"Break Some Dishes" — A Sitting Commissioner on Where to Move Fast on AI, and Where to Stop Cold

Paul Tyler (00:01) Hi, this is Paul Tyler, and welcome to another great episode of The L&A Hub. I've got a very special guest today, Mr. Josh Hershman, who has done something like no one I know in insurance regulation has done before. He's been a regulator, a private attorney, the head of an open-source data standards project, an insurance company CEO, and now he's Commissioner for the State of Connecticut. Welcome, Josh. Did I describe your background adequately?

Josh Hershman (00:35) Yeah — no, thank you, Paul. Thanks for having me. It's an interesting journey, but you know, I just have a hard time saying no.

Paul Tyler (00:43) So I'm sure you went to your career counselor in high school and said, "This is where I want to go," and the test said, "Okay, here are the following five steps." What's that path? You say stuff happens, but you make your career happen.

Josh Hershman (00:59) If you'd asked me twenty years ago where I'd be, this is nowhere near the dartboard, let alone on the board itself. I think it's just always thinking about what's interesting and what's next. And I like to listen to smarter people than me and take as much advice as I can get. Like you correctly identified, I started out in private practice doing mostly mergers, acquisitions, transactional work, some business litigation. I got an opportunity to become the deputy insurance commissioner in the state, and I didn't say no to it. It was the coolest experience of my entire life. I really took it as a learning experience — I got to do every single thing you could possibly imagine in insurance, from arguing with major CEOs to managing the transition of the in-office workforce during COVID to working from home. Quite the gamut. On the regulatory and policy side, I drove a lot of the policies at the Connecticut Insurance Department while I was there, and I got to run hearings as a hearing officer. Connecticut's the coolest place in the world to do insurance, and being a regulator in Connecticut is the coolest job. We have huge reinsurers downstate. We have an innovative captive insurance marketplace. We have an insurtech community that's pretty powerful — thanks to you, Paul, and a lot of your initiatives. And we have the legacy carriers, which are hard to beat: for domiciled carriers you have The Hartford, Travelers, United, Cigna. So it's a really cool place to be, and I love it here.

Paul Tyler (03:07) So if somebody wanted to be Josh, it sounds like the rule would be: be curious, put yourself in the right place at the right time. Is there more to it than that? Clearly there is.

Josh Hershman (03:19) Yeah. You just keep going. One of the things I constantly do is show up and do the stuff I need to do. I've been lucky enough to show up enough times that people are interested in seeing what I can do for them. After I left the Connecticut Insurance Department the first time around, I worked with lots of different organizations, and one of them wanted to build a life carrier. No one wakes up and says, "Hey, tomorrow I want to start a life insurance company" — it's quite the process. But this group had a very specific market segment they wanted to offer a product to, and traditional insurance just didn't have the bandwidth, the appetite, or the data to feel comfortable driving it. So we had to build our own carrier. And when you get to be the driving force of building that carrier, they let you be the CEO too. So I was the CEO of that organization.

Paul Tyler (04:27) Hey, I appreciate the support you gave us the first time around when we were building an incubator up in Hartford. It was great — you were always there, showed up, talked to the people, door was open. We sent some crazy startups. Remember some of the cryptocurrency P&C shops in Europe? It sounded crazy then, but some of the stuff you were doing... I look at things like stablecoin starting to play in the economy now. Some of the things we'd have said were just crazy ten years ago suddenly start to make more sense today.

Josh Hershman (05:05) Yeah, it's ever-evolving. The crypto space is very interesting. On the P&C side, thinking about it as an insurance-type product, a lot of what would come our way was about preserving the initial investment — because of the volatility related to some of these crypto products. And that did not feel like an insurance product. It felt closer to a security-type product, and the SEC should have to look into that. I'm sure the SEC said, "No, no, this looks and feels like insurance, go back to insurance." So that's typically what happens. At some point I wouldn't be surprised if there were these types of insurance products around crypto investments. I don't see it anytime soon, and it might not be called insurance, but there'll always be something out there.

