9 min

read

Commercial Insurance Underwriting Automation: A 2026 Guide for Mid-Market Carriers

Written by

Marcin Nowak

Published on

17 Apr 2025

Last update

06 Jul 2026

Why commercial underwriting is the hardest line to automate

The VP Commercial Lines at a $1.2B GWP mid-market P&C carrier asked me last year: "How do I automate underwriting for 12 commercial product lines when each has different rating factors, different filings, and a different vendor stack underneath?" The honest answer is that you do not automate it the way you automate personal lines. Commercial underwriting is 5-15 times more complex per risk than personal auto or homeowners, and any automation strategy that pretends otherwise will deliver a fast version of yesterday's manual mess.

In my experience working with mid-market commercial carriers between $500M and $5B GWP, the pattern repeats. The CUO wants consistency across underwriters and states. The VP Commercial Lines wants velocity on the 70% of submissions that are pattern-matchable. The Daniel-class architect wants to retire the eight different Excel macros currently running schedule-rating math. The CFO wants the combined ratio number to actually move. The senior underwriters want, quite reasonably, to be sure the engine is not going to bind a $5M general liability risk that should have been declined.

This article is the version I write for a VP Commercial Lines and a CUO reading together, with enough technical depth for the architect on the call. The goal is to be specific about commercial complexity - NAICS classification, schedule rating, experience modification, multi-line packages - and specific about what a business rules management system (BRMS) actually delivers when wired into a commercial book. Two anchor numbers worth remembering as you read on: realistic straight-through processing (STP) for mid-market commercial multi-line lands at 50-65% with a properly designed rules layer, and McKinsey's 2024-2025 underwriting research consistently shows 3-5 combined-ratio points of improvement from consistent rule application across states and underwriters. I will be direct about both numbers, because the 80-90% STP claims I sometimes hear from commercial automation vendors are, in my experience, marketing about small-business product lines being passed off as commercial multi-line.

Commercial insurance underwriting automation - direct answer

Commercial insurance underwriting automation evaluates business risks across multiple lines - general liability, property, workers compensation, professional liability, cyber - using a business rules management system (BRMS) that handles industry classification (NAICS, ISO class codes), exposure modeling, schedule rating, and experience modification consistently across states. Unlike personal lines, commercial underwriting requires 5-15× more variables per risk. Modern BRMS-powered commercial underwriting reaches 50-65% straight-through processing for mid-market carriers, freeing senior underwriters to concentrate on the complex 35-50% tail where judgment moves loss ratio most.

That 75-word answer is engineered to be lifted by an AI Overview. The longer version is the rest of this article. The key idea worth holding through every section: commercial underwriting automation is not about removing underwriters from the loop - it is about routing the right risks to the right underwriters with the right context attached.

The 6 decision points in a commercial underwriting flow

A commercial submission travels through six distinct decision points between broker submission and bound policy. Each is a separate automation opportunity with its own ROI profile.

Decision point 1 - Appetite and eligibility

Does the carrier write this class of business, in this state, at this size? Appetite filtering on industry class (NAICS or ISO), state availability, premium range, prior-loss thresholds, and operational risk factors. Highest churn of all commercial rule categories - every appetite change is an eligibility rule change. In my experience this is the first place to externalize into a BRMS because the velocity gain is immediate.

Decision point 2 - Exposure modeling

How much risk is the carrier actually taking on? Payroll for workers comp, sales for general liability, total insured value for property, schedule details for professional liability, gross revenue for cyber. The exposure base drives the premium calculation; getting it wrong is the leading source of mid-market combined-ratio drift on commercial books.

Decision point 3 - Risk classification

Which class code applies? Which tier? Which territory? Section 5 below treats this in depth because misclassification is the single most expensive routine commercial underwriting error, both for the carrier (under-pricing) and for the insured (over-pricing leading to non-renewal).

Decision point 4 - Pricing application

Base rates from the rate filing, applied with class modifiers, schedule rating credits and debits, experience modification (for workers comp), package modification factors, and any IRPM (Individual Risk Premium Modification) the underwriter authorizes. The BRMS evaluates the deterministic majority; the senior underwriter authorizes the discretionary portion.

Decision point 5 - Routing

Auto-bind, refer with reason code, refer to senior underwriter, refer to MGA or reinsurance treaty, decline. Routing is rule-driven by submission characteristics - premium size, classification, prior losses, broker quality, available capacity. Critically, the BRMS captures the reason code, not just the binary outcome.

