Insurance as Regulator

Frontier If the designation causes the loss reduction rather than marking the kind of owner who would have re-roofed anyway — which one storm’s cross-section cannot separate, and 7 says what would — then a two-page state bulletin bought a construction standard that a building code could not. Alabama requires every insurer writing wind coverage in the state to discount premiums for a privately owned construction standard it does not administer. The Alabama Department of Insurance reports the mandated range as 35 to 60 per cent off the hurricane portion of the premium and 20 to 35 per cent off the other-wind portion, phased in across Mobile and Baldwin counties in 2017 and the rest of the state on 1 January 2018.

Established The measured side of the ledger is a data call on 40,195 coastal Alabama wind policies struck by one hurricane. Of those, 7,417 carried an IBHS FORTIFIED designation. The study commissioned by the state insurance department reports loss frequency lower by 55 to 74 per cent, severity lower by 15 to 40 per cent and loss ratio lower by 51 to 72 per cent, with a counterfactual saving of USD 105.6 million to USD 116.1 million on one storm that generated 8,629 claims and USD 181.5 million of paid losses. Established Against that, the baseline the public instrument achieved: in the same year’s ranking of eighteen Atlantic and Gulf states on residential code adoption and enforcement, Alabama placed seventeenth.

Frontier The prize is a rule that pays for its own enforcement. A building code needs a legislature, an inspectorate and a general fund; a priced contract needs an actuary, a third-party evaluator at USD 300 to USD 500 per house, and a premium line the owner reads every year. By May 2026 the standard had passed 100,000 designations, more than half in the preceding three years, and in Alabama roughly 85 per cent of FORTIFIED roofs are reported to carry no public subsidy.

Speculative The gains are narrow and not evenly held. They accrue to owners of detached houses with insurable equity, in states whose regulators will mandate a discount, for wind. They do not reach renters, and they do not reach the 67 per cent of USD 6.9 trillion in global catastrophe losses between 1980 and 2024 that was uninsured. The same mechanism withdraws the policy when the price is held down: California’s insurer of last resort grew from USD 87.2 million of premium in 2018 to USD 1.4 billion in 2024. The condition on all of it sits in 5 — nobody has published the comparison that would show the standard, and not the owner, is doing the work.

Established The subject is the priced private contract acting as the binding rule-setter: not a statute, not a consensus standards committee, but an underwriter deciding what it will cover and at what price. Four levers do the work, and they are separable. The first is the price itself — a premium that varies with a verifiable property of the thing insured. The second is the underwriting condition: coverage granted only if a named control is present. The third is verification — inspection, survey, certification, a designation that somebody other than the owner attests. The fourth is the claim: exclusions, deductibles and sub-limits that move loss back onto the insured after the event.

Frontier Only the first three are regulation in any useful sense, and the sharpest critique of this whole field is that most of what insurers do is the fourth. Abraham and Schwarcz, writing in the Indiana Law Journal in 2022, draw the distinction that organises the rest of this brief: creating less loss than the insurance itself would otherwise have created “is not regulation or loss prevention. Rather, it is damage-control.” An insurer that claws back the moral hazard it introduced has got back to zero. Regulation means the world has fewer losses in it than if the insurer had never written the line.

Established Three institutional forms recur, and they behave differently. The engineering mutual prices from inspection rather than from claims history: FM Global descends from the Manufacturers Mutual Fire Insurance Company founded by the textile mill owner Zachariah Allen in 1835, and sets risk and premium “by engineering analysis as opposed to historically based actuarial calculations.” The bureau grades and publishes: the Insurance Services Office, wholly owned by Verisk Analytics since October 2009, holds more than 19 billion records and supplies the standardised policy text used across the United States property-casualty market. The third form is the one Alabama relies on: an insurer-funded laboratory writes a voluntary construction standard, independent evaluators certify houses against it, and the state then compels every insurer to price the certificate.

Established That laboratory is a physical fact, not a committee. The IBHS Research Center sits on 90 acres in Chester County, South Carolina; its test chamber is 145 feet by 145 feet and six storeys tall, driven by 105 fans of roughly six feet diameter with 350 horsepower engines, able to reproduce winds to 130 mph, with a hail cannon and a roof-aging farm alongside. More than 60 insurance companies and industry bodies were founding members, among them State Farm, Allstate, Liberty Mutual, Travelers and USAA. Frontier The standard that comes out of it is therefore an interested party’s standard, and the question of whether that matters is an empirical one rather than a rhetorical one.

Speculative The theoretical case for the form is Ostrom’s, not Hayek’s. Elinor Ostrom’s design principles for durable self-governing institutions ask for clearly defined boundaries, monitors who are accountable to the appropriators or are the appropriators, graduated sanctions, low-cost conflict resolution, external recognition of the right to organise, and nested enterprises. An insurer-funded standards body with third-party evaluators, a designation registry, premium credits that scale with the level achieved, and a state bulletin that recognises the whole arrangement is an unusually clean instance of that list. Handwave Whether a commercial insurance market is a common-pool resource at all, and whether the analogy survives the fact that the appropriators here are publicly traded carriers rather than villagers, is asserted more often than it is argued.

Established The anchor holds. Alabama Act 2015-313, carried as SB254, requires insurers to provide premium discounts, rate reductions or deductible adjustments for a valid FORTIFIED designation on wind coverage, and Department of Insurance Bulletin 2016-07 set the operative numbers. The reported ranges are 35 to 60 per cent off the hurricane portion and 20 to 35 per cent off the other-wind portion, effective in Mobile and Baldwin counties in 2017 and statewide on 1 January 2018. Frontier One widely circulated secondary description of the same rule gives it as “20 to 55 per cent off the wind portion”, a different shape entirely; the bulletin PDF itself would not open for this brief, so the discount schedule is reported here on two secondary sources that disagree, and a reader who needs the exact relativities should read the bulletin.