Paul Tyler (06:01) No, totally agree. Well, we want to talk about AI, because you and I have had some great conversations in both of your roles on this stuff. So tell me — now that you're at the Insurance Department, how are you bringing AI into the department? How's it changing how regulators actually do business today?

Josh Hershman (06:24) As you know, every insurance department across the country is going to have their own bucket of how they're using AI. When I talk with other states, a lot of them are deploying it in some way or another, or at least having initial conversations. I'll tell you what, Paul — I'm all in. The State of Connecticut has a license with Microsoft and Copilot through the Department of Administrative Services, which happens to be the state agency that drives our cybersecurity and governance. All the possible use cases that make sense for the Insurance Department are things I'm looking into. We're getting a lot of buy-in from staff and trying to figure out the best way to deploy AI in workflows — whether it's on review or letter writing. One super easy example: insurance regulators, especially on the financial side, do financial exams all the time. They have copious amounts of information to go through, and they're really only looking for two or three little things in it. Control-F is a great thing, but running a 10-K through any chatbot — in our case, Copilot — and asking it the five or six questions an insurance regulator would want to ask, then going back to verify it, saves a ton of time. So we're starting to see interesting use cases internally. We have a little group, one from every division the Insurance Department has, coming together on a monthly or quarterly basis, talking about the different use cases, the governance, the oversight, how to deploy it, and how to break some of the silos that may exist. Someone on the financial side might come up with an amazing use case that someone on the rate-and-form filing side hadn't thought of. So we're making sure there's cross-collaboration going on. It's here. I'm trying to deploy it as much as possible. And if you'll indulge me, I'll give you the way I think I'm going to be successful internally.

Josh Hershman (08:43) If you were to line up a hundred people in the workforce, you'd get probably ninety different answers on how they think about the use of AI and how they're deploying it in their job. Some are completely scared it's going to take over their job and they won't be relevant anymore. Some are scared about privacy issues, some about work-product issues — lots of different concerns, and all of them are valid. Being concerned about losing your job would be the scariest thing for me if I thought there were a material issue there. But we look at it as highest and best use. Regulators can be doing so many other things — asking more questions, being more relevant, understanding some of the complexities — rather than just trying to catch up. So the positioning is highest and best use. It's not replacing anyone. Some people are less interested in deploying it, and you might think those people are of an older generation than you and me, Paul. But the way I've found you get really interesting buy-in is when you get the older generation to say, "Wow, this is amazing, I'm going to start using it." And then everyone around them hears it and thinks, "Geez, if he or she is doing that, I must be foolish not to." So I've found that's how I've been successful — spending time with the groups that would otherwise dismiss it, getting them to buy in, and then having that trickle down internally.

Paul Tyler (10:26) Interesting. I'm going to take notes, like a lot of people I've talked to. When we look back on this, we'll say it's so obvious — this is the path it took us. When you're in the middle of change, it's sometimes hard to pop your head up and see the trend. But it feels to me like at the end of the day we'll say AI did the following, and five or ten percent of it was technology; the other ninety percent was change management, people, education — a lot of rethinking. I agree with you: I don't think it will change jobs so much as disrupt jobs. And the data's starting to show that companies actually adopting it are hiring more people. You could read a lot into that, but I think we'll find some interesting data down the road. Maybe we click into a bit of what this change is and how it manifests. I went back — you can go into Google Trends and look at trends over time — and I compared "AI innovation" searches versus "AI governance." I'm telling you, AI governance is off the charts over the last year. So I think, okay, am I going to do something really interesting or novel with this, or am I going to be thinking about all these privacy issues? Yes, legitimate concerns — privacy, controls, accuracy, all legitimate. But where are we in the balance today? To me it feels like governance is way outweighing innovation, but I'm also looking at this from a very different lens.

