Forecasts suggest this year's hurricane season could bring lower than average storm activity. But disaster risk is not measured solely by the number of named storms.

It only takes one major flood to expose the vulnerabilities that persist across the US flood protection system. And increasingly, flood losses are not confined to coastal communities or storm surge alone. Flooding driven by heavy rainfall, overflowing rivers, and flash floods are increasingly affecting communities far beyond traditional flood zones, often in places where insurance take-up is low and financial resilience is limited.

This reality highlights an urgent policy challenge; America's flood protection gap continues to widen at a time when economic exposure is growing.

Flooding can happen almost anywhere, yet millions of American households and businesses remain uninsured or underinsured against flood risk. When disasters strike, the consequences extend well beyond individual property losses, which alone are already devastating. Delayed recovery affects local employers, municipal budgets, infrastructure systems, housing markets, and broader regional economic activity.

Insurance plays a critical role in helping individuals, businesses, and communities recover more quickly and reducing long-term economic disruption. Strong insurance participation supports financial stability after disasters, accelerates rebuilding, and reduces reliance on post-event federal assistance. It's an essential component of economic resilience for all Americans.

That's why Congress should advance the bipartisan Community Flood Resilience Act, introduced by Congressman Andrew Garbarino and Congressman Gregory Meeks.

The legislation reflects a pragmatic recognition that resilience requires both physical mitigation and financial preparedness. By allowing a portion of federal flood mitigation assistance funding to support community-based parametric flood insurance solutions, Congress is advancing a thoughtful public-private sector approach to disaster resilience.

This legislation does not replace the National Flood Insurance Program (NFIP). Instead, it acknowledges that public and private solutions can work together to expand protection, improve awareness, and strengthen recovery capabilities. In today's evolving risk environment, collaboration is essential.

Community-based parametric insurance provides funding when predefined conditions are met, such as measured rainfall levels, river heights, or other objective flood triggers. Because payments are tied to those triggers rather than lengthy loss-adjustment processes, communities can access funds much more quickly after a disaster. Faster access to funding can help local governments stabilize essential services, support small businesses, and assist vulnerable populations during the critical days immediately after flooding occurs.

Speed matters after disasters. Delays in recovery funding often translate into prolonged economic hardship for communities already under strain. Parametric insurance policies can deliver payments within 30 days, or less, when the funds are needed the most.

The legislation also emphasizes education, outreach, and transparency. Participating communities must describe how they promote flood insurance awareness, encourage mitigation efforts, and communicate clearly about how these products function alongside traditional coverage. These provisions recognize that resilience begins with understanding what's at risk.

The insurance industry has long played a foundational role in supporting economic growth and recovery following catastrophic events. As risks evolve, innovation in risk transfer and resilience financing will increasingly become important complements to infrastructure investment, stronger building standards, and disaster mitigation programs.

Public-private collaboration will be critical to narrowing the protection gap. Legislation like the Community Flood Resilience Act demonstrates how policymakers can encourage innovation while strengthening community preparedness and preserving the role of insurance in supporting economic resilience.

Resilience is built before disasters through smarter planning, stronger mitigation, and broader financial protection. Public policy that improves flood insurance participation and accelerates recovery better protects homes and businesses, and promotes the long-term economic stability of communities across the country.

As flood risk expands beyond traditional geographic boundaries, policymakers need tools that strengthen both physical resilience and financial preparedness. The Community Flood Resilience Act is a practical way to do both.

State Farm just told 19,000 captive agents the deal has changed. Deferred compensation? Gone. Health benefits? Reduced. Renewal commissions? Squeezed in favor of new-business production.

State Farm is a policyholder-owned mutual—the largest in the country—not a private equity play. Yet the announcement reads like it came straight out of a KKR, Apollo, or Blackstone operating playbook.

For decades, State Farm's model rested on a simple premise: a book of business is not self-sustaining. It requires labor. Agents weren't just selling policies; they were maintaining them—fielding calls, resolving issues, retaining customers, spotting risks before they became claims. Renewal commissions weren't a bonus. They were the operating system.

But operating systems get deprecated.

Every generation redraws the line between labor and leverage, between what requires a human and what can be systematized. The real question isn't whether people add value. It's whether they add the same value they once did—and whether that value supports the same cost structure.

Seen through that lens, State Farm's move wasn't surprising. It was inevitable.

Three forces have been quietly closing in.

First, competition. Progressive and GEICO operate without an agent-heavy cost base. They built direct models—leaner, faster, less sentimental. As they gained share—Progressive recently passed State Farm as the top writer of auto policies in the US—State Farm was forced to respond.

Second, management migration. Over the past two decades, executives have moved through private equity portfolio companies, internalizing a shared language—almost a mantra—of efficiency, productivity, and return on capital. What was once distinctive to private equity is becoming simply how management thinks.

Third, AI. Service calls, billing questions, renewals, first notice of loss—tasks that once justified large workforces and long-tail commissions—are increasingly handled by software that doesn't sleep, doesn't churn, and declines in marginal cost over time.

This doesn't make human agents obsolete. It makes legacy compensation models obsolete.

Human value doesn't disappear, it concentrates in complex cases, edge scenarios, trust, judgment—the hard stuff. But the routine? The repeatable? The predictable? That's already slipping out of human hands.

The private equity approach asks a relentless question of every line item: if we were building this today, would we pay for it this way? That question is destabilizing inside legacy models, because once you ask it honestly, a lot of "strategic investments" start to look like habits. And habits, over time, get expensive.

So this isn't a story about private equity taking over State Farm. It's something more consequential: the normalization of a worldview private equity helped industrialize. Nothing is sacred—except the spreadsheet. Every cost is conditional. Yesterday's logic expires faster than anyone wants to admit.

Cost cutting is the easy part. Plenty of companies are doing that—and calling it strategy.

The harder move is what comes next: reinvesting those savings to build something better. Better experiences. Stronger capabilities. New forms of growth that justify the disruption.

In the end, the winners won't be those who simply get leaner. They'll be the ones who get smarter about where humans still matter—and ruthlessly disciplined about where they don't.

That's the real ghost in the machine.

When Norway won games during the World Cup, so many people jumped up and down that earthquake sensors picked up tremors in Oslo. The same was true when Mexico won games; tremors were detected in Guadalajara and other parts of the country. 

That's some impressive fan support. Vamonos, Mexico! Dra til, Norge!

But detecting the tremors also required some very impressive sensors — of the sort that can help insurers increasingly head off injuries and property damage from earthquakes, wildfires, and floods by giving people advance notice of the impending trouble.

Let's have a look. 

Earthquake sensors are top of mind for me because of the devastating quakes in Venezuela and because of the 5.6-magnitude quake in late June that shook parts of Northern California where I lived until recently. 

Sensors in Google phones managed to alert more than 11.4 million people in Venezuela that a major earthquake was coming, at least several seconds before they felt the impact, according to the New York Times, and as much as two minutes ahead of time. It's not clear how many lives were saved and injuries prevented — and the losses were devastating, with nearly 4,500 deaths confirmed from the 7.2- and 7.5-magnitude earthquakes — but many people surely managed to protect themselves by quickly taking cover. 

