Inside the NAIC AI Model Bulletin

An insurer opening the NAIC AI Model Bulletin has two questions to settle: what the document asks the company to have, and whether it binds in a given state. The NAIC adopted the text, formally the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, on December 4, 2023.¹ It is a template that a state insurance department issues under its own name.

Its opening paragraph gives it three jobs.¹ It reminds insurers that decisions affecting consumers must comply with existing insurance law when AI systems make or support them, sets out the department’s expectations for governing those systems, and advises insurers of the information and documentation the department may request in an investigation or examination. The governance map shows where the bulletin sits.

What the bulletin is

The NAIC writes model material for state insurance regulators, and each state chooses whether and how to adopt it. The bulletin is guidance, not a statute. The NAIC’s status map dated October 8, 2026 lists 27 states, the District of Columbia, and Puerto Rico as having adopted it.² Some other states appear on the map under insurance-specific regulation or guidance of their own instead. The state tracker records the instrument each state and the District issued.

Its Legislative Authority passage says the expectations in Section 3 and the oversight considerations in Section 4 “rely on” laws the state already has, covering unfair trade practices, unfair claims settlement practices, corporate governance disclosure, property and casualty rating, and market conduct surveillance.¹ Section 3 begins there: the legal and regulatory standards that apply to decisions insurers make using AI systems “require, at a minimum, that decisions made by Insurers are not inaccurate, arbitrary, capricious, or unfairly discriminatory.”¹ The document carries no penalty clause. A department that issues it is describing how it will apply those statutes when AI is involved, so adoption status and underlying authority have to be checked together.

An adopting state’s version can differ from the model, and a drafting note says states may have adopted different definitions.¹ Non-adoption does not mean AI-assisted decisions fall outside a state’s unfair-practices, discrimination, claims, rating, or examination authority.

Who and what it reaches

The bulletin addresses insurers authorized to do business in the issuing state. Its focus is an AI system that makes or supports decisions related to regulated insurance practices, whatever a vendor calls the product and whoever built it. Section 2 defines “AI System” broadly, by outputs running from predictions to “other output influencing decisions made in real or virtual environments”; predictive models and generative AI are defined separately.¹

It also asks insurers to scale governance to their own circumstances. Controls should be commensurate with the insurer’s own assessment of the risk its systems pose to consumers.¹ Five things go into that assessment: the nature of the decision, the potential harm, how far a human is involved in the final call, how explainable the outcome is to the person affected, and how much the insurer leans on outside data and models.¹ The bulletin supplies no universal list of high-risk systems and prescribes no method for choosing the oversight that fits a use; the framework implementation guide takes that up.

What belongs in a written AIS Program?

The central expectation comes early in Section 3. Insurers authorized to do business in the state “are expected to develop, implement, and maintain a written program (an ‘AIS Program’) for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices.”¹ The program should be designed to mitigate the risk of adverse consumer outcomes, meaning decisions that harm a consumer in violation of standards the department enforces.

The AIS Program Guidelines come in four numbered parts: General Guidelines, Governance, Risk Management and Internal Controls, and Third-Party AI Systems and Data. Under the first, the program should:

• address governance, internal audit functions, and risk management controls;
• vest responsibility for the program and the insurer’s AI strategy with senior management accountable to the board or an appropriate board committee;
• be tailored to and proportionate with the insurer’s use of and reliance on AI;
• address AI use across the insurance life cycle and every phase of an AI system’s own life cycle;
• address systems used in regulated insurance practices whether the insurer or a third-party vendor developed them;
• include processes for notifying affected consumers that AI systems are in use, with access to appropriate levels of information.

One guideline is a permission. The program may stand alone or sit inside the insurer’s enterprise risk management program, and it may adopt or rely on a framework from an official third-party standard organization, such as the NIST AI Risk Management Framework that the framework comparison examines.¹

None of the four parts is a prescribed table of contents. Near its end the bulletin says “The goal of the bulletin is not to prescribe specific practices or to prescribe specific documentation requirements,” and it recognizes that compliance can be shown “through alternative means, including through practices that differ from those described in this bulletin.”¹

Governance and accountability

The Governance part says the program should include a governance framework that prioritizes transparency, fairness, and accountability, while recognizing that proprietary and trade secret information must be protected. The insurer may rely on its existing structures, and it “should consider addressing” four items:¹

• the policies, processes, and procedures followed at each stage of an AI system’s life cycle;
• the requirements the insurer adopts to document compliance with its own AIS Program;
• the internal accountability structure for AI systems;
• for predictive models, the processes that run from design through monitoring, with the methods used to detect and address errors, performance issues, outliers, or unfair discrimination.

The second item bears most directly on record-keeping, because it adds: “Documentation requirements should be developed with Section 4 in mind.”¹

For the accountability structure the bulletin offers examples, among them cross-disciplinary committees, defined authority, independent lines of defense, and escalation and reporting protocols.¹ The structure itself is the insurer’s choice, and the governance roles guide covers the practical assignment of preparers and signers.

Risk controls and testing

The Risk Management and Internal Controls part adds a documentation expectation of its own. The program “should document the Insurer’s risk identification, mitigation, and management framework and internal controls for AI Systems generally and at each stage of the AI System life cycle.”¹ Those controls should address seven items:

• oversight and approval of the development, adoption, or acquisition of AI systems, with constraints and controls on automation and design;
• data practices and accountability procedures, including data currency, lineage, quality, integrity, bias analysis and minimization, and suitability;
• management and oversight of predictive models, including inventories, documentation of development and use, and assessments such as traceability and model drift;
• validating, testing, and retesting “as necessary”;
• protection of non-public information;
• data and record retention;
• for predictive models, a narrative description of each model’s intended goals and of how it is developed and validated.