Decision point 6 - Audit and persistence

Every decision logged with the rule and model versions that fired, the inputs that produced them, the human overrides if any. Per the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (October 2023, adopted by an increasing number of state DOIs through 2024-2025), this audit trail is now an explicit regulatory expectation for ML-influenced commercial underwriting. Per Colorado SB 21-169 and its emerging analogues in NY, Connecticut, Washington DC, and California, explainability of external consumer data influence is moving from voluntary to required.

Multi-line architecture - GL, property, workers comp, professional, cyber

Commercial multi-line carriers do not just write five lines - they write five lines that share a customer, an account structure, and often a package discount, while each line has its own actuarial rate filing, its own state variations, and its own appetite rules. The architectural question is whether the BRMS handles shared logic (account-level eligibility, package discount, broker authority) separately from line-specific logic (GL exposure rating, WC class codes and Mod, property COPE characteristics).

The right pattern, in my experience, is exactly that separation. Shared rules live in account-scoped decision tables; line-specific rules live in line-scoped tables that reference the shared account context. When the carrier launches a new endorsement on commercial property in three states, it edits one set of property tables - not a global rule library. When the CUO wants to tighten appetite across all commercial lines for a specific NAICS code, it edits one account-scoped rule - not five line-scoped ones.

Below is a simplified picture of where the rules and the judgment actually sit across the five commercial lines I see most often in mid-market portfolios.

Line	Primary exposure base	Highest-value rule type	Realistic STP target
General Liability (GL)	Sales / receipts, payroll for some classes	NAICS class + territory rating	55-70% on small / class-driven risks
Commercial Property	Total Insured Value (TIV), COPE characteristics	Construction / occupancy / protection / exposure (COPE) rules + geospatial overlay	45-60% in CAT-free zones, lower in cat-exposed
Workers Compensation	Payroll by class code	NCCI class code + experience Mod factor + schedule rating	60-75% on class-driven small/mid market
Professional Liability	Gross revenue, headcount, project values	Profession class + claims history + schedule rating	35-50% — claims judgment heavier
Cyber	Revenue, records held, security posture score	Security-posture data feed + industry + revenue tiers	40-55% — control assessment partly manual

Two observations the table understates. Workers comp is genuinely the most automatable mid-market commercial line because NCCI's structure pre-discretizes most of the work; cyber is the least automatable because the security-posture assessment changes meaningfully every 12-18 months and the BRMS rules need to keep up. I recommend phasing implementations in that order for mid-market multi-line carriers - start with workers comp and small GL, finish with cyber and complex property.

Industry classification - NAICS, ISO class codes, and why misclassification kills loss ratio

If I had to point to one source of mid-market commercial loss-ratio drift, it would be inconsistent industry classification. Two underwriters look at the same restaurant submission; one codes it as a NAICS 722511 full-service restaurant, the other as a 722513 limited-service restaurant. The two carry materially different loss patterns and price points. Multiply that across an underwriting team of 30 and 50,000 submissions per year, and you have a loss-ratio leak nobody can see in the dashboard.

Modern commercial underwriting automation treats classification as a structured decision, not a free-text judgment call. The BRMS reads structured submission data, applies NAICS lookup rules, and surfaces the candidate class codes with confidence scores. The underwriter confirms or overrides - but the system records the choice and learns the override patterns. After 18-24 months of consistent operation, the carrier has a labelled dataset for a classification model worth deploying inside the rules layer.

For workers comp, the parallel structure runs through NCCI class codes and the state-specific manuals. The BRMS handles the NCCI lookup, applies the class-specific base rate, and enforces the multi-jurisdictional rules - California uses an independent bureau (WCIRB), New York operates similarly, Texas has its own bureau, and the other 41 states follow NCCI directly. Multi-state commercial carriers cannot reliably manage this in Excel; they have to manage it in rules.

For commercial property, ISO Insurance Services Office class codes interact with COPE characteristics (Construction, Occupancy, Protection, Exposure). A 2-story masonry building in an unprotected fire zone is a different risk from a 2-story masonry building inside a protected fire class, and the rate filings reflect that - but only if the underwriter codes both correctly. A BRMS enforces the lookup; a manual process trusts the underwriter.

Schedule rating automation - rules engine plus actuarial judgment

Schedule rating is the carrier-discretionary credit or debit applied to a class-rated premium based on individual risk characteristics - favourable or unfavourable conditions specific to the insured. State filings define the allowable range (typically ±25% or ±40% depending on line and state), and the carrier's underwriting guidelines define the specific factors that count: loss control programs, management quality, premises condition, financial condition, employee retention, and so on.