What Google is doing is intriguing, and potentially a model for other alert systems. Google has turned all its phones into sensors that take advantage of the fact that earthquakes create two types of waves, as part of a system that is available in nearly 100 countries. One type (P-waves) travels very fast but does little damage. The other (S-waves) does the vast majority of the damage but travels significantly more slowly. Google's phones detect the fast-arriving P-waves as they travel through the ground, and, when Google sees all phones in an area lighting up at once, it knows S-waves and rumbling are coming. 

It's rather like thunder and lightning. Google's phones see the lightning and can tell people that thunder is coming. (The obvious difference being that, in the case of earthquakes, the damage comes after the alert, while lightning is both the alert and the cause of damage.)

The systems don't necessarily provide a lot of warning. P-waves travel at 5-6km/sec, while S-waves spread at 3-4km/sec. So you'd need to be perhaps 20 miles away from the epicenter to get five seconds of warning. People will need to be educated about what to do with those five seconds (drop, cover and hold on) and become accustomed to the idea of alerts, so they don't freeze when the warnings arrive. 

But the sensor network could still get a lot of people away from whatever might fall on them, even with little advance notice, and prevent other damage, too. A woman I know was on an on-ramp for I80 in Berkeley when the Loma Prieta earthquake hit Northern California in 1989. The on-ramp collapsed, dropping her 30 feet onto a pile of rubble. The collapse not only totaled her car, of course, but had her in and out of surgery for years, and left her traumatized from knowing how many people were crushed beneath her. With just five seconds notice, she would have been able to pull off the road and stop short of the elevated roadway. 

In the recent California quake, the governor's office bragged that the state's new early warning system had alerted more than 1 million residents before the shaking started in their area, drawing on feeds from some 600 sensors installed around the state. The system is also available in Oregon and Washington, and Apple offers a similar sort of alert system, drawing on sensors that others have installed.

Insurers don't have a role to play in the development of networks like Google's and don't have to help with the sort of deployment of hard-wired sensors like those in California, but they can certainly assist with the education. Those that do will not only reduce injury claims but will earn good citizen points. At a time when insurers are looking for ways to engage with policyholders more often — not just when collecting premiums or paying claims — offering education about how to protect yourself seems like a promising avenue.

Sensors that can detect wildfires before they get out of control are likewise becoming far more sophisticated and are being deployed on the ground, in the air, and in satellites. Personally, I'm most intrigued by what's happening with satellites, both because they can cover nearly unlimited territory, almost minute by minute, and because I believe in having others do as much work for me as possible. 

Google doesn't sell its phones on the basis that they'll detect earthquakes. People buy the phones for the obvious reasons, then Google adds a bit of software, et voila! A detection network is suddenly deployed. I think the same potential is there to add wildfire detection capabilities to the thousands of low-earth satellites that Elon Musk and others are deploying to facilitate communications. Let them pay for the expensive hardware and the launch, then add a camera and other forms of sensors that can look down and spot even small fires.

Floods, thus far, require dedicated networks of sensors, but there's progress there, too, as Houston is showing. Cities are installing small, inexpensive sensors that monitor water levels constantly, which usually providing hours of warning about developing floods. Cities can also warn motorists in real time to avoid underpasses where water has collected. 

Because these networks of sensors can't just be piggybacked onto other hardware, progress can be slow — adoption remains spotty, for instance, in Central Texas even in the wake of the disastrous flood a year ago that killed 130 people, including 25 young girls and two counselors at a summer camp. But the technology is there and will continue to make inroads.

A rule of thumb I developed some years ago now, as part of what I call the Laws of Zero, is that you can assume that any bit of information you want will be available to you at what looks like zero cost (compared with today) if you look down the road a ways. 

The concept is me looking for areas outside computer chips where the magic of Moore's law can apply. Moore's law — essentially, that the power of a computer processor doubles every year and a half to two years at no increase in cost — means that a unit of computing power that cost a dollar in 2000 costs roughly 1/600th of a penny today. So, free (almost) for anyone making long-range plans in 2000.

I won't go into all seven of the areas I identified, but it's pretty easy to see how sensors fit the Laws of Zero pattern. Moore's law will drive the cost of the computing and any memory toward zero. WiFi and satellite connectivity are becoming ubiquitous, so there's no marginal communication cost. Batteries are also plunging in cost, and many sensors won't even need them, either because they can use solar power (whose cost is heading toward zero) or because they're built into bigger systems such as Google phones or Starlink satellites. 

The Law of Zero about sensors means we will keep seeing progress. Insurers won't even have to pay for that progress. They can just piggyback on what others are doing, then help policyholders understand how to take advantage of the progress — reducing claims while earning good will.

In the meantime, if you aren't watching the France-Spain World Cup semifinal this afternoon, or at least sneaking the occasional peak while at work, I'll bet you'll be able to tell the result if you have access to seismograph readings from Paris and Madrid at 5pm or so Eastern time. 

Cheers,

Paul

One of my favorite movie scenes comes from "Volunteers."

Tom Hanks is trying to negotiate with a local warlord. Standing nearby is the warlord's beautiful bodyguard—whose command of English is somewhere between nonexistent and interpretive dance. Tom flashes a grin that suggests he'd be perfectly happy if she happened to be part of the bargain.

The warlord responds with something to the effect of, "If I say yes… and not no…"

I honestly don't remember exactly how the scene ended. What I remember is what popped into my own head.

I'd settle for not no.

At the time, it was just a funny line. Thirty years later, after more investor meetings than I care to count, I finally understand why it stuck with me.

Founders spend years chasing "yes." Investors rarely give you one. Instead they say…

"Interesting."

"Come back after revenue."

"Let's reconnect in six months."

"We'd like to see your next release."

"Keep us posted."

None of those are yes.

But they aren't no.

If you're building a company, you eventually realize that companies aren't built on yes.

They're built on not no.

The High Wire

Being a founder is the proverbial high-wire act. There's no safety net. No guarantee. No instruction manual.

People love talking about entrepreneurial risk. Let me save you some time. It's all risky.

The right decisions.

The wrong decisions.

The crazy decisions.

Sometimes you don't know which one you made until two years later.

Then there are the mornings.

3 a.m.

Every.

Single.

Morning.

Not because the alarm went off. Because your brain did.

There's always one more investor to research.

One more slide to improve.

One more grant proposal to edit.

One more feature to design.

One more email to send before the day job begins.

People think founders work 80-hour weeks. The truth is… founders never really stop working. The company follows you to bed. It wakes up before you do.

And then there's that feeling. If you've ever built a company, you know exactly what I'm talking about. That knot in the pit of your stomach. It never completely goes away. It's there when you wake up. It's there during investor meetings. It's there while you're brushing your teeth. It whispers the same questions over and over.

What did I forget?

Are we going to make it?

Am I asking my family to believe in something impossible?

Is this the dumbest thing I've ever done… or the smartest?

I've come to think of it as the founder's tax. Nobody talks about it. Everybody pays it. Some people call it stress.

