Green Mountain Mutual Insurance

\\n\\n \\n \\n\\n \\n\\n

---

\\n\\n \\n

Section 1 — Company Profile & Scope

\\n\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Field	Detail
Company	Green Mountain Mutual Insurance (fictional profile)
Headcount	180 employees across: underwriting (22), claims handling (38), field agents (45), IT & operations (15), sales & distribution (28), finance & compliance (12), executive (8), HR & admin (12)
Annual Premium Volume	$240M across regional P&C lines
Product Lines	Personal lines (homeowners, auto) ~55%; Small commercial (BOP, workers comp) ~30%; Farm & ranch ~10%; Specialty/excess ~5%
Geographic Focus	Vermont primary; expanded into NH and upstate NY since 2018
Distribution	Independent agent network (~85 agents); 3 direct sales staff; no captive captive agents
Current IT Infrastructure	On-premise core policy and claims system (PolicyPen v4); Azure-hosted file servers; Microsoft 365 E3; Salesforce for agent management; IBM Watson Assistant for customer service chatbot (pilot)
Current AI Usage	ChatGPT personal accounts (widespread); IBM Watson Assistant pilot; Microsoft 365 Copilot trial (12 users); no formal AI governance program
Decision-Makers	CEO, COO, VP Underwriting, VP Claims, CIO, Director of Compliance, Director of Agent Relations

\\n\\n \\n\\n

---

\\n\\n \\n

Section 2 — Current State Inventory

\\n

AI tools currently in use across the carrier, mapped by deployment type, user volume, and risk classification.

\\n\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Tool	Deployment Type	Users	Volume Estimate	Risk Flag
ChatGPT (free, personal accounts)	Consumer web — no enterprise controls	~65 employees (underwriting, claims, agents)	150–280 queries/day estimated	CRITICAL — No firm visibility, no data controls, GLBA exposure
Microsoft 365 Copilot	M365 E3 tenant — pilot phase	12 underwriters (trial)	Unknown — no reporting configured	HIGH — Consumer financial data in M365 tenant, no RBAC configured for AI access
IBM Watson Assistant	Cloud SaaS — customer service chatbot	Customer-facing (live to policyholders)	~800 conversations/month	MODERATE — Policyholder PII in Watson; carrier reviewing BAAs
PolicyPen AI features	Licensed on-premise system	22 underwriters, 8 processors	High — daily use	LOW — Vendor-controlled, on-premise
Salesforce Einstein AI	Cloud SaaS — agent management	28 sales staff	Moderate — lead scoring, email drafting	HIGH — Agent contact data, commission structures, agent PII in Salesforce cloud
Google Gemini (personal accounts)	Consumer web	~20 employees	Low — occasional use	CRITICAL — Same as ChatGPT free tier; no visibility
CLAIMS FRAUD MODEL (internal)	On-premise — legacy statistical model	Claims adjusters (required)	Used on ~40% of claims	MODERATE — Not AI/LLM; needs documentation for NAIC 668

\\n\\n \\n\\n

---

\\n\\n \\n

Section 3 — Data Sensitivity Map

\\n

Classification of data types by department, with AI tools currently touching each classification. This map forms the basis for GLBA and NAIC compliance documentation.

\\n\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Department	Data Types	AI Tools Touching This Data	Classification	Volume/Month
Claims Handling	Claim forms, medical reports (auto accident), police reports, body shop estimates, witness statements, bank account info for claim payments	ChatGPT (personal), Gemini (personal), M365 Copilot (trial)	CRITICAL — PII + PHI + financial data / GLBA / HIPAA adjacency	~1,400 claims/month; avg 8–12 documents/claim
Underwriting	Policy applications (SSN, DOB, financial disclosures), loss history reports, credit-based insurance scores, inspections, property records	ChatGPT (personal), M365 Copilot (trial), PolicyPen AI	CRITICAL — Non-public personal financial data / GLBA / NAIC regulated	~850 new policies/month; 400+ renewals/month
Field Agents	Customer contact info, policy documents, claims status inquiries, coverage questions, producer commission records	ChatGPT (personal), Salesforce Einstein, Gemini (personal)	HIGH — Agent PII, commission data, policyholder contacts / GLBA	~85 agents, avg 25 customer interactions/day
Customer Service (Watson)	Policy numbers, claim numbers, coverage questions, payment info, contact history	IBM Watson Assistant (live)	MODERATE — PII in third-party cloud / GLBA / contract review needed	~800 conversations/month
Sales & Distribution	Lead data, commission structures, agent performance metrics, competitive quote data	Salesforce Einstein, ChatGPT (personal)	HIGH — Agent PII, competitive data / GLBA	~200 new leads/month; 85 agent records
Finance & Compliance	Premium reports, loss ratio data, reserves, regulatory filings, audit workpapers	ChatGPT (personal), M365 Copilot (trial)	HIGH — Regulatory filings, financial data / SOX adjacency	Quarterly regulatory cycle; monthly financial reporting