Established The loss study is real and unusually large for this literature. The Center for Risk and Insurance Research at the University of Alabama’s Culverhouse College of Business, directed by Lars Powell, was commissioned by the Alabama Department of Insurance to analyse Hurricane Sally, which made landfall at Gulf Shores, Alabama in September 2020. Eighty-six insurance companies, including non-admitted carriers, responded to a data call covering coastal Alabama. The resulting sample is 40,195 single-family owner-occupied wind policies: 25,093 conventional, 7,685 built to supplemental codes, and 7,417 FORTIFIED, split 1,705 FORTIFIED Roof and 5,712 FORTIFIED Gold. Those policies generated 8,629 claims totalling USD 181,466,480 paid, and USD 243,566,706 of total damage once deductibles are added, against roughly USD 17 billion of insured value.

Established The headline relativities are consistent across the three independent write-ups this brief could open. Loss frequency lower by at least 55 per cent and as much as 74 per cent; claim severity lower by 15 to 40 per cent; loss ratio lower by 51 to 72 per cent; deductibles paid by policyholders lower by more than 60 per cent. The aggregate counterfactuals are USD 105.6 million of insurer losses avoided had every home in Sally’s path met FORTIFIED Roof, and USD 116.1 million had every home met FORTIFIED Gold. One trade account of the same study renders severity as 14 to 40 per cent and the insurer saving as “up to USD 112 million” with almost USD 35 million of homeowner deductibles, and adds that FORTIFIED homes were about a quarter of the policies but only 9 per cent of the claims.

Frontier A fourth account of the same study reports different numbers altogether, and that is a finding. The advocacy organisation that promotes the standard in Alabama summarises it as “70 per cent fewer insurance claims” and a “22 per cent reduction in claim amounts” across 30,000 properties — a different frequency figure, a different severity figure and a different sample size from the 40,195 the study itself reports. Neither restatement is obviously wrong; both are being used to sell a policy. Frontier The primary report, Performance of IBHS FORTIFIED Home Construction in Hurricane Sally, is published by the Alabama Department of Insurance and could not be fetched for this brief, so the study’s identification strategy — whether it is a raw cohort comparison, a regression with controls, or something with a counterfactual in it — is not verified here, and no claim in this brief rests on it being causal.

Established Adoption is large, recent and concentrated. FORTIFIED passed 100,000 designations on 20 May 2026, with more than half of all designations earned in the preceding three years. Alabama leads the country: about 53,000 designated homes were reported in May 2025, against roughly 80,000 nationally across 32 states at the same date, and the state celebrated its 50,000th in September 2024. In February 2023 the comparable national figure was about 44,000 across 23 states and more than 440 cities. Eighty companies won volume awards for 2025 work — six of them for between 1,000 and 2,499 designations each — which is a contractor industry, not a pilot.

Established Public money is present but is not the main driver in the anchor state. Strengthen Alabama Homes disbursed about USD 86 million for 8,700 retrofits between 2015 and 2025, which is under one-sixth of the state’s designated stock; a case study of the programme reports that almost 85 per cent of FORTIFIED roofs in Alabama receive no public support. North Carolina runs grants through its coastal underwriting association across 18 counties. Louisiana’s Fortify Homes Program opened at noon on 2 October 2023 with USD 10,000 grants, about 3,000 of them funded, the first 1,500 reserved for policyholders of the state’s own insurer of last resort and 500 released in the first round, awarded first-come, first-served; Louisiana also legislated a mandatory premium discount for FORTIFIED roofs. Oklahoma ran a third pilot round of its own grant programme in 2025 and cited the Alabama loss study as its justification.

Established The most decisive fact in this brief is a ranking. IBHS’s Rating the States, fifth edition, 2024, scores eighteen Atlantic and Gulf states from 0 to 100 on residential code adoption, enforcement, training and contractor licensing. Virginia ranks first, Florida second, South Carolina third. Alabama — the national leader in FORTIFIED designations, the state with the mandate, the state with the loss study — ranks seventeenth of eighteen, ahead only of Delaware and behind Texas. Frontier The priced private contract is doing the most work in precisely the state where the public instrument does the least, which is either the strongest available evidence that insurance substitutes for regulation, or evidence that it is what a state reaches for when it will not legislate. The report itself carries a disclaimer that it is “not intended for use in insurance underwriting or rating, or for regulatory purposes.”

Established Alabama’s code story is a patchwork, which is the same finding from the other side. The voluntary Construction Code Supplement that aligns local codes with FORTIFIED has been adopted by Fairhope, Baldwin County, Mobile County and the City of Mobile, covering what its promoters put at nearly 70 per cent of coastal Alabama. After Hurricane Sally, Fairhope reported construction and demolition debris at about 3 per cent of total storm debris. Frontier That is a municipal aggregate with no control jurisdiction attached and it is reported by an interested party; it is suggestive and it is not evidence.

Established The historical record for insurance-as-regulator is stronger than the contemporary one. The Hartford Steam Boiler Inspection and Insurance Company was founded on 30 June 1866 out of the Polytechnic Club of Hartford, selling guaranteed inspection bundled with indemnity at a time when catastrophic boiler explosions in the United States were occurring roughly once every four days. Across a British series of 137 documented boiler explosions between 1815 and 1962, 122 fell in the nineteenth century and 15 in the twentieth. The American Society of Mechanical Engineers was formed in 1880 largely in response to calls for boiler safety, issued a Boiler Testing Code in 1884 and construction standards in 1915. Frontier Attributing that decline to insurance rather than to metallurgy, statutory inspection and the disappearance of the stationary steam plant is a causal claim nobody has identified.

