever will run it writes down the evaluation criteria: the metric, the threshold, the test data and the pass bar. The criteria are signed, given an independent RFC 3161 timestamp and entered in a public registry. The format is PRML, an open specification.
A reviewer can check that a disclosed copy matches the version committed no later than the timestamp.
What it does not show
- It does not show when the tests ran, or that they ran after the timestamp.
- It does not show that the results are correct, or that the criteria were appropriate for the risk.
- It does not show that no other version of the criteria existed.
- It is not a qualified timestamp under eIDAS or Swiss law, and it is not a legal, actuarial or insurance assessment.
Where it could fit
An insured can choose to share the record with an underwriter or a claims handler, next to its test results and governance documents, to show which criteria were on record by a given date. It is one document among others and does not replace them.
See an example
The sample Evidence Pack and the acceptance record page show such a record end to end, with an offline check.