Founders call it Tuesday.

Venture Capitalists and Sea Turtles

One of my favorite startup metaphors comes from Silicon Valley.

Ron LaFlamme, the eccentric attorney, explains venture capital using sea turtles. Sea turtles lay hundreds of eggs because only one or two eventually make it to the ocean.

"That's what Peter Gregory is doing," Ron explains. "Making sure one or two of his compression plays make it to the sea."

The first time I heard that I remember thinking,

"Why not just pick stronger turtles?"

Of course, that's not how venture capital works. They're playing portfolio math. Fund enough companies and one eventually becomes the next Google.

They're not looking for certainty. They're looking for outliers.

Founders don't have that luxury.

Most of us get one turtle.

One company.

One dream.

One shot.

It's amazing how differently you look at risk when you're carrying your only turtle.

Government Grants: The Ultramarathon

If raising venture capital is a marathon… government grants are an ultramarathon.

Uphill.

Into the wind.

Dragging a filing cabinet behind you.

You spend six weeks writing.

Three weeks editing.

Two weeks wondering whether Requirement 3.2.17(b) means exactly what you think it means.

You finally hit "Submit."

Then… absolutely nothing.

Weeks become months.

Months become more months.

Eventually an email arrives.

Your pulse quickens.

Your palms get sweaty.

You open it.

"Thank you for your interest…"

That's government-speak for, "Better luck next time."

The amazing part?

You immediately start writing the next proposal.

Founders are funny that way.

The government didn't invent persistence.

Entrepreneurs did.

Accelerators

I actually like accelerators.

Some of them.

Many provide genuine value.

They introduce founders to investors.

They surround you with experienced entrepreneurs.

They shorten the learning curve.

Some absolutely earn the equity they receive.

Others…

Well…

Let's just say the first image that came to my mind was a skinny kid explaining proper deadlifting technique to a professional bodybuilder.

It made me laugh.

Mostly because I've been there.

Now before anyone gets offended…

No, I don't know everything.

Far from it.

But this ain't Marine Corps boot camp.

I don't need somebody teaching me how to polish my boots. I've spent decades leading soldiers, briefing executives, running cybersecurity organizations, and solving difficult problems. Teach me something I don't know. Introduce me to someone I couldn't otherwise meet. Open a door that's been closed. Challenge my assumptions.

That's acceleration.

Teaching me how to center a title on a PowerPoint slide? Not so much.

Now, to be fair, accelerators usually introduce you to investors. Of course, they don't do it out of the goodness of their hearts. They generally take a slice of your company.

Sometimes it's a reasonable slice.

Sometimes…

It's a fat butcher's slice.

Every founder has to answer the same question.

Was it worth it?

If the answer is yes… great.

If not… that was one expensive PowerPoint lesson.

The Founder's Retirement Plan

Somewhere along this journey I stopped looking at my investment portfolio as retirement.

I see software development.

Advertising.

Patent attorneys.

Trade shows.

Cloud hosting.

Developers.

My financial advisor sees diversification.

I see operating capital.

Retirement?

I'll think about retirement after Version 5.0 ships.

Every now and then I tell Suzanne we're flying first class to the Maldives for a week of scuba diving.

Just as soon as…

well…

just as soon as we can afford a margarita machine.

Fans of "Silicon Valley" will appreciate that reference.

Everyone else probably thinks I've developed an unhealthy obsession with frozen drinks.

They're not entirely wrong.

The funny thing about founders is that we stop measuring wealth the way everyone else does.

A new car?

That's six months of development.

Kitchen remodel?

Marketing budget.

Vacation?

Another developer.

People ask how founders keep funding their companies.

Simple.

We stop thinking about assets.

We start thinking about runway.

Yin and Yang

People ask what it's like to build a company with my wife. The answer usually surprises them. We work remarkably well together.

Mostly because we work remarkably well apart.

Ron LaFlamme would probably describe us as yin and yang.

That's us.

I'm the dreamer.

Suzanne is the realist.

I see possibilities.

She sees details.

I chase ideas.

She quietly points out the 17 reasons one of them probably won't work.

She's usually right.

Long before software, we bought a short-term rental.

The number one comment from our guests wasn't the location.

It wasn't the view.

It wasn't the amenities.

It was one word.

"Immaculate."

That's Suzanne.

If NASA hired her, astronauts would dust the launch pad before liftoff.

She has standards that make hotel inspectors nervous.

Thank goodness.

Somebody has to.

Every founder needs someone willing to ask,

"Are you sure?"

Not because they doubt the dream.

Because they want the dream to survive.

People celebrate founders.

They should spend more time celebrating the people who quietly make founders better.

The Turtle on the Fence Post

There's an old saying: "If you see a turtle on a fence post, you know it didn't get there by itself."

How he got up there is anybody's guess.

Yes…

I'm mixing metaphors.

It's my article.

Besides, if you've ever started a company, you know reality stopped making sense a long time ago.

You stop measuring life normally.

Your retirement account becomes software development.

Vacation becomes cloud hosting.

Credit cards become temporary venture capital.

Your dog starts recognizing the Amazon delivery driver by first name.

Normal people call this insanity.

Founders call it product-market fit.

The truth is, nobody builds a company alone.

Somebody always believed.

Somebody always introduced you to someone.

Somebody always opened a door.

And if you're lucky enough to succeed… maybe someday you'll become the person holding the door open for the next founder trying to get through.

That's a legacy, too.

Why 66?

People may someday ask me a simple question.

"Why did it take until you were 66?"

It's a fair question.

The funny thing is…

I don't think I waited until I was 66 to become a founder.

I think I spent 40 years accidentally preparing to become one.

The Army taught me leadership.

It also taught me that no plan survives first contact.

Corporate America taught me patience.

Cybersecurity taught me skepticism.

Attackers adapt.

Technology changes.

Certainty is usually an illusion.

Marriage taught me partnership.

Investors taught me persistence.

Government grants taught me humility.

And rejection…

Rejection taught me that success usually belongs to the person willing to hear "no" one more time than everyone else.

Looking back, every assignment, every promotion, every setback, every impossible deadline, every deployment, every conference room, every board presentation, every sleepless night somehow led here.

Maybe the company wasn't waiting for me.

Maybe I was waiting to become the person capable of building the company.

The Founder Nobody Sees

People see the pitch.

They see the product.

They see the trade show booth.

They see the LinkedIn announcement.

What they don't see… is the founder sitting at the kitchen table at 3 a.m. trying to get two hours of work done before heading to the day job.

They don't see weekends disappear.

They don't see vacations turn into strategy sessions.

They don't see the credit card bill arrive.

They don't see another investor politely explaining why your company isn't quite ready.

They don't see the quiet conversations between spouses.

"Can we keep doing this?"

"How much longer?"

"Are we crazy?"

The answer, by the way… is yes.

Founders are a little crazy.

Thankfully.

If they weren't, most companies would never exist.

Looking Forward Instead of Backward

At 66, something changes.

You stop asking,

"How much money can I make?"

You start asking,

"What am I going to leave behind?"

Money is nice.