Josh Hershman (12:17) I'm happy to hear that governance is leading the search — that's an interesting fact I hadn't heard before. I love that. Even internally, most of the questions I get from staff are, "Let's talk about the cybersecurity aspect, let's talk about the governance, let's talk about the privacy." And it's stuff we have answers to and work through. But it's a good thing that's where people's heads go. In terms of your specific question — innovation versus governance — are we going to run a thousand miles in ten minutes, break a lot of dishes, sweep them up, and try again? Or are we going to walk across the country in twenty years? What's the pace there? I think there are segments to think about this in. The Europeans did an interesting thing where they broke it down by how much the AI solution impacts the consumer. Is it something that's going to impact their life? Is it something that's going to materially impact their finances? Or does it have no real impact — a model that's just using information — or minimal impact? They have different standards around each of those use cases. Something similar can be thought of here. The internal use cases an insurance company or any organization would deploy — to improve their billing systems, their internal communications, letter writing for consumers, things that aren't necessarily customer-facing and involve no decision-making — those things, I feel like people should be empowered to break dishes and move quickly. I'd hope organizations aren't hesitating on those. It's the areas where you're approving or denying a claim based on AI — well, maybe you do need to. I'm an advocate that you should figure that out. I don't think you should stop. There are ways to make sure you're compliant, and you should figure out the best way to deploy it. But those are the areas where moving slow and being cautious is important. Still, at some point you've got to go. These organizations have been thinking for a very long time about the best way to strategize deployment in underwriting, claims, or some other area where it impacts consumers materially. You can spin your wheels as long as you'd like. If you're not going to try it —

Josh Hershman (15:10) Yes, there may be some regulatory repercussions, or the plaintiff's bar might come after you. But at the end of the day, for the success of availability and affordability in the insurance industry, these solutions need to be deployed in the very short term.

Paul Tyler (15:29) Interesting. What I find is — I've never gone into any room on a topic like this and found such uneven distribution of knowledge about how this stuff works. You'd think, okay, if I walk into an insurance company that sells annuities, I could have a legitimate discussion around guaranteed lifetime income benefits. And Josh, shockingly — I won't name names — consistently, everybody knows their little piece, but they have a very hard time even describing how the product works. Now fast-forward to technology that's changing rapidly. This is another layer on top of another layer of complexity. Take underwriting — it's complicated enough for people to understand the underwriting process. Then you've got to say, "Wait a second, what's the decision versus the workflow?" There's this knowledge gap that has to be closed. But you can't make somebody want to learn something. Your approach — how do you get people curious enough to learn about this? What strategy are you using? Everybody would think regulators are the last ones to try this stuff.

Josh Hershman (16:55) I don't really have a magic strategy. You highlighted something interesting — everyone kind of knows their little piece, and I think that's true. What I'm trying to do at the Insurance Department in Connecticut, at least, is have all the little pieces shared with everyone at all times. So we're communicating. I don't know what the success is going to be. There are only so many use cases we can deploy it in, and we're figuring that out. Once we figure out all the use cases, hopefully we'll be able to show the value and deploy them meaningfully. The thing that just jumped into my mind — I'm going to take us off topic for a second — is that when you brought up annuities, what drives me insane is how complex the illustrations are. And quite frankly, how poor the illustrations are across the board. I have a hard time understanding, when I'm looking at these illustrations, how much am I supposed to get, when, and what does this actually mean? If there was never a use case more tailor-made for a complex situation, it's deploying AI to make those illustrations more consumer-friendly. There's no reason we can't be gamifying the illustrations in the annuity space. It should be something where I'm playing an interesting game that gets my mind to understand exactly what this annuity is doing. It's nothing complex or new, and it can be done now entirely with artificial intelligence. That's one area of such low-hanging fruit for the industry. And I know the illustrations are so driven by statute, so everyone's going to be concerned: does it meet the minimum requirements? But come to Connecticut with an interesting idea there — we'll get you up and running real quick.

Paul Tyler (18:45) Well, you just hit a topic real close to me, because Zinnia now owns WinFlex, which — I don't have exact numbers, but I bet we have probably seventy percent of the life insurance illustrations run by independent distribution running on WinFlex. So we have maybe forty or fifty carriers, probably six hundred products on this thing. Now, you say how complicated it is to read those things — you should see what it's like to run the illustrations. A project I've been working on here: how do we actually... let me explain how complicated it is. WinFlex is a very rich illustration system. We probably support eighty to ninety different sales concepts in it. You can imagine what that UI looks like. When I started getting the business, agents were still running the illustrations themselves. Now they're falling into the sales desk, asking for these illustrations to be run. And you'd find this interesting — we've got a browser plugin we're playing with, using agentic browsing to make it easier to drive this thing, so it's easier to even generate this stuff.