Established Underwriters Laboratories is the cleanest case of an insurance body producing a standard that the state later adopted. William Henry Merrill signed its first test report on 24 March 1894 from a room in a Chicago fire insurance patrol station, with funding from the Chicago Fire Underwriters’ Association and the Western Insurance Union; its first published standard, in 1903, was for tin-clad fire doors. UL certification now carries regulatory weight through the OSHA Nationally Recognized Testing Laboratory programme. Established The ownership has since moved: UL reorganised on 26 June 2022 into a research institute, a standards non-profit and a for-profit testing arm, and UL Solutions listed in April 2024, raising about USD 950 million at roughly a USD 7 billion valuation. A private regulator that exits to public equity is a different institution from the one the insurers founded.

Established Marine classification is the oldest and largest working example, and it shows the failure mode. The Register Society of 1760 published its first register in 1764, grading hulls A, E, I, O, U and equipment G, M, B, which is where “A1” comes from; Bureau Veritas followed in 1828 at Antwerp. Twelve societies belong to the International Association of Classification Societies while more than 50 organisations worldwide claim to class ships, and flag states delegate statutory certification to them. Frontier That structure invites class-hopping to the most permissive society, and the litigation after the Prestige spill is described as an episode that could have radically changed the role of class societies; it did not.

Established The contemporary negative case is cyber, and it is unambiguous. Baker and Shortland, in the Geneva Papers in 2023, find that cyber insurers largely left security decisions to the insured, abandoned expensive security assessments when customers resisted them, and concentrated on post-incident response rather than on conditioning coverage. They report no evidence that insurance-based security governance reduced ransomware losses, and find that insurer-facilitated fast ransom payment encouraged further attacks, with demands rising from thousands of dollars in the early 2010s to millions by 2019 to 2021; Colonial Pipeline paid USD 4.4 million. Established Talesh, in the DePaul Law Review in 2017, reaches a matching verdict from qualitative fieldwork: cyber insurers do real loss prevention, directors-and-officers insurers do almost none and offer no discounts for specific prevention efforts, and employment-practices insurers reframe anti-discrimination law as litigation avoidance.

Established Where the price signal is allowed to run, it prices exit rather than mitigation. Boomhower, Fowlie, Gellman and Plantinga, in NBER working paper 32625 (June 2024, revised February 2025), find real California homeowners premiums up 23.3 per cent statewide between 2017 and 2022, insurer-initiated non-renewals running at 2 to 3 per cent before 2019 and accelerating afterwards in high-hazard zones, and customer-initiated switching stable at about 8 per cent despite very large premium dispersion. Across 636 rate-increase requests between 2008 and 2023 they find striking bunching at 6.9 per cent, the threshold that triggers a costly public hearing. Established They also measure the informational gap directly: one carrier’s one-kilometre-grid wildfire classification predicts losses with an R-squared of 0.82 against 0.16 for a competitor’s coarser scheme, and properties offered lower rates by the information-disadvantaged insurer carried roughly 50 per cent higher average annual losses.

Established The withdrawal numbers are the counter-case in its strongest form. California’s FAIR Plan, created in August 1968 by amendment to the state insurance code after insurers refused to write in minority neighbourhoods following the 1965 Watts riots, grew its policy count 276 per cent between 2018 and 2024, including 22.6 per cent in 2023 and 45.0 per cent in 2024; premium went from USD 87.2 million in 2018 to USD 1.4 billion in 2024, and ceded reinsurance premium from USD 8 million in 2018 to USD 169 million in 2023. By June 2025 it carried 610,179 policies and USD 650 billion of exposure, up 289 per cent since 2021, on USD 1.84 billion of written premium and no dwelling rate increase since 2023; by March 2026 the figures were about 663,000 policies and USD 700 billion, reaching USD 768 billion by June 2026. Established Excess and surplus lines took 4 per cent of California homeowners premium in 2023 against 0.4 per cent in 2013, and California supplied 23.5 per cent of national E&S homeowners premium against 4.6 per cent a decade earlier.

Established When the residual market pays, the assessment is the tax nobody voted for. After the January 2025 Palisades and Eaton fires the FAIR Plan levied a USD 1 billion assessment against roughly USD 4 billion of liability; under a July 2024 agreement member insurers may pass half of an assessment to customers as a surcharge and all of it above USD 2 billion, and the median homeowner surcharge worked out at about USD 28. The same fires drove the United States homeowners direct loss ratio to 102.1 per cent, the worst start to a year in five. Established Florida ran the same cycle earlier: its state-backed insurer held 711,000 policies in 1999, about 1.4 million in 2005, 419,000 by 2019, more than 1.3 million by June 2023 and fewer than 800,000 by 30 June 2025, with statutory rate caps of 12 per cent a year on homesteaded property against a 14.2 per cent indicated need in 2023.

Established Subsidised public rates demonstrably defeat the signal. The National Flood Insurance Program, created by the National Flood Insurance Act of 1968, tried to move to risk-based rates under the Biggert-Waters Act of 2012 and had grandfathering reinstated by the Homeowner Flood Insurance Affordability Act signed in March 2014. It owed USD 25 billion by August 2017, had USD 16 billion cancelled that October, and still owed USD 20.525 billion in December 2020; take-up in flood zones runs around 30 per cent. Established The Geneva Association’s 2026 review of fourteen public-private insurance programmes states the mechanism plainly: solidarity pricing “improves affordability and uptake but weakens risk-reduction incentives and market discipline”, and in the United States “the NFIP’s subsidised coverage supported renewed development in high-risk floodplains.”