\\n\\n

GLBA Safeguards Rule Compliance Gap

\\n

The GLBA Safeguards Rule (16 CFR Part 314), as updated in 2023, requires carriers to:

\\n

\\n
• Identify and classify all customer information (✓ in this assessment)
\\n
• Identify and assess risks to customer information (✗ not done — current AI usage undocumented)
\\n
• Implement controls to address identified risks (✗ no controls on personal AI accounts)
\\n
• Monitor and test controls (✗ no monitoring program exists)
\\n
• Require service providers to maintain appropriate safeguards (✗ no BAAs with AI vendors)
\\n

\\n \\n\\n

---

\\n\\n \\n

Section 4 — Exposure Scenarios

\\n

Three plausible incident scenarios based on observed carrier behavior and current AI usage patterns.

\\n\\n \\n \\n\\n \\n \\n\\n \\n \\n\\n

---

\\n\\n \\n

Section 5 — Recommended Architecture

\\n

Two AI capabilities are recommended for Phase 2 deployment: a claims triage assistant and an underwriting research agent. Both are deployed in a VPC-isolated environment with no data leaving the carrier's private infrastructure.

\\n\\n \\n\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Component	Description	Implementation
Claims Triage Assistant	First-pass review of incoming claims — coverage verification, reserve range recommendation, fraud indicator flag, medical record summarization. Trained on the carrier's claims history, coverage forms, and claims handling SOPs.	VPC-isolated; Llama 3.1 70B fine-tuned on claims corpus; RAG pipeline against claims document store; output is draft recommendation — handler reviews and approves
Underwriting Research Agent	Natural language Q&A against the full policy portfolio, rate manuals, underwriting guidelines, and agent communications. Underwriter asks: \\\"What's the exposure profile for this class code in Chittenden County?\\\" — gets answer from the carrier's own data, not from public sources.	VPC-isolated; Mistral fine-tuned on policy corpus; RAG against rate manual PDF library and agent email archive; audit log of every query and response
PHI Anonymization Layer	Medical records and other PHI-adjacent data is anonymized (not just redacted) before ingestion into the training corpus. The model learns from claim patterns, not from individual claimant identity.	HIPAA-adjacent design; de-identification pipeline before vector embedding; no raw PII in training data
Role-Based Access Controls	Underwriters see policy and rate data. Claims handlers see claim documents. Agents see customer contact data for their own book. No cross-role data surfacing without explicit access grant.	RBAC layer above document store; each AI query checks user role before returning data; principle of least privilege enforced
Immutable Audit Log	Every query and response is logged — user ID, timestamp, data sources accessed, output. Required for NAIC 668 documentation and GLBA compliance reporting.	Append-only log to separate audit store; SHA-256 integrity verification; exportable to compliance dashboard

\\n\\n \\n\\n

---

\\n\\n \\n

Section 6 — Phased Roadmap

\\n\\n \\n \\n\\n \\n \\n\\n \\n \\n\\n

---

\\n\\n \\n

Section 7 — Investment Estimate

\\n\\n

AI Readiness Assessment

\\n

Already completed for this fictional firm profile as part of the sample illustration.

