The NAIC Insurance Data Security Model Law, Explained

You can get a long way into insurance AI governance before anyone mentions the data security law. Then it arrives all at once: inside the vendor questionnaire, inside the incident-response plan, inside the exam letter asking for your third-party inventory. That law is the NAIC Insurance Data Security Model Law, and if your company holds insurance licenses across much of the country, it is already one of the statutes you answer to.

It sits one layer below the AI conversation. AI governance asks what your models do. This law asks what happens to the data underneath all of it, and what you do when something goes wrong. The two overlap more than most programs admit, which is why it pays to read them together.

What the model law is

The Insurance Data Security Model Law, NAIC model number 668, is a template statute published in the NAIC’s model-law compendium in the fourth quarter of 2017 for state legislatures to enact as binding law.¹ Per the NAIC’s own description, it requires insurers and other licensed entities to develop, implement, and maintain an information security program, investigate cybersecurity events, and notify the state insurance commissioner when one occurs.² By our own count of the enacting texts, 27 states and Puerto Rico have a version of it on the books as of September 4, 2026, which makes it the nearest thing to a nationwide data security baseline the industry has.³ If the state-by-state structure that produced that result is unfamiliar, how U.S. insurance regulation actually works is the layer underneath this one.

Two features of that sentence deserve a second look. First, like every NAIC product, the model text binds no one by itself. It takes a state to enact it, and states modify as they enact, the same adoption mechanics covered in what the NAIC is and is not. Second, once enacted, this is not guidance. A model law becomes a statute with penalties, which puts it in a different weight class from the AI bulletin most compliance teams have spent the last two years reading.

The reach is also wider than the word “insurer” suggests. The law speaks to licensees: carriers, yes, but also producers, agencies, and other entities holding a state insurance license. An agency with a book of customer data is inside the same statute as the carrier whose paper it sells. The model’s one size break is narrower than it sounds: a licensee with fewer than ten employees, independent contractors included, is exempt from Section 4, the information security program itself, and from nothing else. The duties to investigate a cybersecurity event and to notify the commissioner still run.¹ And in states that adopted the certification provision, an insurer domiciled there owes its commissioner a written statement by February 15 each year certifying compliance with that program section, with the records behind it kept five years for examination.¹ That turns the security program from a document into a recurring sworn statement.

The four duties at its core

Stripped to the load-bearing parts, the law asks for four things.

A written information security program. Not a policy binder, but a program scaled to the licensee’s size, complexity, and the nature of the data it holds, and built on a risk assessment. The assessment is the foundation document: an examiner who wants to know whether your program is real starts by asking what risks it was built against.

Third-party oversight. A licensee answers for the service providers it lets near nonpublic information. That means due diligence before engagement, contracts that require protection of the data, and attention afterward. The vendor’s breach is legally your notification problem, a point that stopped being theoretical when the NAIC’s own PeopleSoft incident put a central industry data repository in the breach conversation.

Investigation of cybersecurity events. When something happens, the licensee must determine whether a cybersecurity event occurred and what nonpublic information it touched.¹ Everything downstream keys off that determination, including the clock.

Notification to the commissioner. Section 6 gives the licensee 72 hours from that determination, and the clock does not run to every state at once. It runs in a state if that state is the licensee’s domicile or home state, or if the licensee reasonably believes the event involved the nonpublic information of 250 or more consumers residing there and the event either triggers notice to some other government or regulatory body or is reasonably likely to cause material harm.¹ Read both gates before anyone drafts a fifty-state notification runbook. An NAIC committee has approved a project for a centralized breach-notification portal, but none has been built: as of September 2026 the association’s Executive (EX) Committee has not taken the project up, and a security review stands in front of that step. If one arrives, a single filing would reach every adopting state, which raises the stakes on the internal moment of determination: slow once, late everywhere.

Which states have enacted the insurance data security model law

Adoption is what turns the model text into binding law, so the only list that matters is the one below: 27 states and Puerto Rico with a version of Model Law 668 in force as of September 4, 2026.³ The District of Columbia is marked pending on the NAIC’s map and is not counted.⁴ New York is not on this list either, because it regulates insurance data security through an instrument of its own, 23 NYCRR Part 500, rather than through the model. Puerto Rico is on the list by a different route from everywhere else: its Commissioner of Insurance adopted the model as Rule 108, a regulation, where the 27 states each passed a bill.³

The notice column is the reason to read a state’s own text rather than the model. Two jurisdictions kept the model’s 72 hours, South Carolina and Puerto Rico, and Puerto Rico gates it on 250 affected consumers. Everywhere else the clock was rewritten in business days, which run longer than they look across a weekend: three in most states, four in Missouri, five in Minnesota and Pennsylvania, ten in Michigan. Vermont has no notification provision in its insurance law at all, and routes breach notice through the Security Breach Notice Act instead.