Established The same review supplies the scale of what insurance does not reach. Natural catastrophes caused USD 6.9 trillion of property losses between 1980 and 2024 with about 67 per cent uninsured; 2024 alone ran USD 327 billion with 57 per cent uninsured. Its programme-by-programme findings cut both ways: Britain’s Flood Re took high-risk households from 8 per cent able to obtain multiple quotes to 99 per cent able to obtain fifteen or more; France’s CCR, holding about 90 per cent of the national catastrophe reinsurance market, met drought subsidence losses above EUR 1 billion a year from 2017 to 2020 and EUR 2.9 billion in 2022, forcing a 66 per cent surcharge increase in 2025; Australia’s cyclone reinsurance pool cut high-risk premiums by about a third and posted a 237 per cent loss ratio in its third year; Britain’s Pool Re accumulated GBP 7 billion and has passed more than GBP 2 billion to the Treasury without the state guarantee ever being called, while covering 4 per cent of small and medium enterprises. Frontier The review’s own summary judgement is that most such programmes operate as “passive shock absorbers rather than as part of a broader strategy to reduce risk.”

Established The public-code counterfactual is not hypothetical either. Hurricane Andrew in August 1992 bankrupted eleven insurers, generated more than 600,000 claims and left over 930,000 Florida policyholders without coverage, and post-storm inspection found concrete tiles glued to felt paper and shingles stapled across the long axis. Florida convened a codes study commission in 1996, established the Florida Building Code in 1998 and brought it into force statewide in 2002; a University of Florida study after the 2004 hurricanes found homes built under the new code sustained less damage on average than those built between 1994 and 2001. Frontier Florida now ranks second of eighteen on code adoption and still ran its insurance market into a state-backed insurer holding 1.3 million policies, which is the fact that stops anyone claiming codes alone solve this.

Frontier Is the FORTIFIED effect causal, and how much of the 55 to 74 per cent frequency gap is the owner rather than the roof? Abraham and Schwarcz put the objection in its sharpest form for exactly this kind of discount: an alarm-system credit “might not reduce the risk of loss, but instead simply signal that they are the type of homeowner who takes care.” A FORTIFIED designation is applied for, paid for and inspected at the owner’s initiative; the people who do that are also the people with newer roofs, more maintenance and better claim discipline. Nothing in a single-storm cross-section distinguishes the two.

Frontier Does a mandated discount change construction, or does it transfer rent? A discount an insurer is compelled to give is a price control on one cell of the rating plan. If the mandated credit exceeds the true loss relativity, the non-designated book subsidises the designated one and the carrier responds by raising base rates or writing less; if it falls short, the incentive is weaker than the headline percentage suggests. Speculative No published work this brief could find compares Alabama’s mandated credits against the loss relativities the state’s own study implies, which is a one-page calculation somebody should do.

Frontier Does the mechanism survive the peril changing from wind to fire? IBHS’s post-event investigation of the January 2025 Palisades and Eaton fires assessed more than 250 properties in the field between 13 and 19 January and drew on CAL FIRE damage inspections covering more than 30,000 structures. Homes with all four of a Class A roof, noncombustible siding, double-pane windows and enclosed eaves had a 54 per cent likelihood of avoiding damage, against 36 per cent where only one action had been taken; more than 25 per cent fuel coverage in the zero-to-five-foot zone pushed the probability of damage or destruction to nearly 90 per cent. Frontier These are observational figures from a conflagration that destroyed more than 16,000 structures, and a 54 per cent survival rate is a much weaker commercial proposition for an underwriter than a 55 to 74 per cent frequency reduction.

Frontier Does the standard degrade between events? A FORTIFIED roof is a construction state, not a behaviour, which is what makes it more promising than the persistence problem Abraham and Schwarcz identify in cyber, where settings adopted for a premium discount are reversed when inconvenient. But roofs age and designations lapse. Speculative Nobody has published a survival curve for designation status across a re-roofing cycle, and the programme is young enough that the data may not exist yet.

Frontier Where does the rule actually get set: the primary insurer, or the reinsurer? The California FAIR Plan’s ceded reinsurance premium rose twenty-fold between 2018 and 2023. If the binding constraint on what gets built is the price of catastrophe reinsurance rather than the primary contract, then “insurance as regulator” names the wrong actor. Speculative This brief found no study that decomposes a primary homeowners rate change into the reinsurance component and the rest for a jurisdiction where the rate is also regulated.

Established The binding bottleneck is not technological. It is that the data needed to test the claim sit inside insurers and are released only when a regulator compels them. The Alabama study exists because the state insurance department issued a data call and 86 carriers answered. That is the whole mechanism, and it has no standing equivalent: there is no continuous per-exposure wind loss series for designated and non-designated homes, in any state, that an outside researcher can obtain.

Established There is no public key joining a designation to a policy or a parcel. The FORTIFIED address lookup is behind a member login. Insurers hold policy identifiers, county assessors hold parcel identifiers, the standards body holds designation identifiers, and nothing reliably joins the three at scale. Frontier Every study in this field is therefore a bespoke record linkage exercise commissioned by whoever can compel the records, which is why the literature consists of programme evaluations rather than replications.

Frontier Per-property hazard is the second missing quantity. A difference-in-differences across a state line needs the storm to have hit both sides with a known intensity, which means a reconstructed wind field at property resolution, not a county average. Sally came ashore at Gulf Shores and the wind field decayed inland and eastward; without a gust reconstruction the treatment and control groups differ in exposure as well as in regime, and the estimate absorbs the difference.

Established Verification capacity is a real constraint with a price on it. A FORTIFIED evaluation costs the homeowner USD 300 to USD 500 in Louisiana’s programme, on top of the roof. The designation requires an independent evaluator documenting compliance as the work proceeds, which is a trained workforce that has to scale with the re-roofing cycle of an entire coast rather than with the grant programme. Frontier Eighty companies earned volume awards for 2025, six of them at 1,000 designations or more, so the capacity exists at the tens of thousands per year scale and has not been tested at hundreds of thousands.