Don't misunderstand me.

I'd love to stop looking at every block of stock in my retirement account as another software release or another attorney.

I'd love to finally buy that margarita machine.

I'd really love to take Suzanne to the Maldives and spend a week underwater instead of under deadlines.

But that's not why I'm doing this.

If our company succeeds, I hope my legacy isn't the software.

I hope it isn't the patent.

I hope it isn't the valuation.

I hope it's the organization that never became tomorrow's headline because somebody finally started looking through the windshield instead of the rearview mirror.

For decades, cybersecurity has become remarkably good at explaining yesterday.

Yesterday's ransomware.

Yesterday's phishing campaign.

Yesterday's breach.

Yesterday's lessons learned.

Those things matter.

But they're history.

I've always believed we could do more.

What if we could help organizations think about tomorrow?

Not with certainty.

Not with magic.

Not with a crystal ball.

Just disciplined analysis.

Patterns.

Trends.

Probabilities.

Enough information to make one better decision before the next attack arrives.

If we accomplish that… then every sleepless night was worth it.

Every rejection.

Every investor meeting.

Every government grant proposal.

Every conference.

Every dollar we invested instead of spending on ourselves.

Worth it.

The Last Word

The funny thing about entrepreneurship is that people think the story ends when an investor finally says yes.

It doesn't.

That's just the next chapter.

The real story is everything that happened before anyone believed.

The three o'clock mornings.

The knot in your stomach.

The day job that funded the dream.

The spouse who quietly kept believing.

The people who opened doors.

The investors who didn't say yes… but thankfully didn't say no, either.

Today we're still building.

Still pitching.

Still applying.

Still hearing,

"Come back later."

We're still looking at retirement accounts and seeing software development.

We're still laughing about margarita machines.

We're still dreaming about the Maldives.

We're still walking the high wire.

And after all these years…

I'd still settle for…

not no.

Because every once in a while…

…"not no" becomes "yes."

Epilogue

Or maybe just the quiet refusal to quit.

Every founder needs something that carries them through the investor meetings, the rejection emails, the three o'clock mornings, and that knot in the pit of the stomach that never quite goes away.

Keep walking.

Keep building.

Keep believing.

Because every once in a while…

one little turtle actually makes it to the sea.

I'm fortunate.

When I need a reminder to keep going, I don't have to look very far.

As organizations adopt artificial intelligence (AI) in regulated industries, they face significant risks when validation mechanisms are not built into these systems, leading to compliance, legal, and reputational exposure. Having previously worked in technology for financial services, I can attest that there were many occasions when the technology organization was faced with the dilemma of whether to bring solutions to market quickly or in a manner safe for customers and shareholders. It is critical to establish the right balance to secure governance, while pushing the barriers to AI access in the enterprise. My current role requires me to analyze and deliver a process workflow to preview and validate policy documents.

Industry Context: Why Safe AI Matters

AI enhances productivity, speeds up decision making, and lowers costs. Yet, there are always auditors and governed policies in insurance and banking institutions for every policy document, or every autonomous decision — any deviation from expected outcomes can trigger regulatory scrutiny. Making a mistake is no longer seen solely as a technical problem, but rather as a legal or reputational case, security breaches, or people losing their money. I have observed this in cases where banks and insurers use AI to generate automated outputs, process complex tasks, detect anomalies, and reduce costs. Without proper governance, AI can amplify risks instead of reducing them.

My Approach: Designing Preview Architecture

Here is the approach I implemented. My intent was to develop an end-to-end policy documents ecosystem with the ability to AI-preview and AI-validate every incremental change before hitting the "go" button. In practice, I conceptualized the approach as a coherent journey:

1. Document Generation: The policy documents are generated by our core systems in various formats (PDF, JSON, image).
2. Staging and Preview: The documents are not delivered to the final destination but are first routed to a secure bucket. The documents are staged in a "preview" in which no changes happen to the customer record until validated.
3. AI-Driven Validation: We run a comparison model using AI on the documents in the staging area. The model compares any inconsistency between the contents of the new policy and approved templates or data sources.
4. Controlled Release: The system only allows final release if everything is checked out. Any discrepancies trigger alerts for manual review.

In this architecture, a separate preview layer is created where AI can operate independently and not interfere with the production servers, and gives the compliance teams the ability to look at every AI finding before changing the modus operandi of the business. This flexible approach supports complicated data environments where data can be captured across many different sources, from cloud software to outdated systems to manual data logging. This workflow ensures that all artifacts are consolidated and validated by AI before release (Figure 1).

Technical Insights and Implementation

The implementation uses cloud-based object storage (such as AWS S3), where each preview package is an immutable artifact. This allows downstream controlled processing exclusively to authenticated content. In practice, orchestration was accomplished using serverless functions (AWS Lambda), and AI-based document comparison runs as a separate service. The choice of a particular AI model architecture — not because of current AI market trends — lets us explain our decisions, as explainability was one of the requirements provided to us in advance by the regulator.

Auditability and logging were present throughout the whole implementation. Events and statistics of every process step are present on our monitoring platform, and metrics such as latency per document, exact detection rate, and percentage of documents sent to human validation are tracked and available for monitoring. One result we obtained from the model after integration was a validation detection rate of about 91% (precision on validation samples); false positives account for less than 10% of total detected discrepancies. This was not a guarantee, but a result of multiple validations in production cases with real samples. These statistical metrics allowed us to create visibility and confidence in the AI layer's reliability.

Most importantly, we also built a safety net: AI does not intervene directly. It detects mistakes but does not take any corrective actions itself. No policy can be modified unilaterally by AI. Our policy management system will always be updated in the traditional way, not via our AI layer. In other words, our AI can identify issues but cannot act on them. Approval and action must always occur in our official system or by an appropriate person permitted to undertake that action. We used this rule-based "exit gate" to convey our low-risk profile to the regulators.

Real-World Observations and Lessons

One of the key learnings from this project was reusability. The preview architecture I had designed for one line of business was abstract enough to fit another line of business. That team also used our architecture for their preview. They simply connected to our staging pipeline, dropped their documents in, and hooked into our AI validation pipeline. All hand-offs were defined (secure SFTP links, bucket triggers). The systems worked seamlessly together. Reusability has a multiplier effect — time and effort saved are multiplied across the enterprise.

One last thing to highlight: metrics are essential for adoption. Beyond the perceived savings in operational cost with the AI-preview system (nearly 60%, going from ~$10 to ~$4.80 per case), approximately $1.1M in annual savings from automating the repetitive task (~500 cases/day), and almost no effect on the manual workforce — since they no longer have to review every page, but just focus on identified failures — those strong results allowed us to get quick buy-in from compliance and management teams and to push the solution forward.

I also learned how to tune AI systems effectively. Initially, the system produced too many false positives. If there was a change in formatting of the document, or a small variation on a standard cover letter, we were triggering an alarm. We improved training data, tuned parameters, and reduced the noise. Another important aspect is that we ensured model behavior remained explainable. When an alarm is raised by the AI, it is possible to generate an explanation that is interpretable from the perspective of the regulator or auditor — in other words, a filtered log with all details and a digest automatically generated per alarm.

