Insurance Regulation and Software Testing Evidence

None of these regimes prescribes a software testing method. Each expects something that software testing evidence can show: Solvency II and Solvency UK expect controlled change to critical systems, the Consumer Duty expects good customer outcomes to be delivered and monitored, IFRS 17 expects reliable data behind the numbers, and the NAIC AI bulletin expects AI systems to be validated and tested.

What Does Solvency II and Solvency UK Expect of Software Change?

Solvency II requires an effective system of governance, including clear allocation and segregation of responsibilities, internal control, risk management, outsourcing oversight and contingency planning. In the UK, the PRA’s restated rules took effect on 31 December 2024 (PRA PS15/24). Testing evidence shows that changes to critical systems are controlled.

What Does the Consumer Duty Expect of Software?

The Consumer Duty requires firms to deliver good outcomes across products and services, price and value, consumer understanding and consumer support, and to monitor and evidence those outcomes, with an annual board assessment. It has applied to open products since 31 July 2023 and to closed products since 31 July 2024 (FCA PRIN 2A). Software delivers most of those outcomes. See Consumer Duty and Software Testing.

What Does IFRS 17 Expect of Operational Data?

IFRS 17 measures groups of insurance contracts using data that originates in policy, claims, billing and reinsurance systems, and has applied to annual periods beginning on or after 1 January 2023. Actuarial and finance teams own measurement; testing evidence shows that the data reaching the engine is complete, accurate and correctly attributed after every operational change.

What Does the NAIC AI Model Bulletin Expect?

The NAIC Model Bulletin on the Use of AI Systems by Insurers, adopted on 4 December 2023, expects a written AI Systems Program covering governance, risk management and internal controls, internal audit and third-party AI, including validation, testing and retesting. Around half the states and the District of Columbia have adopted it or similar guidance (NAIC adoption map).

EU insurers within Solvency II scope also fall under DORA’s digital operational resilience testing requirements.

What Makes Testing Evidence Usable Across All Four Regimes?

The same five qualities serve every regime: completeness, traceability from source to result, independence of approval, reproducibility and timeliness. Evidence produced as testing happens, rather than assembled for an audit, meets all five. See Release Evidence for Insurers.

How Does Virtuoso QA Touchstone Produce This Evidence?

Touchstone, Virtuoso QA’s agentic QA platform, builds the evidence as the work happens. Requirements are drafted from the firm’s own documents and cite their source; a named person approves each one; tests run on a deterministic engine against identified builds; and changes are traced to the requirements they affect.

The chain from source document to result is available for every release.

• Traceability: each requirement cites the rule, policy or specification it came from.

• Independence: AI proposes and a named person approves; approval cannot be switched off.

• Reproducibility: the same test against the same build gives the same result.

• Timeliness: evidence exists before the go-live decision.

Touchstone does not make an insurer compliant with any regime. It provides tested, evidenced control over the software that implements the firm’s obligations.