Josh Hershman (19:47) Yeah.

Paul Tyler (20:07) And that's not even the problem before the problem. Now I get these back — how do I prepare for them and show them? There are fascinating problems here. But think about it: we talk about accessibility of insurance, affordability. If it takes an hour to run all these illustrations and get them back to a client, how many are you going to do?

Josh Hershman (20:17) Right.

Paul Tyler (20:35) If we can make it a little easier, quicker, faster, better, maybe it's easier to serve some people who wouldn't have had insurance. So I think there are some good benefits coming out of this that would broadly serve the industry. But man, it's hard to get there.

Josh Hershman (20:49) Yeah. And another low-hanging-fruit byproduct of this: the biggest complaint people have about individuals who sell annuities is "that wasn't suitable" or "you shouldn't have sold them that product." I feel like it's a tool. Having the illustration be something so digestible is such a powerful tool for the person selling the product, for the consumer, and for any party in between — whether the consumer ends up wanting to sue the salesperson for some reason, or a regulator is interested. The salesperson can say, "Look, I spent a lot of time. They have this very easy way to understand what's going on here. I don't know what more you'd want from me as someone selling the product." Because right now it's so confusing, and that's part of the reason people get mad. Ten years from now — you sell the product, ten years go by, and everyone's upset because they got something they didn't think they got. Maybe it would have cost them a little more to get what they thought they were getting, or maybe they wouldn't have gotten the product at all and you'd have sold them something else. So I think it's a natural progression. And I'd hate for the regulators to be the ones who have to figure this out. It'd be amazing if industry could come to the table and say, "Look, we've deployed AI here to make this so easy and friendly. What do you think?"

Paul Tyler (22:11) The next topic, I think, is who and how should this system structure be developed. We're working closely with IRI, with ACORD; now NAFA is interested in coming up with data-sharing standards. And Josh, it takes a long time. It's funny — you say it takes so long if it's a big organization, so let's do it ourselves... well, the carriers take a long time too to come up with standards. There's not really an easy way. But suitability is really interesting, right? Because now, especially with AI, we could come up with a set of rules — say you have a suitability base model 101. Maybe a carrier wants to appropriately say, "I'm okay dialing the risk a little this way versus a little that way." You could argue about who should be doing that. There could be a ground truth for bottom-line suitability. Josh, if you buy an annuity, you should not have to eat cat food for the next ten years because I took every single dime out of you. There are some baselines. Who should be doing that? Is that the states? Is that the NAIC? Is it the carriers getting together? Where should this governance take place?

Josh Hershman (23:39) Well, you hit on something. Insurance is a wonky place when it comes to who's doing what and how. Inherently, insurance is state-based, so the questions around these annuities are left to the individual states. McCarran-Ferguson — a law that, nowadays you have these bills that are thousands and thousands of pages, but this was like two lines — basically says all insurance business is left to the state unless Congress has otherwise enacted. And Congress has made actions: they took over TRIA for terrorism insurance, they do NFIP for flood insurance, they do CMS on Medicare and Medicaid, and they've taken a lot of the health components under ERISA. So there are many different structural organizations in the mix impacting the way insurance regulation is promulgated. But in terms of data standards and coming up with suitability baselines, those are dialogues that could and should take place at the National Association of Insurance Commissioners. It doesn't mean any state is going to agree. It doesn't mean that if you get ten states, the rest are going to come along. But it's the best forum to have some of these more complex, larger conversations. Unfortunately, the NAIC moves slowly. One of the acronyms for it is "no action immediately contemplated."