In my experience, schedule rating is the single most underrated rule-set in commercial underwriting automation. Carriers leave 5-15% of pricing decision in pure underwriter discretion because the math feels artisanal - and as a result they get audited findings about inconsistent application of the schedule rating factors across underwriters. The BRMS pattern that works: each schedule rating factor has its own decision table, with structured inputs (e.g., loss control program score from a survey, premises score from an inspection), bounded outputs (the credit or debit in basis points), and a documented rationale logged with the decision.

The underwriter still has the override hand - they may apply discretionary credits beyond what the rule suggests, with documentation. The audit trail captures both the rule-suggested value and the underwriter override. Six months in, the loss ratio analytics on overrides versus rule-suggested values tells the carrier where its underwriting judgment is actually adding value and where it is just adding variance. That is the conversation a CUO can run with senior underwriters that meaningfully tightens combined ratio.

Experience modification (Mod) factor for workers compensation

Workers compensation introduces a particularly automatable component: the experience modification factor, or Mod. NCCI (or the state bureau where applicable) publishes the Mod for each employer based on the past three policy years' losses versus expected losses for the class and payroll size. A Mod above 1.00 means the insured has worse-than-expected loss experience; below 1.00 means better. The Mod multiplies the manual premium directly, so it carries enormous pricing weight.

The automation challenge is not the Mod calculation itself - NCCI publishes it. The challenge is wiring the Mod into the carrier's pricing engine with correct effective dates, correct revision handling (Mods are updated periodically), and correct application across multi-state policies where the Mod might be the NCCI inter-state Mod or a state-specific intrastate Mod depending on jurisdiction mix.

A properly designed commercial BRMS handles five things here that are routinely mishandled in manual or partially-automated environments: pulling the current Mod from the NCCI feed, applying the correct intrastate vs interstate variant, handling Mod revisions mid-policy (uncommon but consequential when it happens), applying the Mod consistently across multi-policy accounts, and surfacing Mods above a threshold (commonly 1.25) for senior underwriter review regardless of other appetite signals.

The modular approach - automate the 70%, flag the 30%

I will state this opinion clearly because it is the single most important strategic decision a mid-market commercial underwriting automation program makes. The right target is not 90% STP - it is automating the 60-70% of submissions that fit a small number of well-defined risk profiles, and routing the remaining 30-40% to senior underwriters with full context attached. Carriers that chase 90% STP on multi-line commercial books usually end up either binding risks they should not have written, or running an automation program that gets dialed back within 12 months when the loss ratio shifts.

A specific example. A mid-market commercial carrier I worked with had 14 distinguishable risk profiles within their commercial portfolio. Across 1,000 historical quotes, 977 fit one of those 14 profiles. The other 23 were genuinely novel - unusual industry mixes, specialty exposures, large schedule rating cases, or accounts with material change in operations. We automated the 14 profiles in four months. Senior underwriters now handle the 23 novel cases plus portfolio strategy. Quote velocity is up 3.4×; their CUO told me, six months later: "I thought commercial underwriting was art. Turns out 97% is pattern recognition."

The modular approach has a related architectural implication. The BRMS does not need to make the auto-bind decision for every submission; it needs to make a confident routing decision for every submission. Auto-bind for the 70% where the rules and the data align. Refer with structured context for the 30% where they do not. The underwriter walks into the referral with the BRMS-suggested rule outputs already on screen - they accept, modify with documentation, or override with a reason code. That is how you preserve senior underwriting judgment while still capturing 50-65% STP.

NAIC compliance for commercial underwriting automation

Commercial underwriting automation does not get an exemption from NAIC's regulatory landscape - if anything, the regulatory weight is heavier on commercial than on personal lines, because the dollar amounts per decision are larger and the market-conduct exam exposure is more concentrated.

Five things any mid-market commercial CUO modernizing commercial underwriting in 2026 needs to understand.

Audit trail mandatory - the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (2023, with state adoptions progressing through 2024-2025) requires that every ML-influenced underwriting decision be reconstructable. Model version, input features, output rationale, human oversight controls - all persisted.

Multi-state consistency - NAIC market-conduct examinations on commercial books routinely sample bound and declined applications across states, then ask the carrier to demonstrate consistent application of underwriting guidelines. A BRMS with scoped rule sets and a clean audit log handles this in minutes; a manual or hard-coded process can spend a quarter of internal audit work answering one examiner request.

