NAIC AI Evaluation Tool Pilot Runs Toward a Fall Adoption Question

The NAIC’s Big Data and Artificial Intelligence Working Group continues to develop the AI Systems Evaluation Tool, the questionnaire examiners would use to assess how insurers govern AI. It is running as a multi-state pilot, and the working group’s own pilot timeline puts an updated version in front of the November 2026 fall meeting, which is scheduled to consider adopting it. Carriers should expect the tool’s four-exhibit structure to shape how AI examinations are scoped.

The tool is a set of optional supplemental exhibits, not a new regulation. The NAIC’s instruction to regulators is that the market conduct, financial analysis, and financial examination handbooks stay authoritative and these exhibits sit beside them. The four exhibits are not a chain. Exhibit A comes first and the other three branch off it, so the governance assessment, the high-risk detail, and the data questions all rest on the counts in A being real. Exhibit D presses hardest on that: for each category of data used in developing the company’s AI system models, it wants to know whether the data originates inside the company or with a named third party. If Exhibit A is missing systems, the governance assessment covers the wrong scope and the high-risk detail invites questions.

Start with the inventory, not the questionnaire. You cannot describe governance over systems you have not counted. You cannot detail a high-risk model you have not classified as high-risk. The tool says as much from the regulator’s side: a company whose AI use is limited or low in inherent risk may draw no inquiry at all past Exhibit A. First-wave exams will find inventory gaps before policy gaps. A system licensed from a vendor or buried inside a larger workflow gets used every day and never gets logged as AI, because nobody who bought it called it that.

The pilot matters because the states running it are stress-testing the questions before anyone is asked to adopt them. Feedback from the pilot could sharpen wording, add examples, or change which documentation is treated as sufficient. Each pilot state also keeps the authority to modify the questions for its own needs, so the version a carrier sees may not be the version posted on the NAIC’s site. Until November, the instrument is still open. Comments can change the wording, and a gap found in that window gets closed on the company’s own calendar.

The immediate work is to walk your governance against the tool’s checklist elements and mark what you can evidence versus what you cannot. A gap list with named owners and due dates beats a polished narrative, because it tells the examiner you have already done the hard thinking. The longer work is to connect the four exhibits inside your own program so the counts, the governance narrative, the high-risk testing, and the data sourcing all tell the same story.

One practical way to start is to run a tabletop exercise. Ask the team that owns the model inventory to produce Exhibit A’s counts, then retain the system-level register that supports them; the exhibit itself does not ask for a system list. Hand that register to the governance committee and ask them to walk through Exhibit B using only those systems. If the committee cannot map its oversight to the inventory, the seam is real and needs to be closed before the exam notice arrives. The same exercise works between Exhibit C and D: pick one high-risk system and trace its data sources, validation history, and drift monitoring back to the governance minutes.

Carriers who run the tabletop tend to find the same gap: the inventory and the governance narrative were produced by different teams for different audiences and have never been read against each other. Exhibit B reads them against each other, which is why the tool surfaces problems a document review does not. Nothing on the exhibit list is individually hard.