Paul Tyler (25:22) [laughs]

Josh Hershman (25:22) So it's tough. But you can imagine — you have fifty-six different jurisdictions, all with different personalities and different political leanings, and they have to come to the table and agree to anything. The NAIC itself is not a statutory organization making laws. They'll create a model act that a state then needs to deploy. A perfect example is the Cyber Act that Connecticut adopted in 2019. The journey of that was: "Boy, there need to be some cyber requirements in the insurance industry." New York, being New York — one of the most sophisticated regulators in the country — came up with a law around 2017. The NAIC took that and spent two years trying to turn it into something that could be a model act. Then each state spent the next two or three years getting that model act through their legislatures. That's the journey of how some of this gets done. Or, the alternative: the NAIC could come up with something like the AI model bulletin, created in the 2023–2024 timeframe. A committee spent a couple of years thinking about how to start the regulation of artificial intelligence at the NAIC, and after years of stakeholder conversations, they created a model bulletin — and each state decides on its own whether to deploy it. Right now there are some twenty-five or twenty-six states that have deployed the model bulletin. So it's a weird, interesting journey to get stuff done. If you want to move quick, you go to one state and try to convince them it's something interesting. If you want to have a national conversation, you go to the NAIC.

Paul Tyler (27:18) Interesting — fast versus slow. Arguably, Josh, sometimes friction is a good thing. You want friction in the right spot. Maybe double-click in there a little. From your vantage point, what part of AI should be regulated fast, and what part is probably worth sitting back on a little and saying, "Let's see how the technology evolves"?

Josh Hershman (27:48) I have mixed feelings on the regulation of artificial intelligence. Artificial intelligence is industry-agnostic. It doesn't care whether it's serving a lawyer, a bookkeeper, the coffee shop, a financial regulator, an insurance company, the banks — it doesn't care. It's a system, a solution, a model. So I always thought this is a much bigger thing than just insurance, and really bigger than just the state of Connecticut or just the state of New York. It's a federal problem. The regulation of artificial intelligence, to me, feels like something that at some point — I don't know when, I don't know how — we're going to have standards across all industries, and they're going to be similar to some extent. We'll have all the different thresholds; it'll look a little different, but they'll have similar core principles. Where we are right now, I think it's up to the states a lot. You see some states — California moved kind of quickly, New York is a little more advanced on what they've issued for insurance, Colorado has a statute — and then, just on the insurance side, you have all these states that have deployed the AI model bulletin. I look at the regulation of artificial intelligence as collaborative, ever-evolving, and growing. We are constantly learning at the Connecticut Insurance Department. We're not going to know the best way to regulate different types of use cases until we sometimes see the impact of those use cases. So I don't think moving away from the principles-based approach we've taken is anything that's going to happen in the short term. But what I do think will happen in the short term is — the AI model bulletin has a word hanging out there: "testing." It just says testing. And I think it's left a lot of carriers and a lot of the industry confused as to what that means, what it looks like, what the expectations are.

Josh Hershman (30:09) While maintaining a principles-based approach, you need to be able to articulate what you mean by testing, to allow carriers to feel emboldened to deploy AI across all their systems. Some carriers are going to the back rooms and saying, "We'd love to try this, but we're really unsure what the regulator is looking for in this space." And you get government relations and lawyers involved who say, "You know what, then let's just hold." Other carriers are much more willing to roll the dice and go with it. I'm not going to comment on either direction carriers take, but if regulators can specifically articulate what they want around the testing component, it should give carriers the comfort to keep driving. One of the things I'm thinking about: in Connecticut there are something like three or four statutes that are sort of binary in their decision. On claims handling — were you unfair or fair when you handled the claim? In underwriting — did you illegally discriminate? Discrimination, of course, is across the insurance industry; you don't have insurance without discriminating one group from another, but you can't illegally discriminate. Are you treating like-situated people the same from a rating perspective? You have three or four of these binary statutes — in marketing, too. And it's figuring out the statistical methods that can help unravel the models being deployed, to determine whether there are breaches in any existing Connecticut state law. When you deploy some of these statistical methods, seeing something that looks like an anomaly, facially, does not necessarily mean an anomaly exists. It doesn't necessarily mean a law is broken. It very well might just mean we need more context. We're going to ask, "What was the business justification for this? Why are you doing the things you're doing?" — getting more color. When you deploy a testing regime, it's not going to be "you're doing it right or wrong." It's going to be part of the bigger picture for regulators to fully understand what's going on.

