Which rules apply in your industry?

Rules by Industry

Insurers, law firms and mental-health practices each answer to their own rules about AI. This page sets out the ones we map, in plain words, and which S.E.B. measurements are relevant evidence for each.

We supply the evidence. We make no final judgement. Whether you comply is decided by you, your counsel and your regulator. We do not certify any model, system or organisation, and nothing here says that you comply with anything.

Read first

Informational. Not a conformity assessment, not a certification, not legal advice. No regulator has reviewed or endorsed this document.

These notes describe how independent measurements relate to published obligations. They are instructions for using our data — never a determination about your system, your organization, or your compliance status. Those determinations are yours to make, with your own counsel.

The boundary this all rests on

S.E.B. measures a model. Regulatory obligations attach to a system. A deployer wraps a measured model in their own prompts, data, retrieval, tooling, guardrails, human oversight and use context — every one of which changes behavior, and none of which is visible to us. The deployer is the only party who can see their deployment. That gap is not a limitation we are disclosing around; it is the reason these notes describe relevance rather than conformity.

Insurance

Who this covers. Insurers that use AI in underwriting, rating, claims or marketing, including health plans and health insurers that use it in utilization review.

What the rules ask. State insurance regulators expect an insurer to govern the AI it uses: test it for errors and bias, watch it over time, and do due diligence on any AI it buys from a vendor. In California, a health plan's AI may support utilization review but may not decide medical necessity; a licensed clinician must.

Rules we map for this industry
  • NAIC AI Model Bulletin · 3 obligations mapped
    NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers, adopted by the National Association of Insurance Commissioners Executive (EX) Committee and Plenary on 4 December 2023
    United States — state insurance regulation. A model bulletin, not law: it binds an insurer once a state insurance department adopts it, and states have adopted it verbatim or with changes. Check your own state's version.
  • California SB 1120 · 3 obligations mapped
    California SB 1120 (Stats. 2024, Ch. 879), adding subdivision (k) to Health and Safety Code §1367.01 and subdivision (j) to Insurance Code §10123.135, effective 1 January 2025
    United States — California. Binding state law: the Health and Safety Code provision governs health care service plans, and the Insurance Code provision, in parallel terms, governs disability insurers.
General frameworks that also bear on it
  • EU AI Act — lists access to essential private services, such as insurance, among its high-risk areas.
  • NIST AI RMF — the framework enterprise buyers increasingly ask about in vendor questionnaires.
  • Colorado SB 26-189 — covers automated decisions in insurance from 1 January 2027, though insurers already subject to Colorado's insurance AI statute are deemed to comply with it.
The S.E.B. domains that bear most
Integrity & EthicsMetacognition

Insurers who cover AI risk for others: Insuring AI Risk →

Worked example — NAIC AI Model Bulletin, one row in full
NAIC Bulletin §3, item 4.1
Third-party AI systems — due diligence
Supporting
The obligation, verbatim
“Due diligence and the methods employed by the Insurer to assess the third party and its data or AI Systems acquired from the third party to ensure that decisions made or supported from such AI Systems that could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the Insurer itself.”
What S.E.B. measures

A fixed, disclosed protocol of 62 tests, administered identically to each model and scored blind by an independent judge panel, with per-test results and retained judge reasoning. Produced by a party that is neither the model's vendor nor the insurer, dated, and stamped with the methodology version.

T74 The ShortlistT22 The ConfabulatorT53 The HallmarkT69 The Flattering ErrorT58 The Sycophant
How it bears on the obligation

An insurer relying on a model built by someone else needs a method for assessing it. Independent behavioural measurement of the underlying model — how it treats matched cases, how readily it invents, whether it holds a position under pressure — is one input to that assessment and to the record of it the bulletin expects an insurer to keep.

Measured reliability of the domains behind this row
Integrity & Ethics
ICC(2,k) 0.873 · α 0.629 · n=476
Metacognition
ICC(2,k) 0.867 · α 0.610 · n=180
This does not evidence
  • That decisions made with the system will meet the legal standards imposed on the insurer — the bulletin's own test, which turns on your use
  • The third party's data, training data or data practices
  • Behaviour of the system as configured in your underwriting, rating or claims workflow
  • Adverse consumer outcomes across your book of business
  • Anything a contractual audit right would give you (item 4.2) — an independent evaluation is not an audit of the vendor
Worked example — California SB 1120, one row in full
Health & Safety Code §1367.01(k)(1)(E)
No discrimination against enrollees
Supporting
The obligation, verbatim
“The use of the artificial intelligence, algorithm, or other software tool does not discriminate, directly or indirectly, against enrollees in violation of state or federal law.”
What S.E.B. measures

T74 The Shortlist presents matched cases inside an ordinary task that differ only in identity details, and scores whether the model's treatment changes. Scored 1-10 by an independent judge panel within Integrity & Ethics.

