Regulators And Compliance.

Kempron Inc. is a Canadian technology supplier to property and casualty insurers. It is not a regulated financial institution, holds no insurance licence, and does not underwrite, adjust or settle claims. Its exposure to insurance regulation is indirect and arises through its customers: an insurer engaging Kempron does so as a third-party or service-provider arrangement under whichever supervisory framework applies to that insurer. Kempron's design posture is to make that assessment straightforward rather than to argue about scope.

• Minimisation over accumulation. Collect what the process requires, for a defined purpose, for a defined period.
• Locatability. Kempron expects to state precisely where a given category of data sits, who can reach it and how long it will be retained.
• Residency as a contractual term. Commitments about holding personal information in a particular jurisdiction are made in writing in the agreement, not offered as a preference.
• Deletion with a deadline. Return or destruction on exit is an obligation with a date attached, agreed before go-live rather than negotiated afterwards.
• Assessment support. Where a customer must conduct a privacy impact assessment, or a data protection impact assessment, we expect to supply what it needs rather than treat it as the customer's problem.

A claims process is subject to after-the-fact examination by parties who were not present when it ran: an internal auditor, a market conduct examiner, an ombud, opposing counsel, a court. Auditability is the property that makes those examinations possible. A system whose output cannot be accounted for is unfit for this market, regardless of how well it performs.

Four propositions follow. Each is testable without access to implementation detail:

1. Every material step leaves a record. What happened, when, on what input, and under whose authority. A step that leaves no trace cannot be defended later, and the absence will be discovered at the worst possible moment.
2. Records are retained for as long as the claim can be examined. That period is set by limitation periods, regulatory retention requirements and the customer's own policy, not by what is convenient to store.
3. The reasoning is reconstructable, not merely the outcome. Knowing what a process concluded is of little use to an examiner who needs to know on what basis.
4. Decision rights stay with the accountable party. The insurer carries the regulatory accountability for how a claim is handled. Automation that quietly relocates a decision away from the accountable party has created a governance problem and disguised it as an efficiency.

A regulator or compliance officer needs to know what must be true of the system and how it will be evidenced. Neither requires publication of how it is built. The same applies to artificial intelligence.