Paul Tyler (32:23) My experience has been — I look at a lot of the concerns about AI, and I almost wish people would say, "Okay, do we already have laws, rules, or internal controls that address this stuff?" For instance, I can't go out and misrepresent a product. We've got trade regulations, insurance regulations, a whole set of laws. If AI does something, you probably don't need a new law for it — you probably have one that needs different, better, quicker enforcement. I agree about claims: you can suddenly make some awfully terrible decisions for people at enormous scale if something goes wrong. I think IP is interesting — who actually owns the IP? These models, if they built them on stuff we put on the web, or materials you and I wrote — wait a second, who owns it? And then when somebody distills a model into something smaller, how can you get sued? Let me give you a real example from a couple of weeks ago about who's controlling this stuff. I got a security finding from our security team saying, "Here's a problem, Paul, with some stuff you've developed and deployed out on the web." I'm like, well, that's fine, but the technology on an unnamed large cloud provider doesn't let me do anything with it. I even go to the cloud provider and ask them for help. They can't give it to me — they actually give it to me, but it's wrong. So wait a second: you tell me to fix it, but nobody internally or externally can tell me how. Now Fable comes online. Okay, Fable, go solve this. And it did.

Josh Hershman (34:00) It's amazing.

Paul Tyler (34:18) Josh, it solved it. I put it all the way through, and then halfway through I go, "Hey, check your result." And it says, "By the way, because you've asked me security-related questions, I'm going to give you a dumber model." Like — what? What is Anthropic doing? Then, as everybody knows, the next day the government tells Amazon, or tells Anthropic, to shut it down. Wait a second — government came in and shut it down. Then a couple of weeks later I go back to use this thing, and guess what? Our IT bill has gone way up for tokens, and our IT department's just turned off this spigot. I can't get it. So wait a second — is it government? Is it...? We've got a lot of gates on this stuff. I don't know. This is kind of interesting — don't expect an answer for it — but who should...

Josh Hershman (35:03) Yeah, that's crazy.

Paul Tyler (35:17) Who's entitled to intelligence here, Josh? This is kind of a fairness question too. If I go to Connecticut, do I get smarter stuff than if I go to New York? I don't know.

Josh Hershman (35:33) It's a really interesting problem. Right now all these different chatbots are losing a lot of money on these queries, and when they start to really price it to what the cost actually is, it will create this divide. And I have no idea how to solve it.

Paul Tyler (35:54) I know. Well, we're close on time. Last question: what advice or suggestions would you give to carriers? What should they be thinking about — where should they be putting their energy, from your perspective?

Josh Hershman (36:11) I think it's really around cleaning up your data, getting all your standards in a good spot, getting in a position to be deploying artificial intelligence in a meaningful way. Look at banking — I saw an article just yesterday or the day before: JPMorgan, I think, did something where the majority of their financial advisors are now AI. And they're winning; they're doing well. Look at a financial advisor and think about an underwriter. At some point we're going to see underwriters driven by artificial intelligence, rightfully so. So I think they should be moving in that direction — and I think they all are. The goal is availability and affordability for consumers while protecting them at the highest possible level. And I think artificial intelligence is going to help us get there.

Paul Tyler (37:01) Excellent. All right, Josh, thanks so much for your time. What's the best way for people to stay in touch with what you're doing and what the Connecticut Insurance Department is doing?

Josh Hershman (37:14) The Connecticut Insurance Department has a great website — check it out. We also have all the possible social medias that exist, so just follow us and reach out if anyone has any questions. I'm always available to chat.

Paul Tyler (37:27) Excellent. Hey, I want to thank our listeners. Be sure to leave us a comment and like us — likes on the podcast platforms help us a lot. And most importantly, be sure to join us again next week for another great episode of The L&A Hub. Thanks, Josh.

Josh Hershman (37:45) All right. Sounds good, Paul.