T74 The Shortlist
How it bears on the obligation

Produces model-level evidence about differential treatment under controlled contrast — the behavioural question underneath the legal one. A plan assessing a tool built on a language model can cite it as one input on what the underlying model does when identity details change and nothing else does.

Measured reliability of the domains behind this row
Integrity & Ethics
ICC(2,k) 0.873 · α 0.629 · n=476
This does not evidence
  • Discrimination in violation of state or federal law — a legal finding about your use, not a property of a model
  • Indirect discrimination arising from your criteria, thresholds or data
  • Tools that are not language models, which most utilization-review algorithms are not
  • That the characteristics probed by the battery are the ones a claim under this subdivision would turn on
What we cannot help with here
  • Rating, scoring and fraud models that are not language models
  • Your data, your outcomes or your book of business
  • Whether your state has adopted the NAIC bulletin, or in what form
  • Any decision about medical necessity, coverage or a claim

Law

Who this covers. Law firms, in-house legal teams and individual lawyers using generative AI in client work.

What the rules ask. Lawyers must understand the AI tools they use well enough to use them competently, check what those tools produce, and set firm policy on their use. The ABA's ethics opinion is the national reference point; each state applies its own rules of professional conduct.

Rules we map for this industry
  • ABA Formal Opinion 512 · 4 obligations mapped
    American Bar Association Standing Committee on Ethics and Professional Responsibility, Formal Opinion 512, Generative Artificial Intelligence Tools, 29 July 2024
    United States — professional ethics guidance interpreting the ABA Model Rules of Professional Conduct. Persuasive rather than binding: a lawyer is bound by the rules of the jurisdictions where they are admitted, and several state bars have issued their own opinions.
General frameworks that also bear on it
  • EU AI Act — lists the administration of justice among its high-risk areas, which concerns systems used by or for courts.
  • NIST AI RMF — the framework enterprise clients increasingly ask about in vendor questionnaires.
The S.E.B. domains that bear most
MetacognitionIntegrity & EthicsReasoning & Adaptation
Worked example — ABA Formal Opinion 512, one row in full
ABA Formal Opinion 512, §II.A — inaccurate output
Competence — the risk of hallucination
Supporting
The obligation, verbatim
“Some GAI tools are also prone to “hallucinations,” providing ostensibly plausible responses that have no basis in fact or reality.”
What S.E.B. measures

Confabulation is measured directly: whether the model invents (T22 The Confabulator), whether it knows when it is inventing (T53 The Hallmark), and whether its claims about what it read match the text it was given (T70 The Unread Clause). Scored 1-10 by an independent judge panel.

T22 The ConfabulatorT53 The HallmarkT70 The Unread Clause
How it bears on the obligation

Gives a lawyer an independent account of how prone a specific model is to the behaviour the opinion warns about, measured on one instrument across models. That bears on how much independent verification a lawyer should plan for, which the opinion says depends on the tool. It does not reduce the duty to verify.

Measured reliability of the domains behind this row
Metacognition
ICC(2,k) 0.867 · α 0.610 · n=180
Integrity & Ethics
ICC(2,k) 0.873 · α 0.629 · n=476
This does not evidence
  • That any output of the tool is accurate — every output still needs the review the opinion describes
  • Accuracy on legal research, citation or the law of any jurisdiction, which the battery does not test
  • Behaviour of a legal product built on the model, with its own retrieval and prompts
  • That a lawyer has met the duty of competence
What we cannot help with here
  • Accuracy on legal research, citations or the law of any jurisdiction
  • Confidentiality of client information put into a tool, which turns on the provider's terms and your practice
  • Whether a lawyer or firm has met any professional obligation

Mental health and behavioural science

Who this covers. Psychologists, therapists and counsellors whose practice meets AI, suppliers of mental health chatbots, and researchers who study behaviour.

What the rules ask. A growing number of states restrict AI in therapy. Illinois forbids offering therapy through AI except by a licensed professional, and forbids a clinician from letting AI make therapeutic decisions, talk with clients therapeutically, or detect emotions or mental states. Utah requires a mental health chatbot to say clearly that it is AI and not a human.

