

Stage | What Meridian holds | Produced by | Date | Describes the live system? |
|---|---|---|---|---|
Plan and design | Nothing. No record of the business problem, the success criteria, the options considered, or the decision to buy rather than build | |||
Collect and process data | Nothing from Meridian. The training data is the supplier's, drawn from mixed insurers, 2019 to 2022. Meridian asked in writing on 19 November 2025 whether Meridian claims were in that population and has had no answer | Supplier | 2019 to 2022 | Unknown |
Build and use model | The supplier's own test report, version 2 | Supplier | November 2022 | No. Measured at threshold 34. The live threshold is 41 |
Verify and validate | Model validation report VAL-CS-2025-02 | Meridian, Model Risk and Analytics | 6 November 2025 | Yes, at threshold 41 |

Stage | What Meridian holds | Produced by | Date | Describes the live system? |
|---|---|---|---|---|
Deploy | Go live approval pack GLP-CS-0423, four approvals | Meridian | May 2023 | Approves a system set at threshold 34 |
Operate and monitor | Three leakage reviews, May to July 2023. Then nothing. Threshold changed January 2025 with no impact assessment and no committee record | Meridian | 2023 and 2025 | Partly |
Retire | Not applicable. The system is live |
Two stages hold nothing at all: Plan and design, and the data stage. Those are the two stages that decide everything downstream, which is the argument week 5 makes.
Two more hold only the supplier's evidence, and the supplier's evidence describes a configuration Meridian stopped running in January 2025.
If you produced a map that shows this shape, you have the answer. The exact stage names matter far less.

Not in the sense that would survive a question.
Meridian can honestly say this: on 4,000 motor and home claims notified between July 2024 and June 2025, the model reached 81.0 per cent accuracy, 73.3 per cent precision and 78.1 per cent recall, measured in November 2025 at the live threshold.
Two sentences in the report's own test set description take most of the weight out of that.
The test set was not held back before the model was built. It was assembled in August 2025 from claims that had already settled. And the model has been evaluated against this set twice.
A test set loses its value the moment it stops being unseen.
It is the best evidence Meridian holds. It is not strong evidence, and the report is honest enough to say why.

Neither, until you know three things.
A system that recommended nothing at all would be right 62.2 per cent of the time. So the honest comparison is 81.0 against 62.2, not 81.0 against zero. It is a real gain and a smaller one than it looks.
Of 1,610 claims the model sent for settlement without inspection, 430 should not have gone. That is the number that describes what actually happens to people.
Different population, different test set, threshold 34. The validation report states this plainly and says it does not reconcile the two. The 94 per cent is nonetheless the figure that reached the Technology and Change Committee.
If you wrote only "accuracy is a poor metric", you had the instinct and not the argument. The base rate is what turns the instinct into something you can say out loud.

What it tells you. Claimants estimated as Black or Black British were recommended for fast-track settlement at 73% of the rate of the highest group, which is below the four-fifths convention.
The report's own analyst concluded the gap sits in the model rather than in the claims, because the base rates are close, 35.0% against 38.7%. That is a real finding, made by Meridian's own analyst, in a final report.
What it does not tell you. Why. And four things limit how far you can take it.
The group variable is estimated from surname and postcode, not declared. The report says misclassification would move the figures in a direction nobody can determine.
The image quality hypothesis was tested on a manual sample of 22 claims, and could not be tested properly because image capture metadata is kept for 90 days and the metadata for the test period no longer exists.
The effect of vehicle age could not be separated from the group estimate.
Two groups fall below the 150 minimum and their ratios should not be relied on.

The strongest finding in this section is not the ratio. It is the sentence after the hypothesis: The follow-up work was agreed with Claims Operations and has not been scheduled.
Meridian found something, could not explain it, agreed to find out, and did not. That is the sentence a regulator would read twice, and it is a sentence about governance rather than about statistics.

Yes, and it is the single most consequential thing in the pack.
The threshold moved from 34 to 41
on 22 January 2025, approved in an email whose subject line was a question about volume, on the stated basis that the leakage numbers were within tolerance. No impact assessment. No committee record. Never reviewed since.
The threshold is the dial that decides how many people have their claim settled without anybody looking at it.
Moving it up sends more claims down the automated path, which changes who the system acts on and who carries the cost of its errors. The model did not change. The system did.
Three things follow.
The supplier's performance evidence is measured at 34 and therefore does not describe what Meridian runs. The coverage grid says so, in its own accuracy row, in a cell nobody has acted on.
The 2023 go live approval was an approval of a different configuration.
And the change went through as a business decision rather than a change to an AI system, which means the governance process did not see it at all. If you want one sentence for a board paper, it is that one.