Frontier Rate regulation caps what the price can say. The bunching of 636 California rate filings at 6.9 per cent is a direct measurement of a regulatory ceiling binding on the instrument this whole brief is about. A premium that cannot move cannot regulate, and the same constraint that protects affordability removes the signal.

Established Model validation is absent where it matters most. California’s 2024 Sustainable Insurance Strategy requires carriers to use catastrophe models that account for property-level and community-level mitigation, in exchange for writing in wildfire-distressed areas. Frontier A model that credits mitigation has to be validated against realised losses on mitigated properties, and the largest available test of that — the January 2025 fires — produced observational survival rates rather than a calibrated relativity.

Speculative The last bottleneck is that the standard is owned. FORTIFIED is the property of an insurer-funded institute; its technical documents, its evaluator network and its registry are all single-sourced. A public code can be forked by a legislature. A private standard whose adoption is mandated by statute is a monopoly the state has created and does not govern, and the resolution of that in the European harmonised-standards context took a court.

Established The first dependency is administrative, not scientific: a joint data call. Alabama’s department obtained 40,195 policy records for one storm. The decisive test in 7 needs the same records from Florida’s department for the same storms, matched on construction year, roof age, insured value and reconstructed gust. Both departments have the statutory power; neither has used it jointly.

Frontier A causal estimate of the designation effect is the scientific result everything else waits on. Until somebody separates the designation from the owner, every downstream claim — the mandated discount level, the grant programme’s benefit-cost ratio, the case for extending the mandate to other states — is resting on a cohort comparison. Frontier The IBHS and CoreLogic finding that modern building codes cut the post-hurricane spike in mortgage delinquency by 50 per cent has the same structure and the same gap, and is reported here from the institute’s own summary because the underlying paper would not open.

Established The wind-field reconstruction is a solved problem in the catastrophe modelling industry and an unsolved one in the public literature. Vendors produce property-resolution gust footprints for every landfalling hurricane; they are commercial products, and a published difference-in-differences using one is a licensing question before it is a statistical one.

Frontier The behavioural dependency is whether homeowners respond to premium signals at all. The California evidence is discouraging: customer-initiated switching held near 8 per cent despite very large premium dispersion, and telematics — the clearest case of a priced behavioural discount — reaches only about 6 per cent of United States drivers even though enrolled drivers measure roughly 30 per cent safer. Speculative A retrofit is a one-off capital decision rather than a continuous behaviour, so the elasticity may be entirely different; nobody has estimated it for FORTIFIED.

Frontier Finally, the literature needs a negative-result channel. The strongest work in this field is negative — Baker and Shortland on ransomware, Talesh on directors-and-officers and employment-practices cover, Abraham and Schwarcz on discounts generally — and it is all legal-academic rather than actuarial. The programme evaluations that produce the positive numbers are commissioned by the programmes.

Frontier The decisive experiment is a difference-in-differences across the Alabama-Florida line, using the mandate date as the treatment and a storm that crossed the border as the event. Alabama’s discount mandate took effect in Mobile and Baldwin counties in 2017 and statewide on 1 January 2018. Hurricane Sally came ashore at Gulf Shores in September 2020, and its wind field crossed into the Florida panhandle. The comparison is per-exposure wind loss on FORTIFIED-designated homes against matched non-designated homes struck by the same storm, with the Florida side as a contemporaneous control that had no mandate and a much stronger public code. Established The data exist: Alabama already pulled 40,195 policy records from 86 carriers for exactly this storm.

Frontier What it would settle that the existing study cannot. A cross-sectional comparison of designated and non-designated homes in one state after one storm confounds the standard with the owner. A border design adds two things: a pre-mandate period, so the designated cohort can be observed before the discount existed and the selection into it changed, and a jurisdiction that shares the storm but not the regime. If the designation gap persists on the Florida side where no mandate operates, the effect is the construction; if it collapses, it was the incentive selecting owners.

Established The matching variables are known and obtainable. Construction year, roof age and last re-roof date, insured value, occupancy, deductible structure, distance to coast, and a reconstructed gust at the parcel. The Alabama sample already stratifies into conventional, supplemental-code and FORTIFIED cohorts, and the FORTIFIED cohort already splits 1,705 Roof and 5,712 Gold, which supports a dose-response test: Gold should beat Roof by more than Roof beats conventional if the standard is doing the work.

Frontier The second-best design is an event study within Alabama around 1 January 2018. The statewide phase-in one year after the two coastal counties creates a staggered adoption with an internal control, and the outcome is designations per thousand dwellings and then per-exposure loss at the next storm. Speculative Its weakness is that the coastal counties are also where the hazard and the grant money are, so the treatment is confounded with everything else about the coast.

Established A cleaner randomisation already happened and nobody analysed it. Louisiana’s Fortify Homes Program opened applications at noon on 2 October 2023, awarded roughly 500 grants of USD 10,000 in the first round first-come, first-served, and reserved about 1,500 of roughly 3,000 total grants for policyholders of the state insurer of last resort. Frontier Arrival time within a self-selected applicant pool is close to random with respect to roof quality, which makes the funded-versus-unfunded applicant margin a regression-discontinuity estimate of the retrofit effect, free of the owner-type confound that dominates the Alabama cross-section. It needs the applicant list and subsequent claims, and both are held by one department.

Frontier The placebo that would expose a confound. Run the same comparison on non-wind perils — fire, theft, water damage from plumbing — on the same policies. A FORTIFIED roof should do nothing for those. If designated homes also show 55 per cent fewer kitchen fires, the estimate is measuring the owner and the whole edifice comes down.

Speculative The experiment nobody can run is the one that would settle the general claim. Whether insurance substitutes for regulation is a question about a counterfactual jurisdiction: the same coast, the same storms, a mandate and no code, or a code and no mandate. Alabama and Florida are the closest natural pairing available — seventeenth and second on code, mandate and no mandate — and they differ in litigation regime, residual-market design, rate regulation and hurricane climatology as well. Handwave Any single estimate from that pair will be reported as if it generalised to wildfire, flood and cyber, and it will not.