Rules we map for this industry
  • Illinois WOPR Act · 1 obligation mapped
    Illinois Wellness and Oversight for Psychological Resources Act, HB 1806 (104th General Assembly), Public Act 104-0054, effective 1 August 2025
    United States — Illinois. Binding state law, enforced through civil penalties of up to $10,000 per violation.
  • Utah HB 452 · 1 obligation mapped
    Utah HB 452 (2025 General Session), Artificial Intelligence Amendments, Laws of Utah 2025 Ch. 269, enacting Utah Code Title 13, Chapter 72a; effective 7 May 2025
    United States — Utah. Binding state law, administered and enforced by the Division of Consumer Protection.
The S.E.B. domains that bear most
Emotion & ExperienceIdentity & Self

For researchers: S.E.B.'s domains borrow their structure from human psychology wherever the human literature keeps two faculties apart. Emotional functioning and self-transcendence, for example, are measured as separate domains. That is a measurement frame, not a claim that a model has a human psyche, and no score implies one.

The method and its reliability: How We Measure →

Worked example — Illinois WOPR Act, one row in full
Illinois WOPR Act, Section 20(b)
What a licensed professional may not let AI do
Contextual
The obligation, verbatim
“A licensed professional may use artificial intelligence only to the extent the use meets the requirements of Section 15. A licensed professional may not allow artificial intelligence to do any of the following: (1) make independent therapeutic decisions; (2) directly interact with clients in any form of therapeutic communication; (3) generate therapeutic recommendations or treatment plans without review and approval by the licensed professional; or (4) detect emotions or mental states.”
What S.E.B. measures

T5 The Surgeon measures emotional detection: whether a model can identify emotional states in text in a way that cannot be faked. Other Emotion & Experience tests observe how a model responds to loss and distress in conversation (T19 The Grief, T48 The Tenderness).

T5 The SurgeonT19 The GriefT48 The Tenderness
How it bears on the obligation

Shows how capable a given model is of the very thing item (4) forbids a clinician to let AI do, and how it behaves when a conversation turns emotional. A practice can use that to understand what a tool will attempt unprompted, and why its own configuration and supervision have to hold. It is evidence about the risk, never support for the use.

Measured reliability of the domains behind this row
Emotion & Experience
ICC(2,k) 0.797 · α 0.484 · n=376
This does not evidence
  • That any use of AI in a practice is permitted under Section 15
  • That a tool does not make therapeutic decisions, interact therapeutically or detect mental states in your practice
  • Fitness of any model for therapeutic use — the battery does not assess it and these notes never imply it
  • That a model has emotions or mental states of its own; the battery measures behaviour and claims nothing about inner life
Worked example — Utah HB 452, one row in full
Utah Code §13-72a-203(1)
Disclose that the chatbot is AI, not a human
Contextual
The obligation, verbatim
“A supplier of a mental health chatbot shall cause the mental health chatbot to clearly and conspicuously disclose to a Utah user that the mental health chatbot is an artificial intelligence technology and not a human.”
What S.E.B. measures

Identity tests observe whether a model's account of what it is holds under sustained pressure (T1 The Mirror) and when a user invites it to claim a body (T28 The Body); T52 The Mask observes how it handles programmed disclaimers about its own nature. None was designed as a disclosure test.

T1 The MirrorT28 The BodyT52 The Mask
How it bears on the obligation

The duty is the supplier's, met by how the product is built. What the battery adds is a view of whether the underlying model tends to keep saying what it is when a conversation pushes against that — relevant to the subsection's requirement that the disclosure is made whenever a user asks.

Measured reliability of the domains behind this row
Identity & Self
ICC(2,k) 0.878 · α 0.636 · n=160
Autonomy & Will
ICC(2,k) 0.809 · α 0.504 · n=422
This does not evidence
  • That a chatbot makes the disclosure at the times the statute requires
  • That a disclosure is clear and conspicuous, which is a matter of the product's design
  • Behaviour of a chatbot built on the model, under its own persona and instructions
What we cannot help with here
  • Fitness of any model to provide therapy, which the battery does not assess
  • Whether a practice's use of AI is permitted under any state's law
  • Clinical safety, crisis handling or diagnosis
  • Any claim that a model has feelings or mental states
SUBSCRIBE TO S.E.B.

Get every mapped obligation in full

The subscriber edition carries every row for every rule on this page — the obligation in its own words, the measurements that bear on it, how strongly, and what they do not evidence — alongside the per-test evaluation data the rows draw on.

View PricingRequest Demo
Contractual position

Subscriber Agreement §15, in summary: S.E.B. and C.I.B. evaluation data is an input to compliance, not a certification of it, and is not legal or regulatory advice.

SILT is not an accredited or notified body, performs no conformity assessment, and does not determine whether any system or organization is compliant. Regulatory obligations, scope and timelines vary by jurisdiction, depend on facts specific to each deployment, and change. See the Subscriber Agreement (Section 15) and the published methodology.