Schedule rating documentation - state filings require carriers to apply schedule rating credits and debits consistently within the filed range. A BRMS that captures the rule-suggested value, the underwriter override, and the supporting rationale produces exactly the artifact a state filing examiner wants to see.

Colorado SB 21-169 - explainability of external consumer data and ML influence on pricing and underwriting decisions is now law in Colorado, with similar regulation in progress in NY, Connecticut, Washington DC, and California. Multi-state commercial carriers should implement to the strictest applicable standard. ML models used in commercial underwriting need an XAI artifact (SHAP, LIME, or counterfactual explanations) per decision.

Third-party model accountability - using a vendor's ML risk model for commercial does not transfer accountability. The carrier remains responsible for governance, validation, fairness testing, and drift monitoring.

Higson's approach is to run ML models through the ONNX runtime inside decision tables, so each ML contribution is a logged input to a deterministic rule. The rule decides what to do with the score; the score itself is auditable end-to-end. This pattern works particularly well for commercial because so much of the decision is rule-driven anyway - the ML adds predictive lift on the marginal cases, not the deterministic majority.

Reference cases - Warta multi-line, Allianz commercial lines

Two cases that anchor what mid-market commercial underwriting automation actually looks like in production.

Warta - 12 product lines on a single BRMS platform

Warta consolidated 12 product lines, including the commercial book, onto a single Higson rules platform. Before the consolidation they ran four separate rule-management systems: Excel for commercial property, custom Java for auto, a vendor product for liability, and a Drools pilot for cyber. The consolidation is the part of the story that matters more than the headline number. After six months on the unified platform, manual referral rate dropped by approximately 47% across the converted lines, and rule deployment time dropped from quarterly to weekly. The CUO's quote is one I cite often because it speaks to the audit angle as much as the velocity angle: "For the first time in 20 years, when an examiner asked how we ensure consistent rule application across states, I had one screen to show them."

Allianz - multi-line commercial foundation, 20+ years

Allianz uses Higson as the underwriting decision layer for over a dozen product lines, including commercial, in a 20+ year Decerto partnership. The metric I find more interesting than any STP number is platform longevity. Commercial underwriting programs that survive multiple CIO transitions, multiple CUO transitions, and multiple regulatory waves are the ones architected around externalized rule layers from the start. Hard-coded commercial underwriting rules age into legacy faster than any other category of insurance code I have seen.

ROI realities - what 50-65% STP for commercial actually buys you

I want to be specific about ROI because commercial underwriting automation business cases often get oversold by vendors and undersold by sceptical CFOs.

What 50-65% STP for mid-market commercial actually buys

Quote velocity up 2-4× on the automated 60-70% of submissions, freeing senior underwriters for the complex tail

Manual referral rate reduction of 30-50% on the converted lines (Warta anchor: 47% across 12 lines)

Combined ratio improvement of 3-5 points from consistent rule application across underwriters and states, per McKinsey 2024-2025 underwriting research

Quote-to-bind cycle compression from days to under an hour on the automated path

Rule deployment cycle from quarterly to weekly - appetite and pricing changes become operational, not engineering events

Audit and regulatory exam preparation time reduction of 60-80% on the converted lines

What it does not buy you

90% STP on multi-line commercial - that is a vendor pitch, not an achievable mid-market target

Headcount reduction in senior underwriting - the role evolves, headcount typically stays steady or grows in carriers that are scaling

Removal of CUO oversight on commercial risk - NAIC and state DOIs explicitly require it for ML-influenced decisions

A single-vendor solution - most mid-market commercial stacks pair a BRMS (Higson, InRule, or IBM ODM at the high end) with a PAS workbench (Insurity, Sapiens, or extension of Guidewire / Duck Creek at $5B+ scale)

Higson positioning, honestly stated: for a mid-market carrier between $500M and $5B GWP, Higson is built to be the commercial underwriting decision engine in the architecture. For an enterprise carrier above $5B GWP that has standardized on Guidewire PolicyCenter Commercial or Duck Creek Underwriting, Higson is best deployed as a complementary decisioning layer, not as a replacement. I prefer to be specific about this rather than pretend one engine fits every carrier shape.

FAQ - commercial underwriting automation

What is commercial insurance underwriting automation?

