23 NYCRR 500 Says That Loss Run Stays In-House. In 2026 the Reader Can Sit in Your Server Closet.

Denise gets to the office at 7:15 because that is the only hour nobody calls. On her desk this Tuesday in October: a 38-page loss run the carrier finally emailed on Friday afternoon, the expiring declarations page for a 22-truck plumbing contractor, and a workers compensation payroll schedule broken across four class codes. The account has a 12/1 effective date, so the submission has to be in front of four markets by the end of next week. She will spend the morning moving numbers out of those three documents into the ACORD 125, 126 and 130 in Applied Epic, and she will get almost all of it right.

Every commercial lines agency in the country runs some version of that morning. And nearly every one of them has, in the last two years, looked at a document reader that could do the retyping in ninety seconds — then stopped cold, because the loss run carries claimant names and dates of injury, the payroll schedule carries Social Security numbers for the owner-officers, and the agency's written information security program says that file does not get handed to a vendor nobody vetted.

That is the specific thing that changed in 2026.

The 38-page loss run is the bottleneck, and it has a dollar figure

Take an eleven-person agency: a principal, three producers, two commercial account managers, three personal lines CSRs, a benefits person and a bookkeeper. Roughly 260 commercial renewals a year, plus 3,000 personal lines policies that mostly renew themselves through the download.

Abstracting a renewal file is not one job, it is six. Confirm limits, deductibles and endorsement forms off the expiring dec page. Order and read five years of loss runs. Rebuild the vehicle schedule from a fleet list the client sent as a phone photo. Rebuild the location schedule with construction, occupancy, protection and exposure detail. Update the experience modification worksheet. Then re-key all of it into the ACORDs.

On a clean small BOP that is 45 minutes. On a contractor with five years of claims, a fleet and a general contractor demanding specific additional insured forms, it is closer to three hours. Call the blended average 95 minutes. Multiply by 260 renewals and you have roughly 410 hours a year of an account manager typing things that already exist in a PDF — and almost all of it lands between the first week of October and the first week of January.

Why the cloud version got killed by your own security program

The reason your agency did not buy a document reader in 2024 was almost never the price. It was the answer to one question on the vendor form: where does the file go?

If you are licensed in New York, 23 NYCRR Part 500 applies to you as a producer, not just to the carriers, and section 500.11 requires a written third-party service provider security policy and real due diligence on anyone who touches nonpublic information. The NAIC Insurance Data Security Model Law, now on the books in roughly two dozen states, puts the same oversight duty and a 72-hour notice to the commissioner on the agency. Layer on the GLBA Safeguards Rule, the data protection language in your carrier agency agreements, and the cyber and E&O renewal application that asks you to list every outside party receiving customer information — and a two-hour time saving stops being worth the paperwork.

On-premises AI means the software that reads and writes your documents runs on hardware the agency owns and controls — the box in the server closet, or the account manager's own machine — so the client's Social Security number never travels to anyone else's computer. Nothing to disclose on the cyber application, nothing new in the third-party register, no data processing addendum to argue about with a vendor's legal department.

flowchart TD
  A["Carrier emails loss run to the renewals inbox"] --> B["Attached to the account in Applied Epic"]
  B --> C["Agency's own reader pulls claims, payroll and vehicles"]
  C --> D{"Anything unreadable or missing?"}
  D -->|Yes| E["Flagged for the account manager to key by hand"]
  D -->|No| F["ACORD 125, 126 and 130 drafted in the file"]
  E --> F
  F --> G["Account manager reviews, then releases to markets"]

What actually shipped in 2026 that made the back office viable

Two things, and neither of them is a chatbot.

The first is hardware. Qualcomm's Dragonwing-class processors, and the machines built around them, made local document work genuinely fast on a box that costs about what a decent copier costs. In 2024 the local option was a small model that garbled a scanned loss run and could only see a few pages at a time. In 2026 the same box takes the whole 38-page run in one pass.

The second is that large organisations stopped treating on-premises as the compromise choice. Cisco is rolling a personal AI agent out to roughly 90,000 employees with an explicit on-premises emphasis, for exactly the reason your compliance file cares about: control of the data and who sees it. When a company that size makes keeping-it-inside the default, the products get built for it and the small agency inherits the option — at roughly 90% less than sending the same volume out to a cloud service.

