AI Governance Documents to Prepare for a Market Conduct Exam

A market conduct exam notice does not arrive with a syllabus. It arrives with a date, a scope, and a list of document requests that may or may not use the word AI. The NAIC AI Model Bulletin still places an insurer’s AI use inside the market conduct machinery the regulator already runs. It says the department may ask for the AIS Program, model documentation, and vendor files ¹. The Evaluation Tool then shows the shape those questions take on paper ².

Market conduct examinations are the state’s standing mechanism for inspecting how an insurer actually treats consumers, run by the departments under the NAIC’s Market Regulation Handbook ³. If the process itself is new to you, what a market conduct exam is and how it runs covers the triggers, the sampling, and the timeline; this piece assumes it and goes straight to the AI files. AI did not get its own proceeding. It got folded into that one. So the useful question is narrow: name the eight files, name who in the building can produce each, and name what happens on the ones nobody can. For the wider governance program these documents sit inside, see our AI governance in insurance guide.

The exam sequence

A market conduct exam follows a recognizable sequence, but no national timetable governs the phases below. This is an InsureAI Wire planning model. The department’s notice, scope, and instructions control the actual dates and deliverables.

The worksheet below mirrors this table with editable columns for your own deadlines and owners.

An eight-part readiness file

We organize AI exam readiness into eight evidence categories: the written AIS Program and its adoption record, the AI system inventory, high-risk system documentation, data records, vendor contracts and due diligence, consumer notices and complaint records, governance minutes, and incident or override records. This is a preparation framework assembled from the Model Bulletin and Evaluation Tool. It is not a uniform request list, and an examiner may ask for fewer, more, or different materials.

Items 3 and 4 line up with the Evaluation Tool’s Exhibits C and D, the closest published list of what a regulator may ask about a model. Item 2 is the register behind Exhibit A: it supports the counts in version 4.0 ², and the version 5.0 draft asks for the model inventory directly ⁴. The remaining categories come from the Model Bulletin’s program expectations, including its call for inventories and descriptions of the models themselves ¹. Every one of them is something a person can hold in hand and read a date off.

Rows 2 and 3 are the two that get pulled first, and each is a whole exercise on its own: row 2 rests on the inventory built in our Exhibit A inventory playbook, and the validation and drift records behind row 3 in the AI model monitoring playbook.

They also need a number you have to supply yourself. Row 2 turns on a revalidation interval and row 3 on how often bias testing repeats, and neither the Model Bulletin nor the Evaluation Tool sets one. Annual is a common working assumption for models that shape pricing or claims, but it is an example, not an authority. The interval is yours to set and defend, and the defensible version is written down in the AIS Program with a reason attached rather than inferred from whenever the last report happens to be dated.

The gap sign column is where most first passes stop being comfortable. That is the column doing the work. An examiner tests whether the program operates; the useful thing to be able to show is that you already know which parts do not, and since when.

Where to start before any notice arrives

The sequence table above starts at the notice. The readiness file does not, and neither does its gap sign column, which is built to be run against your own files at any time. The production test at the end tells you which of the eight you cannot produce today; this section is what to do with that answer. Sort the repairs by what a late start costs each item rather than by a calendar, because until a department supplies one there is none.

Start with the two where late costs everything. Items 1 and 2 fail differently from the rest. With no written AIS Program there is nothing to hand over and no smaller answer to give instead; the request lands on empty. Without the inventory, the counts Exhibit A wants can only be estimated. Both are mostly authoring work, which makes them cheap relative to what their absence costs. Writing the program now does not give it a review history, but it moves item 1 from missing to dated, and the history has to start somewhere.

Then the ones where late costs evidence you cannot buy back. Validation and monitoring records for the systems you have classified as high risk, governance minutes, and the incident and override log are worth whatever their history is worth, and nothing done later supplies the earlier dates. The complaint register belongs here too. The table wants an AI flag on the register, and flags get attached when the complaint is taken; a queue that never carried one can be re-read, but what comes out is dated to the reading rather than to the complaint. Item 5 sits upstream of the whole band, because the contract decides whether the validation records exist to be collected at all, and an amendment adding audit rights needs a vendor’s signature.

Leave the work that costs the same whenever it starts. The Exhibit D data-element answers, the data dictionary behind them, and the consumer notice templates are documentation exercises against systems you already run. Delivery logs come with them, provided the notices went out; if they did not, what is missing is the disclosure itself rather than the paperwork. None of it is quick, but waiting does not inflate it, which is why it should go last.

One limit sits under all of it. Priority ordering cannot conjure a record that only accumulates: a monitoring history reaching back years is either behind you or it is not, and resequencing will never supply the missing stretch. Backfilling the file after the fact is the one response that turns a documentation gap into a credibility problem. The gap record below is the form that case takes instead.

The gap record: what to do when you cannot produce it

Every carrier has gaps. The expensive version is discovering them in the same week the examiner does. The gap record is a worksheet for naming one first, in a form that reads as management rather than apology.

The two rows below are illustrative, not a real company’s data.

The pattern is the same for every gap: name it, explain why it exists, assign an interim control, name the owner, and set a due date. The interim control is the load-bearing column. “We are aware of the issue and are working on it” describes a feeling about the gap; “all triage decisions are manually reviewed until validation is completed” describes what happens to a policyholder in the meantime, which is the thing an examiner can test.

Both illustrative gaps above are vendor-shaped, which is the common case. The contract that governs whether you can get validation records out of a vendor at all is usually signed years before anyone asks, and our AI vendor risk assessment checklist covers the clauses that decide it. For the data-lineage side of row G-02, the NAIC Exhibit D data documentation playbook works through what naming a data source actually requires.

What the NAIC Evaluation Tool means for exam prep

What each exhibit of the NAIC’s AI evaluation tool asks, both in version 4.0, the text used in the twelve-state pilot running through September 2026 ⁵⁶, and in the version 5.0 draft put out for comment after August 31, is covered in our exhibit-by-exhibit guide to the supplement.

Run a 30-minute production test

If you have not received an exam notice, run the documentation checklist against your own files. Pick one item and try to produce it in 30 minutes. If you cannot, that is a gap. Write it down with an owner and a due date. Do this for all eight items. The result is your gap record, ready before the letter arrives.

If the notice has already arrived, read the dates in it first, then handle the two administrative deliverables: the acknowledgment letter and the internal exam file, then the kickoff minutes. Run the same 30-minute test anyway, on the items your confirmed scope actually reaches. Finding the hole during collection week costs you a gap record. Finding it during the interview costs you the answer.

A caution about the list itself: your exam’s scope is set by the department, not by this article. An exam can arrive pointed entirely at claims handling and never open the inventory, or it can start with the AIS Program and stay there for six weeks. Eight items is what the Bulletin and the Evaluation Tool make reachable. What actually gets reached is the examiner’s call.