Two more departures matter before you assume the model describes your obligation. The first is who is covered: Rhode Island reaches only domestic and foreign insurance companies, and Maryland only carriers, a category running from insurers through managed general agents to third-party administrators but stopping short of the producers and agencies the model covers. The second is the small-licensee break. Virginia and Rhode Island dropped it altogether, so the ten-employee exemption in the model text does not exist there at all; most states kept one but raised it, to 15, 20, 25 or 50 employees; and North Dakota and Oklahoma replaced the headcount with revenue or asset tests. The model’s ten is a poor guide to whether any particular licensee is exempt.

One caution about the dates in the table: they are the day the chapter took effect. Most of these states then phased the security program in over a year and third-party oversight over two, so the deadline a licensee actually worked to fell later than the column shows.

Where GLBA fits

Underneath the model law sits a federal statute. Since 1999 the Gramm-Leach-Bliley Act has placed every financial institution, insurers included, under a continuing obligation to protect the security and confidentiality of customer information. It does not spell out what that takes. It tells each institution’s own regulator to set the safeguards standards.⁵

The piece most people miss is who that regulator is. For anyone engaged in providing insurance, GLBA names the state insurance authority of the licensee’s domicile, and directs it to implement the safeguards standards by rule.⁵ The FTC gets only the financial institutions no other agency covers, which is why its Safeguards Rule reaches other non-bank companies and stops short of insurers.⁵

Model Law 668 is how the states carry that federal duty. Read the two together and the structure is simple: GLBA supplies the obligation and the allocation, the states supply the teeth, and 668 is the tooth shape most of them chose. GLBA’s privacy-notice requirements run on a separate track. The model law is the security side of the same federal floor.

Where it meets your AI program

This is the connection few write down, and the reason this piece exists.

Start with the inventory. The third parties your AI governance program tracks, the vendors whose models score, draft, or triage, are in almost every case also third-party service providers under the data security law, because they touch nonpublic information to do their work. One vendor, two regulatory lenses, same underlying spreadsheet. Programs that run these as separate lists discover the mismatch during an exam, which is the worst time to discover it.

Then the records. A security program that documents its risk assessments and vendor oversight is producing the same species of evidence an AI governance program produces, and examiners read both with the same skepticism: a document dated last week reads like it was written last week. The disciplines compound. So do the gaps.

Finally, the incident chain. A breach at an AI vendor is a cybersecurity event under this law exactly as it is a vendor-oversight failure under your AI framework. The notification duty, the investigation duty, and the contract question about who tells you what, and how fast, are one problem wearing two labels. If your AI vendor risk assessment does not already ask about breach-notification timelines, the data security law is the reason it should.

What to check

Three lookups cover most of the practical exposure. Which of your license states have enacted the law, and with what modifications, is the first: the table above names the enacting statute in each of them, and only the state’s own enacted text shows what it changed on the way in. Our state tracker maps the AI rules, not this one. Whether your security program’s third-party list and your AI vendor inventory describe the same population is the second. Who inside your company has the authority to declare that a determination has been made, and how quickly that declaration can happen on a weekend, is the third, because that answer defines your real notification timeline.

None of these duties lands on the NAIC, on the vendor, or on the model text. They land on the licensee whose name is on the filing. Where the notification gates are met, the clock belongs to the enacting state rather than to the model, and in most of the country it runs in business days from the moment the licensee determines a cybersecurity event occurred. That makes the most consequential sentence in the whole incident-response plan the one that defines when a determination happens. Companies that treat data security as an IT topic discover this in the wrong order. The law is aimed at whoever holds the license, and it prices the delay accordingly.

FAQ

Is a breach inside a vendor’s system a cybersecurity event under the model law? Yes, if the licensee learns that an event has or may have occurred in a system a third-party service provider maintains. Section 5.C requires the licensee to complete the Section 5.B investigation itself or to confirm and document that the provider completed it. The 72-hour clocks in Section 6 start at different points, the licensee’s own determination under 6.A and receipt of the provider’s notice for an assuming insurer under 6.C, so the incident plan needs to name which one applies.¹

Does every unauthorized access count as a cybersecurity event? No. Section 3.D excludes the acquisition of encrypted nonpublic information when the key or process was not also taken, and an event where the licensee has determined that the information was not used or released and has been returned or destroyed. Records concerning every cybersecurity event still have to be kept for at least five years and produced to the commissioner on demand under Section 5.D.¹

What penalty does a violation carry? The model leaves it blank. Under its Section 10 a licensee “may be penalized in accordance with [insert general penalty statute],” so each enacting state fills in its own insurance-code penalty, and the exposure differs by license state.¹