The same Tuesday morning, done the new way

7:15. Denise drops Friday's loss run into the account folder in Epic. The reader works through the 38 pages and writes back a claims summary by policy year: incurred, paid, open reserves, claim count, and the three claims carrying a reserve above $25,000 with a one-line description of each. It pulls the four class codes and payroll figures off the schedule and lays them next to last year's, flagging the two that moved more than 15%.

7:34. It has drafted the ACORD 125 and 126 from the expiring dec page, filled the ACORD 130 payroll grid, and marked eight fields it could not confirm — the FEIN it could not read on the fax, two VINs cut off in the client's photo, and the years of experience for a driver added mid-term.

7:50. Denise works the eight flags, which is the job she is actually paid for, and adds the narrative the underwriter will want on the open bodily injury claim — she was on the phone with the client's safety manager about it in March, and no document contains that conversation. By 8:40 the packet is with the producer for market selection. The file never left the building, and nothing new went on the cyber renewal application.

The arithmetic, with the assumptions written down

Illustrative numbers. Substitute your own renewal count and payroll.

The dollars are real but they are not the reason. The reason is that those 303 hours sit inside the October-to-January window, when your two commercial account managers are the constraint on how many accounts actually get shopped instead of rolled with the incumbent.

Where a licensed human still has to stand

The reader tells you the general liability limit on the expiring dec page. It does not know the general contractor's subcontract requires both CG 20 10 and CG 20 37, primary and non-contributory, with a waiver of subrogation, and that the expiring policy carries only the blanket additional insured form. That gap is a coverage judgment, it belongs to a licensed producer, and it is the single most common way agencies end up in an E&O claim.

It will also mis-total a loss run where the carrier restated reserves between valuation dates, and it cannot tell a genuinely closed claim from one closed and reopened. Your account manager still reads incurred against paid with her own eyes. Surplus lines filings, diligent effort affidavits and the signature on the application stay with a licensed person.

And be clear-eyed about what you just took on: the box is yours now. It needs patching, a backup, and somebody's cell number for the afternoon of December 28 when it stops responding in the middle of 1/1 season.

The Monday version of this is small. Pick one document type — loss runs, nothing else. Take 25 files you already abstracted this year, run them through, and compare against what your account manager actually typed. A missed reserve is a different problem from a garbled address. Then do the boring part before you expand: add the machine to your written information security program as an internal system, and tell your E&O and cyber carrier at renewal rather than after a claim.

Frequently asked questions

Do I have to tell my E&O carrier about this?

Tell them, in writing, at renewal. Most cyber and E&O applications now ask directly about use of artificial intelligence and about who receives customer information. Running on your own hardware makes both answers simpler, but a documented "we run this ourselves, and a licensed account manager reviews the output before it leaves the agency" is worth far more at claim time than silence.

Our agency management system is already cloud-hosted. Doesn't that make on-premises pointless?

No, and it is the sharpest version of the question. Your agency management vendor is one named party in a signed agreement with security obligations you already diligenced. Adding a second party that also touches loss runs and payroll schedules is a new disclosure, a new due diligence file and a new answer on the cyber application. Keeping the reader in-house means client data moves between your system of record and your own machine, and nowhere else.

How big does the agency need to be for this to be worth it?

Roughly the point where you abstract more than 150 commercial renewal files a year, or where one account manager spends more than a full day a week keying documents. Below that the hours saved will not carry the upkeep, and you are better off tightening how you order loss runs so they arrive earlier than Friday afternoon.

One last thing, on the other half of the agency. Document work is quiet; the front desk is not. Certificate requests, first notice of loss calls and the 4:50pm "can you add a vehicle before I pick it up tonight" arrive whether or not anyone is free. CallSphere builds AI voice and chat agents that answer the agency line and website chat around the clock, take the details, and book the callback with the right account manager — so the person abstracting a renewal file is not the same person being interrupted eleven times an hour. It is a hosted service, so it belongs in the same third-party review as anything else touching client information.