Risk management rarely looks the same from one state to another. Differences in workers’ compensation laws, workforce demographics, industry mix, weather, operating conditions, and claim costs can all affect an organization’s exposure.
For organizations operating across multiple states, these differences create a challenge: How do you identify meaningful patterns across your entire organization without overlooking the local factors that influence risk?
A risk management information system (RMIS) can help bring claims, incidents, safety information, and other risk data together. Artificial intelligence (AI) adds another layer of potential value by helping users identify patterns, flag unusual activity, and investigate emerging trends.
But more data and more sophisticated technology do not automatically lead to better decisions. The quality of the information, the context surrounding it, and the ability to validate what the system identifies are just as important as the technology itself.
Why State-Specific Risk Matters
A multi-state organization cannot assume that the same risk factors affect every location equally. Even when locations share policies and procedures, their operating environments may differ significantly.
Consider several examples of exposures an organization might evaluate:
| State | Examples of exposures to evaluate |
| California | Heat exposure, wildfire-related conditions, earthquakes, and the effects of operating across diverse industries and geographic regions |
| Illinois | Winter weather, transportation-related exposures, and risks associated with urban operations and varied industry types |
| Ohio | Manufacturing and industrial operations, material handling, and machinery-related injuries |
| Texas | Extreme heat, severe weather, large geographic service areas, and risks associated with outdoor work |
These examples are starting points for investigation, not rankings of the states by risk. Actual exposure depends on the organization’s industry, workforce, locations, operations, and claims history. Public entities, for example, may face very different risks depending on whether they operate public works departments, transit systems, schools, utilities, emergency services, or public facilities.
The goal is not to assume that a particular state is inherently more dangerous. It is to understand which factors may influence an organization’s risk and determine whether the available data supports that conclusion.
What the Data Can—and Cannot—Tell You
The U.S. Bureau of Labor Statistics (BLS) provides state-level information on workplace injuries and illnesses. Its 2024 data for private industry reported the following total recordable case rates per 100 full-time workers:
- California: 2.9
- Illinois: 2.2
- Ohio: 2.0
- Texas: 1.7
Source: BLS — Rate of Total Recordable Cases by State.
These figures offer one useful point of comparison, but they require context. They represent private-industry rates, not a comprehensive measure of risk across public entities and every type of organization. They also do not explain why rates differ among states or establish that one state is safer than another in every circumstance.
A lower injury frequency does not necessarily mean lower overall financial exposure. A location with fewer claims may still experience severe, costly incidents. Conversely, a location with more frequent but less severe injuries may have a different pattern of loss.
For risk managers, this distinction matters. Frequency, severity, claim cost, and the nature of the underlying exposure should be evaluated together—not treated as interchangeable measures of risk.
The Regulatory Landscape Adds Another Layer
State-specific risk is not limited to physical conditions or injury rates. Workers’ compensation requirements and other regulatory developments can also affect how organizations manage claims, benefits, reporting, and workplace policies.
The National Council on Compensation Insurance (NCCI) tracks legislative and regulatory developments that may affect the workers’ compensation system. Its 2026 Legislative and Regulatory Trends Report examines topics including worker classification, portable benefits, mental injury legislation, and other emerging issues.
For organizations operating in multiple states, monitoring these developments can help identify issues that warrant further review. However, a legislative update is not the same as an assessment of an organization’s specific legal obligations. Risk managers should confirm applicable requirements with qualified legal, compliance, and insurance professionals.
An effective RMIS should help an organization organize relevant information and identify where additional attention may be needed. It should not replace the professional judgment required to interpret regulations or determine how they apply to a particular operation.
Where AI Can Help Risk Managers
AI can make large amounts of risk information easier to analyze. When used appropriately, it can help teams explore patterns that might be difficult to spot through manual review alone.
Potential applications include:
Identifying unusual patterns. AI-assisted analysis may flag changes in claim frequency, incident types, locations, or other indicators that deserve investigation.
Connecting information across departments. When claims, safety, inspections, corrective actions, and operational information can be analyzed together, teams may gain a broader view of the circumstances surrounding an incident.
Prioritizing investigations. An analytical tool may help direct attention toward emerging patterns or unusual results, allowing risk professionals to decide which findings warrant further review.
Supporting trend analysis. Historical information can help teams investigate whether a pattern is changing over time and whether the change coincides with differences in operations, staffing, processes, or other relevant factors.
Making complex information easier to explore. AI-powered interfaces may help users query information, summarize results, and identify areas for additional analysis—provided the answers can be traced back to reliable underlying data.
These are potential benefits, not guaranteed outcomes. Their usefulness depends on the data available, how the system is configured, and whether the findings are tested against real-world conditions.
AI Can Identify a Pattern Without Explaining Its Cause
One of the most important distinctions in AI-assisted risk management is the difference between identifying a correlation and establishing a cause.
Imagine an AI tool flags an increase in claims at a particular location. That finding may be worth investigating, but it does not automatically mean that the location has become less safe.
Several factors could explain the change:
- The location may have added employees or expanded operations.
- Reporting practices may have changed, leading to more incidents being recorded.
- A different mix of job responsibilities may have affected exposure.
- A small number of severe claims may have changed the financial picture.