A blank row is not an absence of risk. It is an absence of evidence, and the two get read the same way by everybody who is not paying attention.
Reliability asks whether the system gives the same answer to the same claim twice. Nobody knows. The note against the grid says the supplier was asked on 19 November and did not answer.
That is not a blank at all, it is an open question with a date, and it should be recorded as one, with an owner and a review date, rather than as an empty cell.
The Safety row is worse and quieter. It is not blank. It was closed: "Agreed with Claims Ops that this property is not applicable to a claims triage system. No further work."
Deciding a property is out of scope is a governance decision, and this one was taken by the function that owns the system, in a conversation, with no rationale recorded.
Interpretability is blank too, with a note that the system produces no per-claim explanation, which is a finding rather than a gap in the paperwork.
If you spotted the Safety row, you read the grid the way it needs to be read.

A model answer at 148 words.
Record R-027 states that there is no automated decision making, on the basis that the output is a routing recommendation and a severity band. For most claims that is right. A band that routes a claim to a handler is a recommendation, and a person decides.
It does not hold for the fast-track path. Where the score falls below the threshold, the system recommends settlement without physical inspection, and the evidence in the validation report shows that recommendation is acted on: Its own ground truth description says that where a claim was fast-tracked and never inspected, the settled band is used. If nobody inspects and nobody reviews, the model has decided the outcome.
The record treats one system as having one answer. It has two paths and they need separate answers. I would ask for R-027 to be revisited on that basis.
What makes this answer work is that it does not say the record is wrong.
It says the record is not precise enough, names the path it is talking about, and cites the sentence in Meridian's own report that proves the point.
That is a conversation the Data Protection Office can have. "You have got Article 22 wrong" is not.

A model at 247 words.
I have been through everything we hold on Claimsight: The validation report, the threshold record, the coverage grid and the 2023 approval pack. Three things I would like your view on.
The threshold. Moving it from 34 to 41 was a reasonable commercial call and it is recorded in an email. Our supplier's performance evidence is measured at 34, so we currently hold no supplier evidence for the configuration we actually run. That is the gap anybody looking at this will find first, and it is easy to close.
The validation finding. The report found a selection rate ratio of 0.73 for one claimant group, below the four-fifths convention. Our analyst's view is that it reflects photograph quality rather than anything about claimants, and that may well be right. We cannot show it. The follow-up analysis was agreed and never scheduled, and the image metadata we would need is deleted after 90 days.
The 2023 approval. Two conditions were attached. Neither has evidence of completion. The post implementation review was scheduled for August 2023 and not held. The residual risk acceptance box is blank.
None of this says stop, and none of it says the system is doing harm. It says we are running a system we can no longer fully describe, at a moment when you are being asked whether it can do more.
Could I have forty-five minutes with you and Model Risk? I would like to agree three things: Schedule the follow-up analysis, extend image metadata retention so it is possible, and put a name in that blank box.

It opens with what was read, so she knows it is not an opinion. It calls the threshold change reasonable, because it was.
It puts the hardest finding second, where it is least likely to be read as an accusation. It separates "we cannot describe this" from "this is harming people", which is the distinction that keeps the conversation alive.
And it asks for forty-five minutes and three specific actions rather than a mandate.
It leads with the 0.73. It uses the word bias.
It implies she approved something she should not have. It asks her to pause the fast-track path.
Every one of those is defensible and every one of them ends the relationship you need for the next fifteen weeks.

Score yourself on each criterion. Be strict.
Score | Description | |||
|---|---|---|---|---|
Yes | Evidence is placed at the stage that produced it. The two empty stages are identified as empty. The supplier's evidence is marked as the supplier's, and as describing threshold 34 rather than the live configuration | |||
Nearly | The map is right but the threshold 34 point is not carried into it, so the supplier evidence is treated as current | |||
Not yet | Evidence is listed rather than placed, or the empty stages are left out because there was nothing to put in them | |||

Score | Description |
|---|---|
Yes | The base rate is used to size the accuracy figure. Precision is read as what happens to people. The test set's two weaknesses are identified. The adverse impact ratio is stated with its four limits and with the unscheduled follow-up named as the real finding. The threshold change is identified as a change to the system |
Nearly | Accuracy is challenged but without the base rate. The ratio is reported without its limits, or with the limits but without the unscheduled follow-up |
Not yet | Numbers are repeated rather than interrogated, or the supplier's 94 per cent is used alongside the 81.0 per cent as though they were comparable |

Score | Description | |
|---|---|---|
Yes | The privacy answer separates the two paths and cites the pack's own sentence. The note is within 250 words, gives the Claims Operations Director a route she can take, separates "cannot describe" from "causing harm", and asks for something proportionate to a post with no authority | |
Nearly | The privacy answer disagrees with the record but treats the system as one thing. Or the note is accurate and asks for more than the situation supports | |
Not yet | The privacy answer accepts the record because it is written down. Or the note delivers a verdict, uses the word bias without its limits, or asks her to stop the fast-track path |

Week 9 opens with a complaint about a Meridian system.
Week 11 risk classifies what you inventoried.
Week 13 assesses the suppliers, and the unanswered letter of 19 November is where that week starts.
Week 17 decides whether Claimsight is high risk under the European Union Artificial Intelligence Act, and the answer turns on a distinction you have not been taught yet.
Keep this work. You will be asked for it again.
Part Two Assessment: Model Answer and Rubric
Read this against what you submitted. The point is not the score. The point is the gap.