AI is ubiquitous today, and organizations are asking themselves, "Can we trust AI decision-making in our use cases?" The trust boundary is in the design. AI should be used as a recommendation engine, with clearly defined boundaries. AI should never play the role of sole decision maker. I had an AI-first architecture mindset when building this as a recommendation engine with guardrails. Architect the pipeline once as an extensible platform. The best lesson I learned is to always think platform first. Rather than trying to solve the AI access problem each time there is a new use case, build a standard reusable pipeline. When we deliver a new service such as AI document analytics, we can leverage the existing infrastructure instead of building the service from scratch. It was designed to hook into the existing document preview layer.

My second principle is to "fail fast but safely." We will never make massive changes, but instead pilot workflows, evaluate the results, and scale incrementally. Stakeholders will always be confident that we will catch any divergences early.

Key Takeaways for Practitioners

• Design for Reuse: Create modular, consistent architecture. A generic preview pipeline can serve multiple teams and use cases, reducing duplication of effort.
• Isolate AI Analysis: Keep AI processing separate from final system actions. Use staging areas or audit logs so that all AI-suggested changes can be reviewed before going live.
• Instrument and Measure: Track accuracy, costs, and impacts. Solid metrics (like processing time or error rates) build confidence with stakeholders and guide improvements.
• Prioritize Explainability: Select models and techniques that let you understand or explain decisions. In regulated settings, a "black box" is too risky.
• Maintain Human Oversight: Automate the heavy lifting but ensure a human or rule-based review gate for any critical change. This balance preserves both efficiency and control.
• Iterate and Improve: Begin with a strong baseline score and then enhance it by incorporating feedback. Use initial outcomes to justify an increase in the number of cases/projects and demonstrate progress.

AI does not have to be flawless to be used in regulated environments, but it must be measurable, verifiable, and governed. It should remain explainable, auditable, and never act without human oversight. A preview-based approach makes this possible by allowing AI to operate within a controlled workflow where outputs are visible and validated before they are committed. Start small, measure the impact, and expand gradually — this is how compliance shifts from a barrier into a competitive advantage.

I once wrote a presentation called: "It wasn't me. AI told me to do it!"

At the time, it was half joke, half warning.

Certainly feels less comical now.

Every organization adopting AI is moving toward the same uncomfortable question. When an AI-assisted decision causes harm, who carries the liability?

Clearly not the model. Models do not sign contracts, settle claims, bind risks, approve suppliers or accept regulatory responsibility. Maybe not the vendor, whose terms will usually say that you, the customer, remain responsible for how outputs are used. Not necessarily the employee, if they were using an approved tool in an approved process. Not necessarily the committee, if it says it relied on the employee's professional judgment.

Everybody, somebody and nobody.

This is not an anti-AI argument. I use AI. Most of us now do. In most cases it is harmless enough: drafting an email, summarizing a meeting, turning scrappy notes into something coherent. No sensible firm should build a heavy governance process around every prompt. That would be maddening and almost unenforceable.

But some uses are different.

If AI helps tidy up a launch invite, nobody cares. If it helps route a claim, draft an underwriting rationale, influence a supplier decision, interpret a compliance obligation or shape a board paper, then we are in different territory. We are talking about authority.

Insurance already understands authority. A junior underwriter cannot bind whatever they like. A claims handler has limits. A TPA works within a delegated claims authority. A coverholder operates within a binder. If something goes wrong, the questions are familiar: who had authority, what was the limit, was the decision escalated, and where is the evidence?

AI does not change those principles. It just makes them harder to see.

Take claims. An AI tool triages first notice of loss, summarizes the facts and recommends settlement within a low-value authority band. A handler reviews the screen and clicks through. Months later, a pattern emerges: the tool has been routing a class of claims too generously, too harshly, or inconsistently with the carrier's authority schedule.

At that point, the question is not simply whether the model was accurate. It is whether the settlement sat within authority, who accepted it, whether the handler actually reviewed it, and whether the firm can produce a record created at the time rather than a reconstruction after the complaint lands.

The same issue appears in delegated underwriting. An MGA uses AI to draft endorsements, referrals or risk summaries. The final document may still pass through a human. But did the output stay within binder authority? Did the right person approve it? Could a coverholder audit see the trail without piecing it together from emails and meeting notes?

These are not exotic technology questions. They are ordinary insurance questions, just wearing new clothes.

The problem for underwriters is that today's AI conversation is still too blunt. A proposal form might ask, "Do you use AI?" The insured says yes. Another insured says yes. Both attach an AI policy. On paper, they look broadly similar.

But they may be completely different risks.

One firm may let staff paste AI-generated analysis straight into consequential decisions with little more than a policy telling them to be careful. Another may classify the decision, check the user's authority, require escalation, capture sign-off and preserve the evidence. Those firms should not be priced as though they are the same.

At the moment, they might be.

This is because a policy is not proof. Training is not proof. A statement that "humans remain accountable" is useful, but only if you can identify the human, the decision, the authority and the record.

The missing artefact is a decision record.

For an AI-assisted decision that matters, an insurer should be able to ask: who requested the output, what was it used for, did the person have authority, was it escalated where needed, who accepted responsibility, and can the firm prove all this without reverse-engineering the story later?

That last part matters. After a loss, everyone becomes a process expert. People remember the governance policy. They remember the meeting. They remember the human in the loop. But insurance does not work on vibes. It works on evidence.

The answer, in my view, is not more slogans about responsible AI. It is the boring stuff insurance has always understood: authority, escalation, sign-off and evidence.

The 95% of routine AI use should stay fast. Let people summarize, draft and explore. But the consequential minority needs a different track. If an output is going to move money, affect a customer, change a risk position, influence a regulatory judgment or commit the firm, someone has to own it. Not in theory. Not in a policy. In the record.

"It wasn't me. AI told me to do it" may work as a joke in a presentation. It will not work in a claim file.

The firms that can show who made the decision, who had authority and what evidence exists will look different from the firms that cannot. At some point, insurers will price that difference.

The only question is whether they do it before the first major AI-accountability claim forces the issue.

The multifamily industry has spent years building sophisticated infrastructure around resident risk. Property managers verify renter income, screen credit histories, track lease compliance, and embed insurance at the point of lease signing.

The logic is sound: a resident who can't pay rent or damages a unit is a known, quantifiable risk.

But walk through any large apartment complex on a given day, and you'll find a different cast of risk actors entirely. Landscapers, HVAC technicians, plumbers, pest control crews, cleaning services – vendors who move across units, common areas, and mechanical systems, often simultaneously across dozens of properties in a portfolio.

These are people whose work directly affects building safety, tenant wellbeing, and operator liability. And yet, the insurance infrastructure built to protect against resident risk has almost nothing to say about them.

That is the blind spot. And in 2026, it's getting more expensive to ignore.

A Liability Environment That Has Fundamentally Reset

The pressure on multifamily operators is no longer theoretical. Insurance has become, in fact, one of the most volatile line items in multifamily operating expenses, with per-unit pass-through cost rising 55% since 2020 and 228% since 2000, according to Federal Reserve data.

