Dropping the sensitive attribute from a rating model does not remove it — correlated features carry it back in. What proxy discrimination actually is, how to test for it, and the trade-offs no metric resolves.
The most common fairness control in insurance modelling is also the weakest: delete the sensitive attribute and declare the model blind. It does not work, and every ML engineer who has looked at feature correlations knows why. Occupation, postcode, vehicle choice, channel, time of purchase — a rich feature set reconstructs much of what you deleted, and a flexible model will use the reconstruction wherever it helps the objective. This is proxy discrimination: the model discriminates by a protected characteristic it was never shown, through features that stand in for it.
This matters now because supervisors have stopped treating it as a philosophy seminar. The EU AI Act lists AI for risk assessment and pricing of natural persons in life and health insurance among its high-risk systems, pulling such models into mandatory risk-management and documentation duties. In the US, the NAIC's model AI bulletin — adopted in December 2023 and rolled out across a growing list of states — makes insurers accountable for discriminatory outcomes of AI-supported decisions, not merely for discriminatory inputs. The question regulators are converging on is not did you use the attribute but can you show what your model does to the groups the attribute defines.
Why insurance makes this uniquely hard
In most domains, fairness debates start from the premise that the protected characteristic should not affect the outcome. Insurance complicates that premise, because the entire product is differentiation by risk, and risk is not uniformly distributed across any demographic slice you can name. Actuarial fairness — each insured pays in proportion to the risk they bring — is itself a fairness concept with a long pedigree, and it routinely collides with group fairness concepts that ask for similar outcomes across groups.
Both positions are coherent. A price that tracks true expected loss can still systematically burden a protected group; a price flattened across groups makes lower-risk insureds subsidise higher-risk ones, which has its own fairness critics and its own adverse-selection consequences. No modelling technique dissolves this tension. What engineering can do is make the trade-off visible, measured and consciously chosen — instead of an accident of whatever the gradient descent found.
What a real proxy test looks like
Testing for proxy discrimination requires the uncomfortable step teams resist: obtaining or inferring the sensitive attribute for analysis, precisely so you can measure what the model does to it. You cannot audit blindness by remaining blind. Where direct collection is impossible, inference methods exist with known error bars; where even that is barred, geographic and cohort analysis is the fallback. Whatever the route, the analysis itself must be governed carefully — attribute data used for auditing must be firewalled from training.
The test battery worth running on a rating or eligibility model.
- Predictive parity by group: are predictions equally well calibrated for each group, or does the model systematically over-predict risk for one? Miscalibration against a group is the cleanest red flag, because it fails even the actuarial-fairness standard — those customers are being charged for risk they do not bring.
- Outcome gaps at equal risk: compare prices or decisions across groups after conditioning on the best available measure of true risk. Residual gaps are the proxy effect, quantified.
- Feature attribution sweeps: measure how much each feature's contribution correlates with the sensitive attribute. This does not prove intent; it tells you where the reconstruction lives, and which features deserve a business justification on file.
- Flip tests on inferred proxies: perturb the proxy features for matched profiles and observe price movement. Large swings from features with weak causal stories and strong demographic correlation are the cases to escalate.
The trade-offs no metric resolves
Run the battery and you meet the hard part: the metrics disagree with each other, provably so in general. Equalising calibration across groups and equalising error rates across groups are mathematically incompatible except in degenerate cases. Suppressing a proxy feature costs predictive accuracy, which reprices someone; often the someone is not who you intended. Constraining a model toward group parity can improve one group's average while worsening outcomes for its lowest-risk members.
So the deliverable of fairness work is not a passed test. It is a documented position: which definitions the company holds itself to for this product, which gaps it measured, which it accepted and why, and who signed. That document is uncomfortable to write, which is exactly the sign it contains real decisions. It is also, increasingly, what a supervisor will ask to see — the NAIC bulletin's governance expectations and the AI Act's documentation duties both point at written, reviewable reasoning rather than good intentions.
What we would actually do
- Rank features by both predictive value and proxy load before training, and require a causal or business rationale for anything high on the second axis. Cheap features with strong demographic correlation and weak risk stories are rarely worth their litigation surface.
- Prefer directly risk-causal features wherever they exist — driving behaviour over demographic bundle, building attributes over neighbourhood composite. The good news for embedded distribution: transaction context supplies many of these directly.
- Retest at every retrain, not annually. Proxy structure shifts as portfolios and features shift; a model fair at launch drifts like everything else drifts.
- Put a human decision, not a threshold, at the end. Metrics inform; a named committee accepts or rejects the trade-off on the record.
Fairness in insurance models is not a solvable problem in the way a latency budget is solvable. It is a managed tension between legitimate definitions that cannot all be satisfied at once. The teams in a defensible position are not the ones claiming their models are bias-free — no serious team claims that — but the ones who can show precisely which fairness properties they measured, which they chose, and what it cost. In a regulatory environment moving from inputs to outcomes, that written trail is the difference between a debate and a finding.