AI risk tiering

Overview

The NAIC AI Risk Evaluation Supplement asks an insurer for its materiality threshold, its risk assessment process, and each AI system’s inherent risk (risk before controls). Exhibit A’s inventory has a column for the inherent risk level, and Exhibit C covers the models the company itself sets as high risk.

Shield360 records these in two places:

• AI inventory → Risk tiering holds the organisation’s materiality threshold and risk criteria, explains how tiers are worked out, and lists the AI systems tiered high in the current environment.
• Each asset’s page in the AI inventory has a NAIC AI system profile with the tiering questions, the computed inherent tier and its reasons, an optional residual risk, and an override.

Caution

The tier is a record of your own risk assessment. Shield360 does not decide what is high risk for a regulator, and recording a tier is not a statement of compliance with the NAIC Model Bulletin or any state’s law.

Prerequisites

• Risk tiering is part of the Compliance module.
• To read it, you need inventory.read.
• To change a profile or set a tier by hand, you need inventory.manage. To change the materiality threshold and risk criteria, your organisation role must have inventory.manage.

Set the materiality threshold

Under Materiality and risk criteria, record:

Field	What to enter
Materiality threshold and Currency	The amount above which an impact is material, for example 5,000,000 USD.
Why this threshold is appropriate	The explanation the Supplement asks for, for example “1% of statutory surplus, as used for the financial examination.”
Set by	The role, committee or board that set it.
Set on	The date it was set.
The company’s risk criteria	How your AIS Program decides that an AI system is high, moderate or low risk.

These settings apply to the whole organisation. Every change is written to the audit log as ai_system.methodology.update with the threshold, its currency and date, and which fields changed. The free text is not copied into the audit log.

How the inherent tier is worked out

Each AI system’s tier comes from its profile. It needs three answers first: direct consumer impact, the decision role (automation, augmentation or support) and material financial impact. Until they are answered, the system is not tiered.

Financial impact is material when the profile’s estimated financial exposure reaches the organisation’s threshold. If either is missing, Shield360 uses the profile’s own material financial impact answer.

A system is high when any of these is true:

• It has a direct consumer impact and automates the decision.
• It has a direct consumer impact and acts without human approval, without limits.
• It has a material financial impact and automates the decision, or its outcomes cannot be reversed.
• It has a direct consumer impact on sensitive data (protected classes, medical or financial data) and automates or augments the decision.

Otherwise each answer adds points:

Factor	Points
Direct consumer impact	3
Decision role	Automation 3, augmentation 2, support 0
Material financial impact	3
Acts without human approval	Without limits 3, within set limits 1
Reversibility	Cannot be reversed 2, hard to reverse 1
Volume	High 2, moderate 1
Data	Sensitive 2, consumer 1
Vendor dependence	Critical 2, partial 1

High is 9 points or more, moderate is 4 to 8, and low is fewer than 4. An optional question that is not answered counts as the lowest answer, and the profile lists it as not answered. The profile shows each reason and its points as you answer, before you save.

Override and residual risk

An analyst can set the tier by hand with a reason. That tier is then reported instead of the computed one: in the inventory’s Risk tier column and filter, in the export, and in the high-risk list. The computed tier stays visible beside it. Select Use the computed tier to remove the override.

Each override is written to the audit log as ai_system.risk_override.set or ai_system.risk_override.clear. The entry records the tier set, the previous override, the computed tier and that a reason was given. The reason itself is stored on the profile.

Residual risk is the tier after controls. If you set it, you must give a rationale.

High-risk systems

The High-risk AI systems list on the Risk tiering page shows every system whose reported tier is high, with its operation areas and its inherent, reported and residual tiers. In the inventory, select High-risk systems or filter Risk tiers. The API filter is tier=high (also moderate, low or untiered).

An AI tool or model tiered high is in scope for an impact assessment.

API

curl -H "Authorization: Bearer $SHIELD360_API_KEY" \
  -H "x-shield360-organisation-id: $ORG_ID" \
  -H "x-shield360-project-id: $PROJECT_ID" \
  -H "x-shield360-environment: production" \
  "https://your-shield360-host/api/governance/ai-systems?tier=high"

Route	Does
GET /api/governance/ai-systems?tier=	Every profile in the environment with its inherent, reported and residual tier and reasons, and the organisation’s methodology
POST /api/governance/ai-systems	Registers an AI system or model by hand
GET, PUT /api/governance/ai-systems/profile?key=	Reads or records one asset’s profile and tiering answers
PUT /api/governance/ai-systems/override	Sets (risk, reason) or clears (risk: null) the tier set by hand
GET, PUT /api/governance/ai-systems/methodology	Reads or changes the organisation’s materiality threshold and risk criteria

Malformed JSON and unknown values are refused with 400. A key, parent system or vendor from another environment is not accepted.

AI inventory

Register AI systems and models and record their NAIC profile.

Impact assessments

Assess the systems in scope, high-tier tools and models included.