How AI Governance Works in Insurance

AI governance in insurance is the work of keeping an AI-assisted decision inside the same legal and operational boundaries that apply when a person makes it. The technology changes how the decision is produced. It does not remove the carrier’s responsibility for underwriting, pricing, claims, sales, privacy, or consumer communication.

That definition is deliberately practical. A useful program must answer four questions: where AI is used, which rules reach each use, who owns the resulting risk, and what evidence shows the controls operated. This page maps those questions to the articles that own them.

The regulatory stack

There is no single national insurance AI code. The stack begins with state insurance law, including unfair trade practices, unfair discrimination, claims handling, rating, privacy, and market conduct authority. AI-specific instruments explain how regulators expect those existing duties to apply to AI-assisted work.

The NAIC Model Bulletin is the closest thing to a shared supervisory baseline. It does not create a new statute. A state decides whether and how to adopt or use it, and the underlying state law supplies the authority.¹ The bulletin’s central subject is a written AI Systems Program, usually called an AIS Program.

The NAIC AI Systems Evaluation Tool has a different job. Its optional Exhibits A through D help regulators ask about AI counts, governance, selected high-risk systems, and data categories.² It does not replace the NAIC’s examination handbooks, and it does not declare which systems are high risk for an insurer.

Several states use their own instruments. New York Circular Letter 7 owns the state’s underwriting and pricing expectations for AIS and external consumer data. Colorado’s current insurance regime must be read alongside the state’s insurance-specific rules rather than treated as a copy of New York. The state tracker is the right place to check the instrument and effective status for a footprint.

Federal policy can change the pressure around that system without instantly replacing it. The federal-state preemption analysis explains why an executive action alone does not settle how state insurance regulation is displaced.

What the program must connect

A governance program is more than a policy document. It connects the systems the company uses, the decisions they shape, the controls applied to them, and the evidence retained. The details have separate owners:

The table matters because these are different jobs. An inventory lists systems. It does not perform vendor diligence. A monitoring plan measures a live model. It does not establish the organization’s examination response. An exam file assembles existing evidence. It should not become the first place that evidence is created.

New readers should not enter through the most technical article.

The guide map above is a reading path, not a maturity score. A company may be advanced in model monitoring and still discover an unrecorded vendor feature. Move to the page that owns the current gap.

One program, with documented state differences

Multi-state carriers often ask whether to build to the strictest state. The useful distinction is portability. A sound inventory, approval record, validation method, vendor review, and monitoring process can usually support several jurisdictions. A filing, officer attestation, state portal, prescribed notice, or product-specific deadline usually cannot.

Use a shared baseline for controls that travel. Keep a state appendix for obligations that do not. Where two states genuinely conflict, document separate treatment instead of pretending one national ceiling exists. This approach reduces duplicate programs without erasing local law.

Where the map becomes concrete

Governance is tested in business decisions. The business-line hub routes claims, underwriting, life, health, homeowners, fraud, reinsurance, and distribution to separate owners. The UnitedHealth case study then shows how public facts, litigation allegations, company responses, and regulatory evidence can expose control questions without turning one company’s experience into a universal rule.

The end state is simple to describe and hard to fake. The organization can name the system, explain why its controls fit the decision, show what happened after deployment, and reproduce the evidence without building it during the examination. Every deeper guide on this site is responsible for one part of that result.