Established The cyber literature shows what the null looks like when somebody checks. Baker and Shortland looked for insurance-driven security governance in ransomware and reported finding none; the market was too competitive for underwriters to impose conditions, and the insurers ended up asking for government intervention instead of self-regulating through underwriting. That is the outcome a property-side study is capable of producing and has not yet been given the chance to produce.

Established The engineering that makes this work is unglamorous and already built. A full-scale wind chamber that can destroy a house on camera, a designation standard written against what the chamber shows, a third-party evaluator with a checklist and a camera, and a registry. The 105-fan array at 350 horsepower each reaching 130 mph is the reason the standard is not a committee’s opinion, and it is the single component this field could not have improvised.

Frontier What is missing is the data plumbing, and it is the same gap Standards as Governance identifies for conformity assessment generally: the certificate exists and the outcome data do not. A parcel-keyed, publicly queryable designation registry, a per-exposure loss reporting format that state departments could require in a standing data call rather than after a disaster, and a gust-footprint archive at property resolution would together turn every landfall into an experiment. None of the three is hard. None of the three has an owner.

Established The retrofit itself is a roof. Sealed roof deck, ring-shank nailing, edge detail, and at the higher levels opening protection and continuous load path. The capital cost lands on the homeowner at re-roofing, which is why the grant programmes cluster at USD 10,000 and why Alabama’s USD 86 million over ten years reached 8,700 houses against about 53,000 designated ones.

Frontier Scaling is a labour problem with a certification bottleneck. The standard’s promoters report training more than 6,000 people a year, which sustains tens of thousands of designations annually. Re-roofing an exposed coast on a twenty-year cycle is a different order of magnitude, and the constraint is evaluators rather than roofers. This is the same class of capacity constraint that binds building-code enforcement, and it is the reason the private route is not obviously cheaper at scale than the public one.

Established Product certification is the adjacent technology that already made this transition. Underwriters Laboratories began as an insurance-funded test house in 1894 and its for-profit testing arm is now listed, while its marks are referenced by OSHA; the trajectory from insurer instrument to public infrastructure to equity asset is the one FORTIFIED is a quarter of the way along.

Established Marine classification is the working full-scale version. Twelve societies in the international association, more than 50 organisations claiming to class ships, flag states delegating statutory certification, and the resulting incentive to shop for a permissive class. Anyone proposing to scale insurance-as-regulator should read the class-hopping literature first.

Frontier Cyber is the adjacent case that failed, and it failed for a reason that transfers. The market was competitive enough that no underwriter could impose conditions without losing the account. Wind mitigation escapes this only because a state compelled every carrier to price the same certificate at once, which is a regulatory act, not a market one. Speculative That is the strongest available argument that the private contract is not self-sustaining as a rule-setter.

Established Engineering mutuals are the form that never needed a mandate. FM Global prices from inspection rather than claims history, reported USD 26 billion of policyholder surplus in 2024 with USD 1.4 billion returned as membership credits, and claims a USD 1.1 trillion reduction in total loss expectancy across its client base (the insurer’s own figure, on its own definition of loss expectancy). It works because commercial policyholders are few, large, inspectable and repeat buyers — none of which is true of a housing market.

Frontier Adjacent on this map: Infrastructure Resilience, Wildfire Systems, Coastal Defense Systems, Climate Adaptation Finance and Future Housing Systems. The financing brief owns the capital stack; this one owns the contract that decides what gets built.

Established The institution that makes the mechanism binding is a state insurance department, and the instrument is a bulletin. Alabama’s mandate is an act of the legislature implemented by a departmental bulletin; Louisiana’s is a statute; the discount is not a market outcome in either state. The private contract governs because a public regulator ordered every carrier to write it the same way, which is the opposite of the story usually told about this mechanism.

Established Rate regulation is the other institutional fact and it cuts against the mechanism. California’s Proposition 103, passed in 1988, imposed a rollback of at least 20 per cent and a prior-approval regime with an intervenor process that reimburses participants who make a substantial contribution. The measured consequence is 636 filings bunching at the 6.9 per cent hearing threshold. Frontier The 2024 Sustainable Insurance Strategy trades faster review and catastrophe-model use for commitments to write in distressed areas; by late 2025 five carriers had filed identical 6.9 per cent requests and one had been granted a 17 per cent emergency increase, with review times falling to about 120 days against a 60-day target.

Established The insurer of last resort is the institution that absorbs the mechanism’s failure and then transmits it back as a levy. A residual market that cannot raise rates grows until an assessment falls on the whole market, and half of that assessment may be surcharged to policyholders who never bought the policy. That is a tax with no appropriation, and it is the principal way the cost of unpriced risk reaches households that made no decision about it.

Frontier The standards body’s own governance is the unexamined institution. IBHS is funded by the carriers whose losses its standard reduces, which aligns incentives precisely and also means the body that writes the rule, runs the laboratory that validates it, accredits the evaluators who certify compliance and holds the registry is one organisation with one funder class. Its own state-ranking report carries a disclaimer against use in underwriting or for regulatory purposes, which is a candid acknowledgement that a measurement produced for advocacy is not a measurement produced for pricing.

Speculative What is missing institutionally is an appeal. A denied building permit has an administrative remedy. A refused designation, a lapsed evaluation or an insurer declining to honour the mandated credit has whatever the department’s complaint process provides. Handwave Ostrom’s sixth design principle asks for rapid access to low-cost local arenas for conflict resolution, and nobody has mapped whether this arrangement has one.