\\n \\n \\n \\n \\n

Item	Amount
AI Readiness Assessment — full engagement	$7,500
Total Assessment	$7,500

\\n\\n

Private AI Build — Itemized Estimate

\\n

The $42K fixed-price covers two AI capabilities (claims triage assistant + underwriting research agent) deployed in VPC-isolated infrastructure. A fixed-price engagement can be scoped in a 60-minute discovery call.

\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Component	Amount	Notes
Architecture design & security spec	$6,500	VPC design, RBAC schema, compliance framework alignment
Data pipeline development (PHI anonymization + RBAC)	$9,000	Encrypted document ingestion, de-identification layer, role-based access
Claims triage assistant — model fine-tuning + RAG	$10,000	Fine-tune on claims history; RAG against claims SOPs and coverage forms
Underwriting research agent — model + Q&A interface	$8,500	Rate manual RAG, policy portfolio Q&A, agent-facing interface
Immutable audit log system	$4,500	NAIC 668 documentation, GLBA compliance logs, compliance dashboard
NAIC 668 compliance documentation package	$3,500	Decision documentation, appeal mechanism, DFR-ready filing
Testing, QA, security review	$5,000	Penetration testing, GLBA compliance validation, handler review workflow testing
Project management & staff training	$4,000	Claims handler + underwriter training, policy documentation, change management
Net Build Cost	$51,000
Discount (assessment credit + volume)	($9,000)
Final Build Cost	$42,000

\\n\\n

Operations Retainer

\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Item	Monthly	Annual
System monitoring and uptime management	$1,400	$16,800
Security patch management and vulnerability scanning	$700	$8,400
Quarterly model retraining (claims + underwriting)	$800	$9,600
Audit log review and GLBA/NAIC compliance reporting	$500	$6,000
Quarterly governance committee support	$300	$3,600
Direct support line for claims/underwriting team questions	$500	$6,000
Operations Retainer	$4,200	$50,400

\\n\\n \\n\\n

---

\\n\\n \\n

Section 8 — Vendor Comparison

\\n

Three-path analysis: Private AI Build (recommended) vs. IBM watsonx (insurance-focused) vs. Salesforce Einstein for Insurance.

\\n\\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n \\n

Criteria	Private AI Build Recommended	IBM watsonx Insurance	Salesforce Einstein Insurance
Data sovereignty	✓ Full — data never leaves carrier VPC	✗ IBM-hosted cloud; data processing under IBM terms	✗ Salesforce cloud; Einstein training data policy unclear
GLBA Safeguards Rule compliance	✓ Architecture designed for it	⚠ BAA available but requires negotiation	⚠ No specific GLBA BAA for Einstein AI features
NAIC 668 documentation	✓ Audit log + decision documentation built in	⚠ Limited audit trail; carrier responsible for 668 documentation	⚠ Not designed for insurance regulatory compliance
Claims data training (PII/PHI)	✓ PHI anonymization layer; no raw PII in training	✗ Medical data processing requires HIPAA BAA; not currently in place	✗ Not HIPAA-covered; no BAA for medical records
Custom to carrier's own data	✓ Fine-tuned on carrier's claims history and guidelines	⚠ Pre-built insurance models; carrier data for RAG only	⚠ Generic insurance AI; limited carrier-specific customization
Underwriting AI (rate manual Q&A)	✓ Trained on carrier's own rate manuals and guidelines	✓ Some UW optimization capabilities	⚠ Lead scoring and email only; not UW research
Agent network support	✓ Agent AI assistant in Phase 3 scope	✗ Not focused on independent agent workflow	✓ Salesforce-native agent management integration
Year 1 cost (build + ops)	$99,900	~$85K–$120K/year (SaaS licensing + implementation)	~$60K–$90K/year (Einstein licensing + implementation)
Year 2+ ongoing cost	$50,400/yr (retainer only)	~$60K–$80K/yr (SaaS + support)	~$50K–$70K/yr (Einstein licensing)
IP ownership	✓ Carrier owns model weights and deployment	✗ IBM owns the model; carrier licenses it	✗ Salesforce owns Einstein; carrier has no model rights

\\n\\n \\n\\n

---

\\n\\n \\n

Section 9 — Next Steps

\\n\\n \\n\\n \\n\\n