Do Insurers Have to Tell Consumers They Use AI?

An insurer that lets a model help decide who gets coverage, and at what price, owes consumers notices about those decisions, though it rarely owes them because of the model. Most of those notices come from rules written long before machine learning reached underwriting. Some states’ insurance privacy laws require reasons for an adverse underwriting decision, and the federal Fair Credit Reporting Act (FCRA) requires an adverse action notice when a consumer report lies behind a denial or a higher price.

The NAIC’s AI Model Bulletin holds the nearest thing to a general duty to disclose AI use, a consumer-notice guideline whose weight depends on how each state issued it. For underwriting and pricing decisions, notice is the part of an insurer’s AI governance that consumers see; claims decisions raise questions of their own.

What the NAIC bulletin asks for

The bulletin’s notice language is guideline 1.9: an insurer’s AIS Program “should include processes and procedures providing notice to impacted consumers that AI Systems are in use” and give access to “appropriate levels of information based on the phase of the insurance life cycle.”¹ The guideline is a “should,” and so is the program around it. Insurers are “expected” to maintain the program, they may show compliance “through alternative means,” and the bulletin disclaims any aim of prescribing particular practices or documentation.²

In November 2023 four trade groups asked the NAIC to delete or narrow the guideline; the American Council of Life Insurers (ACLI) accepted telling potential insureds that AI systems “may be in use” but objected to the access clause.³ Adopted unchanged, the access clause is part of guideline 1.9 wherever a state repeats it.¹ Of the state texts we checked, Pennsylvania’s 2024 notice and South Carolina’s 2026 bulletin do, word for word.⁴ North Dakota’s 2026 bulletin has no notice guideline and only encourages insurers to keep an AI program.⁵

Status as of November 3, 2026. The adoption map the NAIC publishes lists 29 jurisdictions as adopted states, and lists California, Colorado, New York, and Texas separately under insurance-specific AI regulation or guidance.⁶ The map does not say whether a state’s text contains every element of the bulletin, so only that state’s own text shows whether guideline 1.9 came with it.⁶

The notices an AI decision already triggers

Under the bulletin, decisions that insurers make with AI systems and that are subject to regulatory oversight must meet the “legal and regulatory standards” governing those decisions, “including unfair trade practice laws.” At a minimum, those standards rule out inaccurate, arbitrary, capricious, or unfairly discriminatory decisions, and compliance “is required regardless of the tools and methods Insurers use to make such decisions.”⁷ The bulletin names no notice law; we take its point to carry over to two: state laws based on the NAIC’s Insurance Information and Privacy Protection Model Act, Model 670, and the FCRA. Neither refers to how a decision is made, so a decline a model drives owes the same notice as an underwriter’s.

Under Model 670, an adverse underwriting decision on individually underwritten coverage includes a declination or termination and, for property or casualty coverage, a higher rate charged on information that differs from what the applicant or policyholder supplied.⁸ For a model fed outside data, the rate item deserves the closest attention: such data can contradict the application and raise a price without declining anyone. The definition also covers residual-market or substandard-insurer placements in property or casualty, and life, health, or disability offers above standard rates. The insurer or agent responsible must then either give the specific reasons in writing or say they are available on written request, plus a summary of the person’s rights.⁹

As a model law, Model 670 binds only in states that have enacted it, and we found no authoritative list of enacting states. Look in a state’s insurance code for its insurance information and privacy protection act; North Carolina’s closely follows Model 670’s reasons section.¹⁰

California’s rewritten insurance privacy act, SB 354, becomes operative on July 1, 2028.¹¹ From then, written reasons are due at the time of the decision for declinations, cancellations, and nonrenewals of covered property and auto policies and of individual life, health, and disability policies.

For insurance, an FCRA adverse action includes denying, cancelling, or reducing coverage, raising any charge for it, or otherwise changing its terms for the worse, in connection with underwriting.¹² Whoever takes such an action “based in whole or in part on any information contained in a consumer report” owes the consumer a notice.¹³ That covers a model fed a credit-based insurance score drawn from a consumer report, or driving data the insurer obtains in a consumer report from a consumer reporting agency. A model fed only the insurer’s own data does not bring the FCRA in.

The Supreme Court held in Safeco Insurance Co. of America v. Burr (2007) that a first-time rate on a new policy can be an adverse action.¹⁴ The comparison is with the rate the applicant would have received had the insurer not taken the credit score into account. The report must also be a necessary condition of the worse result; if the rate would have been the same without it, no notice is owed.

An FCRA notice identifies the consumer reporting agency and any credit score used, and tells the consumer that a free copy of the report can be requested within 60 days and its contents disputed.¹³ It also states that the agency did not make the decision and cannot supply the reasons for it; the statute asks the insurer for no reasons of its own.

What the notice must say when a model decided

Model 670 requires the “specific reason or reasons” for an adverse underwriting decision, and Connecticut’s insurance department has said what does not qualify.⁹ In a 2000 bulletin on the state’s insurance privacy act, it told property and casualty insurers that “a statement such as ‘Underwriting reasons’ is not a specific reason.”¹⁵ Connecticut’s guidance is old, but it construes the statute’s own words, which Model 670 also uses.

Model 670’s on-request rights show, by implication, what each reason has to rest on. Someone who asks in writing within 90 business days of the notice is owed, within 21 business days, the reasons and the specific items of personal and privileged information that support them.¹⁶ The insurer must also give the names and addresses of the institutional sources that supplied those items, subject to limited exceptions for privileged information and medical records.