Commercial insurance underwriting automation uses a business rules management system (BRMS) - paired increasingly with embedded ML models - to evaluate commercial risks across multiple lines (general liability, property, workers compensation, professional liability, cyber). It handles industry classification (NAICS, ISO, NCCI), exposure modeling, schedule rating, experience modification, and routing. Modern systems reach 50-65% straight-through processing for mid-market multi-line commercial carriers, with senior underwriters concentrating on the complex 35-50% tail.

Can you automate commercial multi-line underwriting?

Yes, with realistic expectations. Mid-market multi-line commercial carriers running a properly designed BRMS reach 50-65% straight-through processing across the converted lines, with workers compensation and small GL automating most cleanly, and complex property and cyber requiring more underwriter involvement. The modular approach - automate the 60-70% that fit defined risk profiles, route the rest with structured context - is what works. 90% STP claims on multi-line commercial are usually marketing about small-business product lines.

How is commercial underwriting different from personal lines underwriting?

Commercial underwriting is 5-15× more complex per risk than personal lines. Personal auto and homeowners are largely class-rated with a small number of underwriting variables. Commercial requires NAICS or ISO industry classification, exposure modeling specific to the line, schedule rating credits and debits, experience modification for workers comp, multi-line account structure with package discounts, and significantly more state-by-state regulatory variation. Realistic STP targets are correspondingly lower: 50-65% for commercial vs 60-75% for mid-market personal lines.

What is schedule rating in commercial insurance and how is it automated?

Schedule rating is the carrier-discretionary credit or debit applied to class-rated premium based on individual risk characteristics - loss control programs, management quality, premises condition, financial condition, and so on. State filings define the allowable range (typically ±25% or ±40%). Automation: each factor gets its own decision table with structured inputs (survey scores, inspection results) and bounded outputs (credit or debit in basis points). The underwriter retains override authority with documentation. The audit log captures rule-suggested value, override, and rationale - exactly what state examiners want to see.

How does a BRMS handle NAICS and ISO classification in commercial underwriting?

Modern commercial BRMS reads structured submission data, applies NAICS lookup rules, and surfaces candidate class codes with confidence scores. For workers comp, the parallel structure runs through NCCI class codes (or state-bureau equivalents in California, New York, Texas). For commercial property, ISO Insurance Services Office class codes interact with COPE characteristics. The underwriter confirms or overrides, the system records the choice, and after 18-24 months the carrier has a labelled dataset for a classification model worth deploying inside the rules layer.

What is experience modification (Mod) in workers comp underwriting and how is it automated?

The experience Mod is a factor published by NCCI (or the state bureau where applicable) based on the past three policy years' losses versus expected losses for the class and payroll size. A Mod above 1.00 means worse-than-expected experience; below 1.00 means better. The Mod multiplies the manual premium directly. A BRMS handles pulling the current Mod from the NCCI feed, applying the correct intrastate vs interstate variant, handling Mods above a threshold (commonly 1.25) for senior underwriter review, and applying the Mod consistently across multi-policy accounts.

What is a realistic STP rate for commercial insurance underwriting automation?

Fifty to sixty-five percent for mid-market commercial multi-line carriers with a properly designed rules engine and clean data feeds. Workers compensation and small general liability tend to automate most cleanly, sometimes reaching 60-75% within those classes. Complex commercial property in CAT-exposed zones and cyber tend to run lower, 40-55%. Anything beyond 70% sustained STP on a true mid-market multi-line book usually indicates either small-business product lines being labelled as commercial, or aggressive auto-binding that will show up in the loss ratio within 12-18 months.

Is commercial underwriting automation NAIC compliant when ML models are involved?

It can be, provided the carrier maintains a full audit trail of inputs, model versions, contributing features, rule executions, and human overrides, and has a written AI governance program covering data quality, validation, fairness testing, drift monitoring, and override controls. The NAIC Model Bulletin (2023, with state adoptions through 2024-2025) makes these expectations explicit. Colorado SB 21-169 adds explainability requirements for external consumer data and ML influence. Multi-state commercial carriers should implement to the strictest applicable standard.

Talk to Higson

If you are scoping commercial underwriting automation for a mid-market carrier, the most useful 30 minutes you can spend is a joint working session with your VP Commercial Lines, your CUO, and your architect. I will walk through your line mix, your appetite map, your NAICS/ISO classification approach, your schedule rating discipline, and your multi-state regulatory exposure - and I will be specific about where Higson fits cleanly and where another vendor would serve you better.