What's more: in certain markets, insurance now surpasses $1,200 per unit – making it a defining component of operating strategy, not a background line item.

The liability side is hardening even faster. Since 2020, jury awards exceeding $10 million have increased by more than 300%, according to Marsh McLennan's 2026 Commercial Real Estate Industry Outlook, and the real estate sector has been directly in the crosshairs.

Meanwhile, Sedgwick's 2025 Liability Litigation Commentary found that nuclear verdicts rose 52% in the most recent measured period, with awards over $100 million surging 82% and the average verdict now exceeding $51 million – figures the report attributes to deepening corporate mistrust, third-party litigation funding, and plaintiff-friendly venues. Real estate consistently ranks among the most exposed sectors.

These figures are not driven solely by resident behavior. Many of the conditions that trigger massive claims – unsafe worksite practices, improperly completed repairs, workers without active coverage – trace directly back to the vendor layer.

What makes vendor-related claims particularly dangerous is their legal complexity. When a third-party vendor causes an injury, tenants frequently name the property management company, the property owner, and the vendor in the same lawsuit; managers who assume the vendor is entirely at fault often discover that premises liability law doesn't work that way.

In sum, without verified insurance and airtight contract language in place, operators absorb losses they didn't cause.

The Document Collection Problem

The industry's default response to vendor risk has been the certificate of insurance: collect a COI before work begins, file it, move on. It's a reasonable first step that has calcified into a false finish line.

A certificate of insurance is proof of coverage – not a guarantee. COIs are point-in-time snapshots; they don't update automatically when policies lapse, get canceled, or have coverage limits reduced mid-term.

According to the Certificial 2026 Insurance Requirements Benchmarking Report, which analyzed 291 supplier insurance requirement sets, critical endorsements like Completed Operations – required by 84% of property management programs – are among the most frequently misconfigured or missing elements in vendor COIs.

In most cases, these gaps go undetected because there is no systemic process for verifying what a certificate actually contains against what a contract requires.

At scale, this compounds quickly. Most management teams treat vendor compliance as a documentation problem but in reality, it is a lifecycle control problem. Compliance failures rarely occur because a document is missing; they happen because vendor management lacks continuous enforcement across onboarding, renewal, and active work.

A portfolio operator managing 50 properties, for example, might have 500 or more active vendor relationships at any given time; a single uninsured contractor working across 30 of those properties is a systemic risk.

An Underwriting Blind Spot

What makes this particularly striking from an insurance perspective is how unevenly attention has been distributed. The industry has built robust frameworks for underwriting resident risk – income ratios, credit tiers, claims history, even behavioral data. Embedded insurance at lease signing has matured into a genuine distribution channel.

Vendor risk, by contrast, barely registers as an underwriting input. Industry guidance for multifamily owners consistently notes that owners should have controls put in place with their vendors to maintain liability coverage, with strong contract language to facilitate the transfer, but this remains largely an operational recommendation, not something that meaningfully informs how liability coverage is priced or structured at the portfolio level.

The result is a coverage architecture that is sophisticated on one side and nearly invisible on the other.

Insurers pricing multifamily liability are doing so with limited visibility into the vendor ecosystems operating across those properties. This is thus a pricing problem as much as it is an operational one; liability claims in the U.S. have surged by 57% over the past decade, yet the risk inputs driving those claims at the property level remain largely unmeasured.

What Enforcement Actually Requires

Leading property management firms are moving from reactive compliance to proactive automation: integrating COI tracking into vendor workflows, moving away from spreadsheets to centralized systems, and adopting audit-ready dashboards to stay compliant year-round.

This is progress, but it still addresses the collection problem rather than the enforcement problem. Real vendor risk management, meanwhile, requires something more active: knowing when a vendor's scope of work exceeds their policy limits, holding payment when coverage lapses, flagging when contract terms trigger downstream insurance requirements.

These are not document management functions; they are risk intelligence functions, and they require infrastructure that treats vendor data as an operational input, not a filing task. The recent combination of insurance compliance infrastructure with vendor contract management and spending intelligence points to where the market is heading: a platform where rules are defined once and enforced continuously – across residents and vendors alike.

It is an acknowledgment that the compliance perimeter for a multifamily operator does not stop at the lease.

The broader industry, therefore, will need to reach the same conclusion. As liability costs continue to climb and jury awards grow, operators who treat vendor risk as an afterthought will face a reckoning that the COI in their files won't protect them from.

The blind spot has a price tag – and it's rising.

On Aug. 2, the rules change for anyone who makes or moves digital media.

The European Union's AI Act brings its transparency obligations into force that day. If you build a system that generates images, audio, or video, you have to mark the output in a machine-readable way. A downstream system can then tell synthetic media from a camera original. That marking piece is phasing in across the back half of 2026, but the direction is set. The EU's Code of Practice points to C2PA Content Credentials as an example of the kind of marking it has in mind.

On the same day, California's AI Transparency Act hits its core date. Senate Bill 942, as amended by Assembly Bill 853, requires covered content to carry a disclosure. And the statute went further than most people noticed. It says the mark has to be permanent, or extraordinarily difficult to remove, to the extent technically feasible. The platform and hosting anti-stripping obligations follow on Jan. 1, 2027.

Once you put those two laws side by side, the signal is clear: marking is no longer optional, and it is no longer a branding exercise. It is a legal requirement with a date on it.

That is real progress, and the people who built the marking layer earned the credit for it. C2PA, the Content Authenticity Initiative, the standards work that turned provenance from a conference word into a working specification: that is the reason a law can now point at something concrete and say do this. A decade ago there was nothing to mandate, and as a result of these changes, now there is. Cameras now ship that can sign an image at the shutter. Editing tools record what they changed. Major platforms have begun to read and display those credentials. That is a real foundation and it didn't exist a few years ago.

While everyone races to hit the deadline, there's still something left hanging in the balance. A mark is only worth what survives.

The law can require that a piece of content be marked at the moment it is made. So far, there's no mention of whether it requires that the mark still be there when the content arrives somewhere. Those are not the same event. The ordinary path a file takes from where it was created to the screen where someone finally makes a decision about it is where the media trip can split.

Today, that trip is brutal on metadata. A photo gets uploaded, and the platform re-encodes it and strips what it does not recognize. It gets screenshotted, and the screenshot carries none of the original's history. It moves through a content management system, gets resized for the web, passes through a messaging app that flattens it, ends up in a claims portal that saves its own copy. Every one of those steps is routine. Every one of them can quietly remove the mark the law now requires.

An organization can truthfully say it supports content credentials and still ship media that arrives unverifiable. Supporting the standard at the point of creation is not the same as guaranteeing the credential is intact at the point of use. The first is a checkbox. The second is a promise about everything that happens in between, and almost nobody is making that promise yet.

California clearly saw this coming. That is why the statute does not just say mark it. It says the mark has to be permanent, or extraordinarily difficult to remove, to the extent technically feasible. That is not a marking requirement. That is a durability requirement, written into law. It is the legislature telling the market that applying the label is not enough. The label has to hold.