New York’s Insurance Circular Letter No. 7 of July 2024 reaches only underwriting and pricing by insurers that use AI systems or external consumer data and information sources (ECDIS).¹⁷ That category leaves out MIB exchange data, motor vehicle reports, prescription drug data, and criminal history searches. Under the circular letter, the reasons given for a declination, rate differential, or other adverse underwriting decision should detail all the information the decision rested on, including its source. An insurer may not point to the proprietary nature of a vendor’s algorithm to excuse reasons that lack specificity.

Together, Connecticut, Model 670, and New York describe the result: a statement more specific than “underwriting reasons,” resting on items of information the insurer can name and trace to their source, with no appeal to a vendor’s secrecy. In New York, those items should cover all the information the decision rested on. None of them, nor any other insurance source cited here, says how to draw that statement out of a complex model, so the illustration that follows is ours. A notice that gives “underwriting reasons” fails. A notice that states the reason and lists every item of information behind the decision, each with the institutional source that supplied it, passes all three; Model 670 alone would let the items and sources wait for a written request. Any extraction method serves if it produces the second kind; an explainability report that only its authors can decode does not.

Rules that make AI use itself the notice

Where a New York insurer uses ECDIS or AI systems, the circular letter says “the notice to the insured or potential insured” should disclose whether it uses AI systems in underwriting or pricing and whether it uses outside vendors’ data about the person.¹⁷ It should also say how the person can ask about the specific data behind the decision. If a process using ECDIS or AI systems will not approve an applicant who can then get coverage only through a process using neither, the insurer should explain why in writing within 15 days and keep that other process going meanwhile.¹⁷

Utah’s SB 319, a utilization management law, governs prior authorization, a health-benefit decision outside this piece’s underwriting and pricing scope, but it is the plainest statute here that makes AI use itself the notice.¹⁸ From January 1, 2027, a health insurer using AI to review prior-authorization requests must disclose that to the state insurance department, its network providers, and each enrollee, and post a website notice, whether or not any request is denied.¹⁸

Colorado’s SB 26-189, signed in May 2026, counts insurance among the consequential decisions it reaches.¹⁹ Insurers, as defined in C.R.S. 10-1-102(13), and their affiliated entities, that are subject to Colorado’s 2021 insurance AI law, SB 21-169 (C.R.S. 10-3-1104.9), are deemed in compliance with SB 26-189 “in the practice of insurance.”²⁰ The statute does not list which insurers fall under SB 21-169, and employment uses stay under SB 26-189. Under a provision SB 26-189 added to the 2021 law, the Commissioner of Insurance may adopt rules on insurers’ notices and disclosures to consumers.¹⁹

Outside that deemed compliance, for consequential decisions made from January 1, 2027, SB 26-189 requires a “deployer,” a business that uses a covered automated decisionmaking technology (ADMT), to give a consumer clear notice before the tool materially influences a decision about them.¹⁹ After an adverse outcome, the deployer has 30 days to describe the decision and the tool’s role, set out the consumer’s rights, and explain how to ask for details of the tool and the personal data used, so far as the developer has supplied them.¹⁹ An insurer not deemed compliant must give that 30-day disclosure “to the extent applicable”; the provision does not say whether that insurer also owes the advance notice.²⁰

Colorado’s Regulation 10-1-1, issued under SB 21-169, applies only to insurers writing three lines: private passenger auto, health benefit plans, and individually issued life insurance.²¹ Insurers in those lines that use external consumer data, or algorithms and predictive models that use it, must keep complaint and inquiry protocols giving consumers the information needed to act meaningfully after an adverse decision based on them. Existing grievance and appeal procedures may serve.²¹ We found no section requiring advance notice of AI use, so the regulation reads as a recourse duty after the decision rather than an AI-use notice.

The California Privacy Protection Agency’s final ADMT rules took “insurance” out of the significant decisions they cover, a definition the agency says it may revisit, and deleted a proposed notice for adverse significant decisions.²² Personal information an insurer handles for an insurance transaction falls under the state’s Insurance Code rather than the California Consumer Privacy Act, so the rules reach insurers mainly through other data, such as employee and job-applicant records.²³

The rules side by side

Showing an examiner the notices went out

On our reading, an examiner can ask for notice templates and records of notices sent, though the bulletin’s request list in Section 4 never names consumer notices.²⁴ That list, for investigations and market conduct actions, is open-ended and reaches “any other information or documentation deemed relevant by the Department.”²⁴

The NAIC’s AI Risk Evaluation Supplement, optional exhibits for gauging an insurer’s AI use, is an exposure draft, not adopted, and states that on its own it creates no substantive legal duties.²⁵ A regulator uses one of its two forms, narrative or checklist, and the checklist alone asks about notice: whether the insurer “promotes consumer awareness of the use of AI Systems” through disclosures and consumer-notification procedures, “as appropriate.”²⁵ In September 2026 ACLI asked the NAIC to drop that question or limit it to disclosures required by law or adopted guidance, so as not to imply a general notice duty.²⁶ The latest draft keeps the question without that limit.²⁵

In a 2016 market conduct exam of American Equity Investment Life Insurance Company, North Carolina examiners checked declined files for the adverse underwriting decision notice.²⁷ They found 28 annuity application files declined for suitability without the notice in a form the Commissioner had approved, as state law requires, and directed the company to revise and refile its form.¹⁰²⁷ That exam did not concern AI, and our searches found no enforcement action or court ruling over an insurer’s failure to disclose AI use, so this record tests the reasons notice.

Our recommendation is a record for every model that makes or supports a decision about a consumer, listing by state the adverse outcomes it can produce, the notice each triggers, and the data and source behind each reason it yields. Where an AI-use rule applies, as in New York, Colorado, or Utah, the record should name that notice too, along with any other consumer notice about AI the insurer gives, since the Supplement kept its notice question without ACLI’s limit. Where a consumer report feeds the model, the record should hold the Safeco comparison, the price with the credit information left out of account, which shows whether the report was a necessary cause.