The bulletin encourages verification and testing methods that identify errors, bias, and the potential for unfair discrimination.¹ It does not dictate one fairness test, one threshold, or one revalidation interval. Proxy variables and outcome differences are explained in the disparate-impact guide, and New York’s particular testing steps remain in the Circular Letter 7 guide.

Post-deployment thresholds and drift records belong to model monitoring.

Third-party AI

Buying a system does not take it out of the program. Every AIS Program should address the process by which the insurer acquires, uses, or relies on third-party data used to develop AI systems and on AI systems a third party developed. Doing so “may include, as appropriate,” standards, policies, procedures, and protocols on three considerations.¹

One is due diligence and the methods used to assess the third party and its data or systems, so that the decisions they support “that could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the Insurer itself.” Another begins “Where appropriate and available,” and covers contract terms that give the insurer audit rights or audit reports and oblige the third party to cooperate on regulatory inquiries and investigations. The last is the performance of contractual rights to confirm the third party’s compliance.¹

The qualifiers matter. The bulletin does not guarantee that every vendor will provide every desired right, or declare one contract clause mandatory in all circumstances. Nor does it address what to do when a vendor refuses a term, which the vendor assessment takes up.

What may a department ask to see?

Section 4, Regulatory Oversight and Examination Considerations, is written as notice of what a regulator may request, and nothing in it asks an insurer to file a document or meet a deadline.

“Regardless of the existence or scope of a written AIS Program,” its first paragraph says, an insurer in an investigation or market conduct action “can expect to be asked about its development, deployment, and use of AI Systems.” The same sentence adds “any other information or documentation deemed relevant by the Department.”¹ The section then lists what a regulator may also request, beginning with governance, risk management, and use protocols:

• the written AIS Program, with information and documentation evidencing its adoption;
• the program’s scope, “including any AI Systems and technologies not included in or addressed by” it;
• how the program is tailored to and proportionate with the insurer’s AI use and the risk to consumers;
• the policies, procedures, guidance, and training materials behind the program;
• diligence, monitoring, oversight, and auditing of data or AI systems a third party developed;
• evidence that the program is implemented and followed, such as inventories and descriptions of the predictive models and AI systems behind decisions that can result in adverse consumer outcomes, and documentation of data practices, validation, testing, and auditing.

For a specific model or system under investigation or examination, the list adds documentation of compliance with program policies, information about the data used, and the techniques, measurements, and thresholds applied.¹

When the inquiry concerns data, models, or AI systems that third parties collected or developed, the insurer “should also expect” requests for its due diligence on those parties, its vendor contracts, audits or confirmation processes on their compliance, and documentation of validation, testing, and auditing.¹

Assembling these materials for an examination is the subject of the exam readiness guide. The list is no ceiling, though: the section’s first paragraph covers whatever else the department deems relevant.¹

The NAIC’s draft evaluation supplement

Since adopting the bulletin, the NAIC has been drafting the AI Risk Evaluation Supplement, formerly called the AI Systems Evaluation Tool: optional exhibits, lettered A through D, that regulators can use when they review an insurer’s AI systems.³⁴ A pilot began in March 2026 with twelve participating states, and in the summary of its August 13, 2026 session the Big Data and Artificial Intelligence (H) Working Group said it would continue through September.⁴ The same summary records the new name.⁴

After its August 31 meeting the working group exposed version 5.0 of the supplement for a 30-day comment period, which closed on September 29, 2026.⁵ As of October 5, 2026, version 5.0 is still posted as an exposure draft, and no version of the supplement has been adopted.³⁵ The exhibit-by-exhibit guide covers the draft itself.

Exhibit B of the draft is titled AIS Program, and the draft says its questions about a company’s program “are not intended to be interpreted as creating new requirements for AIS Program.”³

The correct next step

After interpreting the bulletin for the states and business uses in scope, move to the framework implementation guide, or take a narrower gap straight to its owner: inventory, vendor review, or model monitoring. The bulletin itself does not become another implementation checklist.

Footnotes

1. National Association of Insurance Commissioners, Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted December 4, 2023. Opening paragraph, p.1; Legislative Authority, p.2; Section 2 definitions and drafting note, p.3; Section 3, pp.4 to 7; Section 4, pp.7 to 9. Retrieved October 5, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶ ↩¹⁷ ↩¹⁸ ↩¹⁹ ↩²⁰ ↩²¹ ↩²²

2. National Association of Insurance Commissioners, Implementation of NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers, status as of October 8, 2026. The count comes from the 29 Adopted States entries in the Reference List on page 2: 27 states, the District of Columbia, and Puerto Rico. A separate heading there lists states with insurance-specific regulation or guidance. Retrieved October 13, 2026. ↩

3. National Association of Insurance Commissioners, Artificial Intelligence (AI) Risk Evaluation Supplement, version 5.0, clean, the Word file posted as the exposure draft. Its footers read “DRAFT AI Risk Evaluation Supplement.” Intent section and Exhibit B narrative. Retrieved October 5, 2026. ↩ ↩² ↩³

4. National Association of Insurance Commissioners, Big Data and Artificial Intelligence (H) Working Group meeting summary report, August 13, 2026, items 1.B and 2, and Pilot Project Background, p.1 for the twelve participating states and p.2 for the pilot’s 2026 dates. Retrieved October 5, 2026. ↩ ↩² ↩³

5. National Association of Insurance Commissioners, Big Data and Artificial Intelligence (H) Working Group, Exposure Drafts section: “we are exposing the AI Risk Evaluation Supplement version 5.0 for written comments and feedback, for a 30-day comment period ending Tuesday, September 29, 2026.” On October 5, 2026 the page showed no adopted version. Retrieved October 5, 2026. ↩ ↩²