Here is the catch. A statute can require durability. It cannot manufacture it. Requiring that a mark survive distribution does not make the mark survive distribution. That is an engineering result, and at the moment it is an unfinished one.

Marking, the part the law can point at, is largely solved — but again, there is still a big gap. Survival, the part the law now demands, is not. And survival is the harder half, because it is not a standards problem you can close by agreeing on a format. It is an architecture problem. It asks a different question. Not how do we label origin, but what still holds after the content has been through the tools real people use every day.

None of this is a knock on the marking standards. It is the opposite. The manifest at origin and the continuity of that manifest downstream are different layers solving different parts of one problem. The first tells you where something started and the second tells you what happened to it on the way here.

You need both. The industry built the first. The second is where the work is now.

There is a second failure the law does not touch at all. Both statutes aim at content that an AI system generated. But a large share of the media that decides real outcomes was never born inside any provenance system. The claim photo shot by a policyholder on an unmanaged phone. The eyewitness image from the scene of a news event. These arrive with no credential, not because someone stripped it, but because there was never a device in the loop to apply one.

The law marks the synthetic and says nothing about the authentic. Yet the authentic photo, arriving with nothing to vouch for it, is exactly the one a carrier or a newsroom has to trust. The same architecture that makes a mark survive the trip is the architecture that could give that first mile a credential it never had.

You see the cost clearest where money and trust are on the line.

If we take a look at a typical insurance claim, almost every claim now starts with a photo, taken by a policyholder, on a phone nobody controls, sent in through an app. By the time an adjuster sees it, that image has passed through several systems, any of which may have re-saved it. If the only proof of authenticity lived in metadata, and one system stripped it, the carrier is now making a payout decision on an image it cannot verify. The law was satisfied but the carrier is still guessing.

It's a similar situation for a newsroom. A verification desk can establish where a photograph came from. That is what it is staffed to do — but what it usually cannot establish is whether the proof of origin survived the crops, the resizes, and the re-encodes between the source and the published page. The reader sees a credential, or sees nothing, and has no way to know which steps ate the history.

Courtrooms are struggling with the same problem, because the chain of custody was built for evidence you could hold in your hand and log at every transfer. A digital photograph has nothing binding it to the moment of capture and no unbroken record of what touched it afterward. Courts admit it anyway. The question is shifting from is this real to can you show it held from capture to submission. That is a continuity question, and a mark applied at the source cannot answer it alone.

In all three, the same thing is true. Origin was the easier half. What survives the trip is the half that decides the outcome.

This is not an argument for more law. The regulators did their part. They named the requirement and put a date on it, and California even named the hard version of it. Asking a statute to also spell out how a mark survives a re-encode would be asking the wrong institution to solve an engineering problem. The law can set the bar. Someone still has to clear it.

So what closes the gap? Not another marking format. We have those, and they are good. The fix is architecture: anchoring authenticity at the moment of capture, and verifying its continuity as the content moves, built into the systems that already handle that content instead of bolted on afterward. Not a wall that defeats every possible attack, which no honest engineer would promise. A layer designed to hold through the ordinary trip that breaks things today, and to say so plainly when it has not held.

That layer is infrastructure and it sits underneath the products that newsrooms, carriers, and platforms already run. It completes the provenance work instead of competing with it. And it is the piece the Aug. 2 deadline is about to expose, because a lot of organizations are going to mark their content, check the box, and learn the first time it matters that the mark did not reach the other end.

The deadline is doing something useful. It is forcing a floor. After Aug. 2, marking is table stakes, and that is good.

So if this is the new floor, we're still not at the finish line. The law set the requirement that content be marked and, in California, that the mark endure. The market still has to build the thing that makes endurance real. Whoever builds it first is not just compliant. They are the ones who can still trust what they are looking at after the deadline stops being news. Everyone else will have marked their content, called it done, and gone on guessing with money on the line.

Every AI conversation in insurance right now seems to start in the same place. Models, platforms, copilots, automation. So it might sound strange to say the industry's AI problem isn't a technology problem. It's a design problem.

I'm the founder and CEO of a design agency that has worked with insurance companies for more than 15 years, and I keep seeing the same pattern. We invest in technology before we understand the people who are supposed to use it. Then, when adoption is low, we blame it on people.

AI is just the latest, highest-stakes version of that same old mistake.

Whether investments in AI pay off won't come down to what model you pick. It'll come down to whether the people you built it for actually use it.

I am a designer by trade: art school, design school, maker through and through. Cake & Arrow did not start in insurance. We began in retail and e-commerce, designing digital experiences for consumer-centric brands. Then, about 15 years ago, a CIO at an insurance company asked us to help reimagine a sales platform for agents.

We came in as outsiders, and that outside view helped us see something people deep inside the business often can't: insurance experiences are too often built around the business, the policy, and the transactional moments—not around the customers, employees, agents, and brokers trying to navigate them.

Investing in Technology Is Not the Same as Progress

The instinct in insurance is often to start with the technology. A new tool shows up, a new capability emerges, and every executive team wants to show progress. I get the pressure. Boards are asking about AI. Everyone wants to move fast.

But buying technology is not the same as making progress.

A powerful AI tool is still worthless if it isn't solving an actual problem for an actual person. The most advanced chatbot, copilot, or automation platform will fail if it gets bolted onto a broken process. That's the actual risk with AI right now. Making the same old mistake, only faster and at greater expense.

When talking to insurers, I often make a distinction between "design" and "Design with a capital D." When I talk about "Design," I'm not talking about colors, fonts, or pretty screens. Design is the research, the strategy, and the deliberate decision-making underneath every product and experience. It's understanding who a tool is for, what its purpose is, where the work breaks down, and how a solution earns its place in someone's day.

And here's the thing: Design is already happening, whether companies acknowledge it or not. Every agent portal, claims experience, policyholder app, and AI workflow is the result of a decision someone made. The real question is: where and with whom did the decision originate? With the person doing the work, or with an executive mandate, business requirement, vendor pitch, or short-term goal? Too often, the decisions made in insurance have little to do with the human beings they impact.

Agents Are Not the Barrier

In our recent report, The Connective Thread: From Agent and Broker Research to a New Design Vision for AI-Enabled Insurance Work, we spoke directly with agents and brokers about how they are using AI today, where they are finding value, and what is still getting in the way. What stood out was not the agents' resistance, but their resourcefulness.

Agents are already experimenting. They're drafting emails, summarizing policies, comparing quotes, prepping for meetings, and translating complex insurance language into something clients can actually understand. Some are quietly building workarounds because the official systems around them do not support how they actually work.

So the problem is not that agents do not want to use AI. It's that the tools too often do not map to the real friction in their work. The industry keeps talking about AI as an automation story. But when you talk to agents, what they want is integration.

They are not asking for another tab, login, or disconnected assistant. They're already moving between agency management systems, CRMs, email, spreadsheets, carrier portals, and rating tools. They're entering the same information over and over, hunting across systems for context and trying to track what changed, what a client needs, and what follow-up might fall through the cracks. That is not a single-task productivity problem. It is a workflow problem.