- A genuine safety issue may have emerged and require corrective action.
The AI output is a starting point for investigation, not proof of the explanation.
The same caution applies to predictions. A model may estimate that certain conditions are associated with higher risk, but its output is not a guarantee that an incident will occur—or that an incident will not occur elsewhere.
Risk managers should be able to investigate the records and factors behind an AI-generated finding, understand the limitations of the analysis, and determine whether the result makes sense in the context of their operations.
Data Quality Still Comes First
AI cannot reliably compensate for incomplete, inconsistent, or poorly categorized information.
If departments record similar incidents differently, use inconsistent claim classifications, or maintain disconnected systems, the resulting analysis may be misleading. Missing records can hide patterns, while inconsistent definitions can create apparent differences that do not reflect actual changes in risk.
Before relying on AI-generated insights, organizations should consider:
- Whether information is complete and consistently recorded.
- Whether categories and definitions are applied consistently across locations.
- Whether historical data reflects meaningful changes in operations and reporting.
- Whether the system identifies the data behind its conclusions.
- How the vendor evaluates accuracy and measures false positives and missed patterns.
- How privacy, access controls, and appropriate use of sensitive information are handled.
The National Institute of Standards and Technology’s AI Risk Management Framework provides guidance for addressing risks associated with AI systems, including issues related to validity, reliability, transparency, privacy, and accountability.
The practical takeaway is straightforward: AI should help risk professionals ask better questions and investigate information more effectively. It should not turn an uncertain finding into an unquestioned conclusion.
What to Look for When Evaluating RMIS Technology
For organizations considering a new risk management information system—or reassessing an existing one—the relevant question is not simply whether the platform offers AI. It is whether the technology can provide useful, dependable information that supports the organization’s actual risk management needs.
These seven questions can help guide the evaluation.
1. Can the System Handle State-Specific Differences?
Determine whether the system can support the differences that matter to your organization, including location-level reporting, relevant claim classifications, and state-specific requirements.
Ask how the platform accommodates changes in regulations and organizational processes. Do not assume that a system’s ability to store state information means it can interpret every applicable requirement.
2. Can You Analyze Both Claim Frequency and Severity?
A useful RMIS should help you look beyond the number of claims. Evaluate whether you can examine claim costs, severity, incident types, trends over time, and differences among locations or business units.
The objective is to understand the nature and potential impact of losses—not simply to identify which location has the most incidents.
3. Can You Connect Information Across Departments?
Claims, safety, inspections, corrective actions, and other operational records may each reveal part of the risk picture.
Ask which systems the RMIS can connect to, how information is matched across records, and whether the resulting analysis provides a meaningful view across departments. Integration should improve understanding, not simply place disconnected data in one interface.
4. Can You Understand How AI Reached a Finding?
If a platform flags an emerging risk or recommends further investigation, ask what information contributed to the result.
Can users review the underlying records and relevant factors? Can the vendor explain the model’s limitations and how its performance is evaluated? How are false positives, missed patterns, and changes in data quality assessed?
The goal is to make AI-assisted findings easier to investigate and validate.
5. Can You Build Reports Around Your Organization’s Needs?
Prebuilt reports may be useful, but different organizations need different views of risk.
Evaluate whether the system can compare locations, departments, claim types, costs, and other relevant measures. Ask whether authorized users can create reports and drill into the underlying information without relying on manual spreadsheet work for every question.
6. How Does the Platform Protect Sensitive Information?
Risk and claims systems may contain confidential employee, medical, financial, and operational information.
Ask about access controls, data security, privacy practices, data retention, and how any AI features process information. If the vendor uses third-party AI services, clarify what data is shared, how it is handled, and whether it may be retained or used to train models.
Security and privacy should be evaluated as part of the platform—not treated as secondary considerations after the technology has been selected.
7. Will the System Support Better Decisions as Your Organization Changes?
An RMIS should fit the organization’s current needs while allowing for changes in locations, operations, reporting requirements, and analytical priorities.
Consider the flexibility of reporting, integration options, implementation requirements, user training, ongoing support, and the vendor’s approach to product development. Also determine whether the system provides information in a form your team can actually use.
A sophisticated platform has limited value if it is difficult to maintain, difficult to understand, or disconnected from the decisions risk managers need to make.
From More Data to Better-Informed Decisions
State-specific exposures, changing regulations, and advances in AI all reinforce the importance of having dependable risk information. But technology alone does not create a complete picture of risk.
Organizations need data they can trust, tools that help them examine that data in context, and professionals who can interpret the results. AI can support that process by identifying patterns and directing attention toward questions worth investigating. It should not replace validation, experience, or accountability.
When evaluating RMIS technology, look beyond feature lists and AI claims. Ask whether the system helps your organization understand what is happening, investigate why it may be happening, and determine what action—if any—is justified by the evidence.
Recordables develops risk management software designed to help organizations manage and analyze risk-related information. For organizations evaluating RMIS technology, the starting point should be the same regardless of platform: understand your operational needs, examine the quality and accessibility of your data, and choose tools that support informed decisions rather than simply generating more information.
Paul Kofman, President of Recordables, has been providing software solutions in Risk Management, Claims Management, Disability Management, Safety, and Occupational for more than 30 years.