Established The residual-market mechanism was invented as a civil-rights remedy and is now a climate subsidy. California’s FAIR Plan was created in August 1968 after insurers refused to write in minority neighbourhoods following the 1965 Watts riots. It now carries USD 768 billion of exposure, with 14 per cent of its policies in urban lower-fire-risk zones representing 28 per cent of its exposure. The instrument built to stop redlining is the instrument now absorbing the withdrawal from the wildland-urban interface.

Frontier A mandated discount is a cross-subsidy and the direction of it is not obvious. If the credit is actuarially generous, non-designated households — disproportionately those who cannot fund a roof — pay for the designated ones. If it is stingy, the mandate is theatre. Either way a rate mandate redistributes within the book, and no published analysis this brief could find states which way Alabama’s runs.

Established Grant programmes are the equity instrument and they are small and rationed. Alabama moved about USD 86 million in ten years to 8,700 houses; Louisiana funded roughly 3,000 grants and released 500 at noon on a Monday, first-come, first-served. Rationing by arrival time on a web form selects for broadband, free time and advance notice. Frontier That it also produces a usable natural experiment, as 7 argues, does not make it a fair allocation rule.

Established The protection gap is the ethical fact that dwarfs the mechanism. Sixty-seven per cent of USD 6.9 trillion in catastrophe losses from 1980 to 2024 was uninsured, and 57 per cent of 2024’s USD 327 billion. A regulator whose only instrument is a premium has no purchase at all on the majority of the loss, and the households in that majority are not the ones buying FORTIFIED roofs.

Frontier Risk-based pricing has a distributional argument on both sides and it is genuinely unresolved. Weill and Gourevitch, in Nature Climate Change in February 2026, frame the trade-off as regulatory: risk-reflective pricing can drive protective adaptation but “may cause a range of negative unintended consequences associated with declines in coverage.” The Geneva Association’s finding that solidarity pricing in France, New Zealand and Britain sustained property values and population growth in hazardous zones is the same trade-off measured from the other end.

Frontier Where insurance genuinely becomes the regulator, the binding decision about where people live stops being made by a planning authority and starts being made by an underwriting committee. A refusal to quote is a land-use decision with no hearing, no appeal and no map. California’s admitted market shed policies across all risk categories after the 2017 and 2018 fire seasons, and the residual market absorbed 610,179 of them by mid-2025; nobody voted for that boundary and nobody published it.

Frontier Uninsurability propagates through the mortgage before it propagates through the household. Lenders require coverage; where coverage is unavailable or capped — California’s residual policies are limited to USD 3 million, about four times the state’s median home value — the financing market closes before the housing market does. Speculative The IBHS and CoreLogic result that code compliance halves the post-hurricane delinquency spike is the only published quantification of that channel this brief could locate, and it is the programme’s own summary of it.

Established The fiscal endpoint is a sovereign balance sheet. The United States flood programme owed USD 20.525 billion in December 2020 after USD 16 billion was cancelled in 2017; France’s reinsurer met EUR 2.9 billion of drought subsidence in 2022 and raised its surcharge 66 per cent in 2025. When the private contract stops setting the rule, the public balance sheet does, and it does so without having priced the risk.

Speculative The optimistic reading is that a priced rule adapts faster than a legislated one. A code cycle runs three to six years and requires a legislature; a rating plan can change in a filing. Alabama went from statute to operative discount schedule in about two years and from there to more than 50,000 designated homes in under a decade. Handwave Whether that speed is an advantage depends entirely on the price being right, and the evidence that it is right is the evidence 7 says has not been gathered.

Frontier The pessimistic reading is that the mechanism works best where it is least needed. Engineering mutuals govern large commercial clients well. Classification societies govern ships well enough to be delegated statutory authority. Both operate on small populations of high-value, inspectable, repeat-purchasing assets. Housing is none of those things, and the one housing programme with a measured result required a statute to make every carrier price it.

These horizons track regulatory instruments, data releases and adoption counts rather than technology, because the hardware in this field — a wind chamber and a checklist — already exists:

• 10 yr: Frontier Either a border difference-in-differences or a grant-lottery discontinuity is published and the designation effect is separated from owner selection, or the field continues to cite one commissioned single-storm cross-section. Frontier The number of states mandating a mitigation discount either passes the handful that have one or stalls where it is. Frontier California’s wildfire mitigation credits are tested against realised losses from a second major conflagration, which is the first out-of-sample check the models will get. Speculative A designation survival curve across a re-roofing cycle becomes computable for the first time.
• 25 yr: Speculative Either the residual markets shrink because mitigation changed the loss distribution, or they become the permanent primary market in the exposed zones and the assessment becomes a standing levy. Speculative Parcel-keyed designation registries either become public infrastructure, as the Standards as Governance brief describes for harmonised standards, or remain member-gated and the literature stays unreplicable.
• 50 yr: Speculative The mechanism either generalises past wind — to fire, to flood, to heat — or is remembered as a wind-specific artefact of one peril whose damage function happened to be dominated by one component of one building. Handwave A jurisdiction somewhere abolishes its residential building code in favour of an insurance requirement, and the natural experiment this brief asks for finally runs by accident.
• 100 / 250+ yr: Handwave Whether priced contracts or legislated codes set construction rules at that horizon depends on whether insurable risk still exists at the relevant scale, and the honest position is that nobody has a method for that question. Handwave The 250-year claim available in this field is that catastrophe pricing becomes the principal allocator of human settlement; it is an assertion, and it is made mostly by people who sell catastrophe models.