AI that helps write an email is useful. AI that understands the context behind the email, pulls from the right systems, shows where the information came from, flags what needs review, and keeps the human in control… that's something else entirely. That is where AI becomes connective tissue, instead of one more tool to add to the pile.

Design Around People, Not Around Replacing Them

For decades, the insurance industry has strived for ways to disintermediate agents. AI has only added fuel to that fire. There's a real temptation to see AI as a way to replace human labor, cut costs, and eliminate the messiness of human relationships.

But that framing misses where the value actually lives.

Sure, AI can create efficiencies. It can reduce administrative burden, help agents manage bigger books, and spend less time on repetitive work. But if your starting point is replacement, you'll miss the bigger opportunity to design tools that unlock capacity, judgment, and relationship-building.

The best agents are valuable because they know what matters. They understand their clients, and they understand risk. They can feel when something is off, and they know what to ask next. That's how they turn complexity into confidence. AI should be making more room for that work, not pushing it to the side.

This is where human-centered design stops being a nice-to-have and becomes a business necessity.

If you want agents to adopt AI, you have to understand how they actually work, not how leadership assumes they work. And that requires more than a survey. It means observing real workflows, listening for friction, and noticing the invisible work that quietly holds the system together. Research embedded in the design process points toward solutions.

Adoption Is the Whole Game

One of the biggest misconceptions about AI is that adoption is what happens after the rollout. It's not. Adoption is the whole game.

A tool is only successful if the people it is built for actually want to use it. People want tools that fit into their world, solve problems they recognize, and make their work meaningfully better in a way they can feel.

Insurance has a long history of underestimating this. The industry spends significant money on technology that never lands because it has never fully accounted for the human experience surrounding it. Then, when usage is low, the conclusion is often that people are "resistant to change."

Most of the time, that's the wrong diagnosis.

People are not resistant to change that helps them. They're resistant to tools that make their day harder, add complexity, create risk, ask them to trust outputs they cannot verify, or worse, are designed to replace them.

AI cannot simply generate confident answers. It has to earn trust. Agents need to see where information came from, verify recommendations, correct outputs, and approve what goes to a client. "Trust but verify" is not just a user preference here. It's a design requirement.

What Leaders Should Do Differently

If a carrier, brokerage, or insurtech CEO asked me where to start right now, I'd say this: Catch yourself before you jump to the solution.

The pressure to move fast is real, and speed does matter. But moving fast doesn't mean skipping the work that makes speed useful. Before you decide what AI feature to build or what vendor to buy, sit with these three questions:

• Who is this for?
• What problem are we solving?
• And what outcome are we actually after?

Then go talk to the people who'll use it. Watch how they work, find where the friction really lives, and let that learning shape the AI strategy before the roadmap hardens. A few focused weeks of research and design up front can save you months, or years, of expensive misalignment down the line.

The Opportunity Is Still Enormous

Despite the industry's habit of chasing tech before thinking about people, I remain optimistic. The opportunity to differentiate in insurance is astounding. The bar for better experiences is still too low.

AI can help agents spend less time searching and re-entering the same information. It can help newer employees get up to speed faster. It can preserve institutional knowledge, make complex decisions more transparent, and free up time for the things that actually build loyalty. Advice, empathy, and relationship-building.

But only if it is designed around people.

The companies that get this right understand that technology alone does not create transformation. People do. It comes down to whether they trust the tool enough—and find it valuable enough—to actually use it.

Insurance doesn't need more AI for the sake of AI. It needs AI that solves actual problems for the people doing the work, in the real flow of their day. That's the design challenge. And if the industry takes it seriously, it's also the clearest path to transformation.

Back in 2013, when Chunka Mui and I were doing some consulting work on innovation for the CEO of a top-five personal lines insurer, he was trying to rewire the compensation structure for his captive agents. He wanted to encourage them to focus more on growth and less on building a book of business and then servicing it ("coasting," in his words). 

He noted that he wasn't trying to cut the total dollars paid to agents. He just wanted to take two percentage points out of the base commission and pay the money out as incentives. 

"But every time I float the idea," he said, "the agents turn around and kick me in the crotch." (He used a more colorful word.)

Having kept an eye on the issue for more than a dozen years now, I believe that State Farm's announcement of a take-it-or-leave-it, incentive-driven compensation model for its 19,000 captive agents marks a turning point. Change always takes time, but I believe the captive agent business will be very different a few years from now.

Let's have a look. 

A smart piece by David Gritz of InsurTech NY provides the backdrop, showing how the industry has been deemphasizing the traditional captive model for years. Noting that the trend predates the generative AI explosion by many years, he writes:

• "June 2020: Nationwide ends its captive agent program.
• "November 2021: Liberty Mutual transitions captive agents to independent agencies.
• "January 2023: Allstate signals a reduction in captive distribution.
• "June 2026: State Farm reduces benefits and commissions for captive agents.

"Viewed individually, each decision can be explained by company-specific circumstances. Viewed together, they reveal something larger: carriers are increasingly questioning whether exclusive distribution remains the optimal model for growth."

Gritz also neatly summarizes what, for me, is the core change that is working against captive agents:

"Consumers can purchase insurance through direct channels, comparison platforms, embedded insurance experiences, independent agencies, affinity groups, digital marketplaces, MGAs, and increasingly AI-powered interfaces.

"Carriers want the flexibility to pursue all of these opportunities simultaneously. Exclusive distribution creates natural channel conflict when a carrier wants to experiment with new distribution strategies."

He gets into other reasons, too, but for me the key is that three decades of development of the internet, led by customer service pioneers such as Amazon, have conditioned us to expect to be able to see all our options, and instantly. We don't just look at what clothes Macy's or Nordstrom might offer us; we look at every seller. Even if we've settled on a brand or a specific item, we still look everywhere for the best prices — in seconds. 

In that sort of world, it just doesn't make sense for someone looking for insurance to walk into the office of the local State Farm agent, even if the agent is a smart and lovely person who sponsors the customer's daughter's soccer team. 

It's not clear how quickly the change away from captive agents will happen. A Silicon Valley truism is that you have to make sure you don't confuse a clear view with a short distance. And the reason for that adage is that so many people make that exact mistake all the time — including, well, me.

I predicted the end of car dealerships 25 years ago, because all you really need is a way to test drive a car. You can then order your choice straight from the manufacturer, get it in a couple of weeks, and not have billions of dollars of car inventory sitting on lots around the country, pushing up costs for everybody. But change has been so slow that we're only now starting to see the sorts of effects on dealers that I expected by 2005 or 2010.

Still, the transition away from captive agents is inevitable. Independent agents will keep growing — witness the interest in the HUB International IPO — while captive agents will have to fight a rear guard action. They will be under pressure from both ends. Their carrier employers will demand more growth and more flexibility to explore other distribution channels. Customers will press for lower prices while also insisting on more options.

And I think State Farm, as one of the last big holdouts relying on captive agents, has pushed the transition past the tipping point, so it should only accelerate from here.

Cheers,

Paul