Every model has an owner. Every change is proved.
Pricing, reserving, claims and fraud models are registered with a named owner. A new version runs as a challenger beside the champion, its evidence is produced on the day, and it goes live only through a promotion gate that a person other than its author approves. The validation dossier is compiled from the records, not written from memory.
Every model, with a person who answers for it.
HONESTAS reads your model registry, whether that is MLflow, SageMaker or your own, and keeps one register across all of them. A model with no owner cannot be used in a decision.
- Owner, purpose, data and where each model may be used
- Every version kept, with what it was trained and tested on
- Drift watched on live cases, with the owner told when it moves
- Every sealed decision names the model version it used
| Model | Role | Drift |
|---|---|---|
| Private motor GLM v6 | Champion | Steady |
| Private motor GLM v7 | Challenger | Steady |
| Claims urgency 2026.07 | Champion | Drifting |
| Photo damage check | Champion | Steady |
| Coastal storm pricing | Champion | Steady |
| Fraud ring signals | Champion | Steady |
More storm claims since 9 Oct. Sara is asked to look by Friday.
- Owner
- A named person
- Validated
- On the day, every run
- Use
- Only where approved
Evidence produced on the day. Not rebuilt at year end.
A new version earns its place by running beside the one it would replace, on real cases, with nothing sent. Each run is seeded, so it can be replayed exactly.
Register
The new version is registered with its owner, its training data and what it is for. A model that cannot be registered cannot be used.
Shadow
It runs as the challenger beside the champion, on the same cases. Its answers are recorded and never sent to a customer.
Compare
Every difference is kept: which cases, which cells, how much. Checks run on each, and each run can be replayed with the same seed.
Promote
Through the gate, or not at all. The record keeps both versions, so any decision can be traced to the one it used.
Tried first. Approved by someone else.
Before a change goes live it must pass the checks your firm set, on practice records first. Then a person who did not build it approves it with a passkey. Duties are kept apart: the author, the validator and the approver are three different people.
- Checks on practice records before anything real
- An author cannot approve their own change
- A failed check stops the change, with its reason recorded
- The same gate for AI buttons, rate tables and wordings
| Check, on practice records | Result |
|---|---|
| Every price inside the filed bands | Pass |
| No cell moves more than 15% | Pass |
| Same price for the same risk, twice | Pass |
| No protected trait used, directly or by proxy | Pass |
| Replay matches its seed | Pass |
| Nothing sent to a customer | Pass |
| Duty | Person | State |
|---|---|---|
| Author | Marta Kowalczyk | Built it |
| Validator | Hana Suzuki | Validated |
| Approver | Nathan Farrell | Passkey |
Three different people. Marta cannot approve her own change, and a failed check would stop it here, with its reason.
Compiled from the records. Signed by a person.
Each year the validation dossier is usually rebuilt from spreadsheets and people's memory. In HONESTAS it is compiled from the sealed runs: data checks, champion and challenger, sensitivity and back-tests. The parts that need judgement are left for the validator to write and sign.
- Every figure links to the run it came from
- The validator's opinion is never written by AI
- Exported for your auditor or supervisor as one file
| Section | Compiled from | State |
|---|---|---|
| Data used and its quality | 14 sealed data checks | Compiled |
| Champion and challenger | 3 shadow runs, 135,000 cars each | Compiled |
| Sensitivity to assumptions | 6 seeded runs | Compiled |
| Back-test against experience | 8 quarters of claims | Compiled |
| The validator's opinion | Hana Suzuki | To write and sign |
| Approval to go live | Nathan Farrell | Waiting |
Every figure links to the sealed run it came from. The opinion and the approval are never compiled.
What changed, and what it touched.
Models, rate tables and wordings share one version store. You can see every saved version, where each is in force and which sealed decisions rely on it.
Validation the rules already ask for.
- Solvency II Article 124Directive 2009/138/EC, validation standardsA regular validation cycle for internal models: performance, test against experience, and sensitivity to key assumptions.
- AI Act Annex III, 5(c)Regulation (EU) 2024/1689Risk assessment and pricing for life and health insurance is high-risk AI, with rules applying from 2 December 2027.
- AI Act Article 15Regulation (EU) 2024/1689, accuracyHigh-risk AI must reach an appropriate level of accuracy, declared and kept up over its lifetime.
- EIOPA Opinion on AIAI governance and risk management, 6 August 2025Data governance, documentation and ongoing monitoring of AI systems used by insurers.
AI Act dates as amended by Regulation (EU) 2026/1744, the Digital Omnibus, published in the Official Journal on 24 July 2026. Not legal advice. Certification and legal opinions stay between you and your advisers.
What people ask.
Do we have to move our models into HONESTAS?
No. Your models stay where they are, in MLflow, SageMaker or your own registry. HONESTAS reads them, keeps the register and records every run and version.
Which models does this cover?
Any model whose output reaches a decision: pricing, reserving, claims triage, photo damage checks, fraud signals, and the AI models behind each assisted button.
Who can approve a new version?
A person your firm names, who is neither the author nor the validator. HONESTAS checks that before the approval can be signed.
What happens when a model drifts?
The owner is told, with the cases that show it. Nothing is switched off by a model on its own. The owner decides, and that decision is recorded too.
Does the dossier replace our validator?
No. It gathers the evidence the validator needs, from sealed runs. The validator's opinion and the approval to go live are written and signed by people.
Go deeper
Bring the model that has waited longest.
Pick a model stuck between validation and approval. We will register it, run it beside its champion and compile the dossier from the runs.