NAIC's AI Supplement 6.0 Lets Regulators Leave GLMs Out of Exhibits B Through D

A 14-day written comment period on version 6.0 of the NAIC’s AI Risk Evaluation Supplement ends Friday, October 30, 2026. Its Big Data and Artificial Intelligence (H) Working Group exposed the text after an October 16 email notice. One new sentence lets regulators set GLMs aside for Exhibits B through D: “Based on existing regulatory oversight provided via rate making, regulators may choose to exclude some or all GLMs for Exhibit B through D related inquiries if appropriate.”

Version 6.0 keeps GLMs in, though several insurer trade groups had asked in 5.0 letters to exclude them. The paragraph before the new sentence still says GLMs “are not without risk of causing unfair discrimination or other Adverse Consumer Impacts.” Exhibit A’s table still lists them, with a checkbox for each of generative AI, agentic AI, GLMs and other AI/ML models, where 5.0 asked for counts. In the tracked-changes file, many edits carry NAIC staff margin notes naming a commenter, often as “Edit to address input by …” or ”… related input.” The table’s note names ACLI, BCBSA, CAI, NAMIC, InsurTech Advisors and Shadow Dynamic Solutions, and gives among its aims “to remove most of the quantification.”

Exhibits C and D remain, and our guide to version 5.0 covers what each asks. New instructions say the supplement “is designed with the intention that regulators using this document will most often use Exhibit A.” Depending on the answers, regulators may then use Exhibit B, and companies may get Exhibit C and D inquiries on a subset of AI uses regulators want to probe further. The intent section adds, with a note naming ACLI: “Consistent with the Handbooks, this Supplement does not independently create substantive legal duties, standards of conduct, admissions, or expanded regulatory authority.”

Under 5.0, a company with an existing AI system inventory “may suggest submission of the inventory in lieu of completing Exhibit A.” Version 6.0 says it “should provide the AI System and/or Model inventory together with the completed Exhibit A.” Regulators, depending on the inventory, “may consider if a separate Exhibit A submission is necessary.” 5.0’s Part Two inventory request is deleted. Notes such as “Carrying over Exhibit A part 2” mark some items moved into Exhibit B questions. The inventory fields now sit in Exhibit A’s company instructions.

The defined term Adverse Consumer Outcome is renamed Adverse Consumer Impact. Its definition still covers an AI System decision “that is subject to insurance regulatory standards enforced by the Department,” but the closing words “in a manner that violates those standards” are deleted. The separate definition of “Consumer Impact” is also gone. On our reading, the new definition reaches an adverse decision whether or not it breaks one of those standards.

Exhibit C gains a proxy question, numbered 10a, asking companies “where applicable” whether they evaluate variables or model outputs for proxy effects that may contribute to Adverse Consumer Impacts or unfair discrimination, with the method and any action taken. Its note names CT. New item 3a asks whether a use case involves agentic AI and, if so, its objectives and authorizations without human approval. The exhibit’s purpose statement still says “AI model risk criteria are set by the insurance company,” while the “Model risk classification” row is deleted.

In Exhibit B’s narrative version, the question on uses with a direct consumer impact still asks about a human in the loop, high volume transactions and the handling of exceptions or errors. It drops the question of “any staffing reductions as part of the AI System implementation,” with a note naming ACLI and BCBSA. It adds “how the company assures itself the human review is appropriate,” with a note naming consumer representatives. Three new closing questions ask how a company discovers unsanctioned AI use, keeps nonpublic personal information out of unapproved AI models and governs enterprise assistants that support many low- and medium-risk uses. A fourth asks how it decides when a general-purpose tool “becomes a high-risk use because of the workflow in which it is deployed.” Exhibit B’s narrative and checklist versions each tell regulators, with notes naming ACLI and NAMIC: “The Exhibits are designed so that regulators would use either the Narrative or the Checklist Exhibit but not both.”

Comments go to Scott Sobel or Miguel Romero by close of business on October 30. The working group’s page lists a public Webex meeting for November 2 and a session at the Fall National Meeting on November 16. The timeline in the August 31 meeting packet put consideration of version 7.0 for adoption at that meeting. With no separate response document among the page’s exposure files, staff margin notes, not working group decisions, are the file’s only link between edits and commenters. The GLM sentence and the definition change carry none, leaving open whose input, if any, shaped them.