The insurance that requires a record

Consider how a factory actually came to install its first sprinkler system. The usual story credits conscience, or regulation, or the slow moral maturation of industry. The truer story is duller and more powerful: the fire insurer required it. The factory owner wanted coverage against the risk of burning down; the insurer, who would have to pay if it did, declined to write the policy at a tolerable price until the building met conditions the insurer specified. Sprinklers were one of them. The owner installed them not because he had been persuaded that safety was a virtue, but because the alternative was paying a premium that priced the danger honestly — or going uncovered and carrying the whole loss himself. The sprinkler was not bought from moral awakening. It was bought from an underwriter's terms.

This pattern, repeated across two centuries and a dozen industries, is one of the least appreciated engines of accountability in the modern world. It is worth looking at closely, because it is about to do its work again — this time on the machines that increasingly decide things about us, and on the records those machines do or do not keep.

The insurer as the accountability engine

Insurance looks, from the outside, like a business of pooling and paying claims. What it actually is, at its core, is a business of pricing risk — and a party that must price a risk in order to carry it acquires an interest no exhortation can match: it needs the risk to be both knowable and, wherever possible, smaller. Those two demands make the insurer, almost accidentally, one of history's most effective private setters of standards.

The fire insurers are the clearest case, but they are not alone. Marine insurers, underwriting cargo and hull across dangerous water, could not tell a seaworthy vessel from a floating hazard by inspection alone, so they leaned on classification — independent societies that surveyed ships, rated their condition, and published the result — and then priced coverage against the rating. A ship that would not be classed was a ship that could not be affordably insured, and a ship that could not be insured struggled to attract cargo. Seaworthiness became, in effect, a commercial requirement enforced through the price of coverage, long before it was fully a legal one. Workers' compensation did something similar to industrial safety: once an employer's premiums moved with its injury experience, the cost of a careless shop floor stopped being someone else's problem and started landing on the employer's own books, and safety practice improved in response to a price signal rather than a sermon.

In each case the mechanism is the same, and it is worth naming precisely. The insurer's self-interest — its need to price and reduce what it carries — becomes a de facto standard. That standard is enforced not by statute but by the two levers an insurer actually controls: the price of the policy and the availability of it. No inspector arrives with the force of law. The insurer simply says, in effect, on these terms, or on worse ones, or not at all, and the market rearranges itself around that sentence. It is private governance, and for long stretches of industrial history it moved faster and bit harder than the public kind.

You cannot insure a risk you cannot assess

Underneath all of it sits a single constraint the underwriter can never escape: you cannot price a risk you cannot assess. An insurer confronted with a hazard it has no way to evaluate does not price it generously; it prices it defensively — high, if it writes the policy at all — because uncertainty about a loss is itself a cost, and a rational underwriter charges for it. The way out, for the party seeking coverage, has always been to make the risk legible: to furnish the insurer with the conditions under which the danger can be measured, bounded, and, ideally, shown to have been reduced. Legibility is the precondition of affordable coverage. It always has been.

Now turn this toward machine decisions. A firm that automates consequential decisions — who is approved, who is flagged, who is offered what terms, who is turned away — is accumulating a new and unfamiliar species of liability. The errors are real, the class actions are foreseeable, the regulatory exposure grows by the quarter. Sooner or later such firms will want to insure against that liability, exactly as their predecessors insured against fire and shipwreck. And the insurer asked to carry it will run straight into the oldest constraint in the trade: it cannot price a risk it cannot assess.

What does it mean to assess the risk of an automated decision? It means being able to answer, for the decisions already made and the ones the system will keep making, whether they were sound — whether they followed the rules that governed them, rested on the evidence actually before them, and can be shown to have done so after the fact. A decision process that produces no examinable account of itself is, to an underwriter, precisely the floating hazard the marine insurer would not class: a source of loss with no surface on which to measure the danger. The insurer's response will be the one it has always given. It will require the conditions that make the risk knowable — and for decisions, those conditions are records: examinable, replayable, contestable accounts of what was decided and why.

The insurer asks the one question that cannot be answered with confidence — show me — and prices the silence of those who cannot.

The record becomes an underwriting requirement

This is where the family's earlier arguments about certification and warranty meet their sharper cousin. Certification is a voluntary signal: a firm chooses to submit to an audit and display the result. A warranty is a voluntary bet: a seller chooses to stand behind a decision and bear the cost if it fails. Both are real and both matter, but both are elective — a firm can decline them and simply forgo the signal. Insurance is different in kind, because for a great many enterprises coverage is not optional. Lenders require it, boards require it, counterparties require it, and in some domains the law requires it. When the thing you cannot operate without is a policy, the underwriter's conditions stop being advice and become the price of doing business at all.

So picture the conversation that is coming, and in some corners has already begun. Before the policy is written, the underwriter asks the firm deploying automated decisions a question that sounds simple and is not: can you show me your decisions were sound? The firm that can — that carries, for each consequential decision, a record of the evidence consulted, the rules in force at the time, and enough state to replay and contest the outcome — has handed the insurer exactly what it needs to assess the risk, and will be priced accordingly. The firm that cannot has handed the insurer only a claim about its own carefulness, unbacked, unfalsifiable, and therefore, to an underwriter, expensive. It will pay more, or accept narrower coverage, or find that at some level of exposure it cannot be covered at all.

That is the moment the record stops being a compliance nicety and becomes an economic instrument. A Decision Receipt — a record built to be examined, replayed, and argued with rather than merely filed — is not, in this frame, an ethical flourish. It is the artifact that makes an otherwise unpriceable risk priceable, and thereby the difference between a policy a firm can afford and one it cannot. The insurer, pursuing nothing more elevated than its own solvency, becomes the party that makes accountability pay. It converts the keeping of an account from a cost a rational actor is tempted to skip into a discount a rational actor is eager to earn.

This is why the insurance market may prove a more reliable force for accountable machine decisions than any amount of principle or advocacy. Exhortation asks firms to be good; regulation orders them to comply and then litigates the meaning of the order for a decade. The underwriter does neither. It simply prices the difference between a decision you can defend and one you cannot, and lets the price do the arguing — as it did with the sprinkler, the classed ship, and the safer factory floor. The record becomes mandatory not because a statute compels it but because coverage requires it, and coverage, unlike conscience, is something the firm has already decided it needs. When the insurer will not carry the silence, the account gets kept.

— Dispatches · Summit Cognitive