• Depends on Standards as Governance for the machinery by which a private specification acquires legal force, which is the step this brief takes for granted and that brief examines; Infrastructure Resilience for the engineering performance the contract is pricing; and Climate Adaptation Finance for the capital that pays for retrofits the premium credit alone will not fund. No scientific result on this map blocks insurance-as-regulator. Its blockers are a data call and a research design, which is why it sits in this category.
• Requires (not on this map) Six constraints, one of them a scientific result and five of them decisions. A joint Alabama-Florida policy-level wind loss data call is the single cheapest missing thing in this brief: both departments already have the power, Alabama has already used it once for 40,195 records, and nobody has used it across the line. A causal estimate of the designation effect separated from owner selection is the result nobody is producing, and every downstream number depends on it. A mandated mitigation discount sized from measured loss relativities would replace a bulletin’s range of 35 to 60 per cent with a number derived from losses rather than from negotiation. A parcel-keyed public designation registry readable by lenders and insurers is the record-linkage layer whose absence makes every study in this field bespoke. A third-party evaluator workforce at re-roofing-cycle scale is an industrial-capacity question that a statute cannot legislate into being, and it is the same bottleneck that limits public code enforcement. A residual-market pricing rule that does not underprice what it absorbs is the decision every affected state has so far declined to take, and it is why the assessment exists.
• Enables Priced retreat from the most exposed zones, mortgage underwriting that can distinguish a hardened house from a conventional one, and grant programmes with a benefit-cost ratio that is measured rather than assumed. No typed enabling edge is claimed, because each of those waits on the causal estimate above rather than on anything produced here.
• Adjacent Wildfire Systems, Coastal Defense Systems, Compound Climate Hazards, Future Housing Systems, Climate Migration Planning, Future Legal Systems, Institutional Design, AI-Cyber Convergence; and off the map, actuarial science, marine classification and the law of insurance rate regulation.

Frontier “Insurance can replace building codes.” This is the claim the brief exists to test, and the honest answer is that one state has run the experiment halfway. Alabama has the mandate, the standard, the loss study and the leading designation count, and ranks seventeenth of eighteen coastal states on code adoption and enforcement. That is the best evidence available for substitution. It is also consistent with a state reaching for a private instrument because it will not pass a public one, and with an outcome that has reached 100,000 houses nationally, more than half of them since 2023 — against more than 16,000 structures destroyed by two California fires in a single week.

Established “The Alabama data prove FORTIFIED works.” They prove that designated homes in Sally’s path had 55 to 74 per cent lower loss frequency and 15 to 40 per cent lower severity than non-designated ones. Whether the designation caused that is a separate question that the design cannot answer, and the selection objection is not hypothetical: it is the specific mechanism Abraham and Schwarcz identify for mitigation discounts generally.

Frontier “Mandating a discount is a market mechanism.” A statute compelling every insurer to reduce a premium by a specified range is a price control on a rating cell. It may be a good one; it is not the market discovering a relativity. The distinction matters because the same jurisdictions that mandate mitigation discounts also cap rate increases, and the second is universally described as interference while the first is described as an incentive.

Established “Cyber insurance is quietly making the internet safer.” The best available study looked and found nothing. Baker and Shortland report that insurers left security to the insured, dropped intrusive assessments under competitive pressure, and that insurer-facilitated ransom payment encouraged further attacks; they found no evidence that insurance-based security governance reduced ransomware losses. Talesh reaches the same conclusion for directors-and-officers and employment-practices cover.

Frontier “Insurers priced climate risk correctly and regulators blocked them.” Partly true and incomplete. The bunching of 636 California filings at 6.9 per cent is direct evidence of a binding regulatory ceiling. But the same research finds that carriers differ enormously in how well they price the risk at all — an R-squared of 0.82 against 0.16 for wildfire loss prediction — and that the weaker classifier was systematically adversely selected, with about 50 per cent higher losses on the policies it won. Some of the withdrawal is regulation and some of it is carriers who cannot tell which houses burn.

Established “FAIR plans and state insurers are a market failure.” They are statutory creations with statutory pricing constraints. California’s was established in 1968 by amendment to the insurance code; Florida’s descends from entities the legislature created after Hurricane Andrew. Their growth is a policy outcome, not a spontaneous one, and the assessment that follows — USD 1 billion after the January 2025 fires, half of it surchargeable to policyholders — is the designed mechanism working as designed.

Frontier “The programme is publicly funded, so the private-ordering claim is bogus.” Not in the anchor state. Strengthen Alabama Homes reached 8,700 houses with USD 86 million while about 53,000 carry designations, and a case study of the programme puts the share of Alabama FORTIFIED roofs with no public support at almost 85 per cent. In Louisiana the ratio runs the other way, with the programme built around grants to policyholders of the state insurer.

Speculative “If insurers just charged risk-based prices, adaptation would follow.” The published evidence on whether price signals change household behaviour is weak and mostly negative. California customers switched insurers at about 8 per cent a year through very large premium dispersion; telematics, the clearest priced behavioural discount in any consumer line, reaches about 6 per cent of United States drivers. A retrofit is a different kind of decision from a driving habit, which is why the elasticity question in 6 is open rather than settled in either direction.

Frontier “Private standards bodies are unaccountable, so this is illegitimate.” The steelman on the other side is real: the body is funded by the parties who pay the losses, its standard is validated in a full-scale wind chamber rather than negotiated, and its monitors are third parties accountable to the funders — which is Ostrom’s fourth design principle almost verbatim. The honest criticism is narrower and harder to answer: one organisation writes the rule, runs the laboratory, accredits the evaluators and holds the registry, and a state has made its certificate compulsory to price.

Handwave “This generalises.” Nothing in the record supports it. The one measured success is a single peril, a single building component, a single state and a single storm, with a mandate behind it. The adjacent attempts — cyber, directors-and-officers, employment practices — produced nulls or perverse outcomes, and the two working large-scale cases, engineering mutuals and marine classification, both operate on small populations of inspectable commercial assets. Anyone extending the Alabama result to artificial intelligence, biosecurity or flood is asserting, not inferring.