The NAIC's vendor framework went voluntary and kept its teeth

A vendor that will not show a regulator its model could cost its customers the right to use it. The NAIC put that line in a framework whose comment period closed August 5.

This week’s story: the vendor framework moved toward the industry and kept its teeth

The Third-Party Data and Models (H) Working Group exposed a revised framework on July 8, and its 28-day comment window closed August 5. It covers third-party data and models used in property and casualty pricing and underwriting, which the document calls the first phase of something broader.

Two things moved. The earlier draft made registration and an approved governance program a precondition for any insurer using a vendor’s models or data; twenty-three interested parties filed comments, and the objections went at that requirement. The new draft asks vendors to register voluntarily and confines this phase to pricing and underwriting. The third ask, dropping data vendors, did not carry.

Reading that as a retreat would be a mistake, because the gate moved rather than closed. A model or dataset actually in use still has to be filed, inside the insurer’s own filing or separately at the regulator’s request, and a vendor that does not produce what is asked may end with the regulator barring insurers from using it in the state. Producing the file on request has replaced registration as the condition of use, and the cost of failing lands on the carrier’s book rather than the vendor’s. Insurers still validate for their own book and, in the phrase that will cost the most desk time, still have to ensure contractual access to necessary information.

One clause reaches further than it looks. Vendor governance programs would have to be consistent with the NAIC AI Principles and the Model Bulletin, so where each jurisdiction stands on the bulletin is part of what decides how much of this reaches you. Our earlier read, written when registration was still the gate: NAIC Proposes Vendor Registry for AI Models Sold to Insurers.

What to do this week

• Open the contract with your largest third-party pricing or underwriting model vendor and find the clause that lets a regulator see the model. The framework puts contractual access on you, so a vendor who cannot be made to produce its file is a model you could lose.
• Written comments are due to Kris DeFrain at the NAIC by August 5. If that is too tight, the August 12 session in Columbus takes comment out loud.
• List which of your pricing and underwriting models and datasets came from outside, and who supplied each. For vendors that do register, regulators get that mapping whether or not you have it.
• Search your governance file for “AI Systems Evaluation Tool” and put the other name beside it. Keep both; neither has been retired.

On the Docket

• August 5, 2026: Comments close on the NAIC’s third-party data and model vendor framework for property/casualty pricing and underwriting. Any carrier pricing on a model it bought. NAIC exposure draft
• August 12, 2026: Third-Party Data and Models (H) Working Group meets in Columbus, 11:45 a.m. ET, with time for oral comment. Anyone who filed, and anyone whose vendor did. NAIC agenda
• August 13, 2026: Big Data and AI (H) Working Group takes the pilot update at 1:00 p.m. ET; Privacy Protections hears comment on Model #672 at 3:00. Every carrier, plus anyone holding consumer financial or health data. NAIC agenda
• August 31, 2026: Big Data and AI public Webex on the AI Risk Evaluation Supplement, 10:30 a.m. ET. Anyone tracking whether the two names are one instrument. NAIC committee page
• September 1, 2026: Comments close on proposed revisions to ASOP No. 45 and ASOP No. 49. Health writers, and anyone whose actuaries sign risk-adjustment work. Actuarial Standards Board

This week in brief

Governance

The NAIC calls the 12-state pilot the AI Risk Evaluation Supplement in its August 13 meeting agenda, a document drafted July 28, where every earlier posting back to November 2025 said AI Systems Evaluation Tool. Nothing announced a change, so what each exhibit asks is unchanged either way. NAIC agenda

Massachusetts moved H.4616 out of committee on July 29, and it now sits with House Ways and Means. The bill would bar an AI tool from being the sole basis of a decision to deny, delay or modify care on medical necessity grounds, require the determination to come from a licensed physician or a competent licensed provider, and open the tool, its training data and its outcomes to inspection by the Division of Insurance. Massachusetts General Court, H.4616

IBM put the 2026 global average breach cost at a record 4.99 million dollars, 12% above last year, with AI-driven attacks up 56%. Among the roughly one in five organizations reporting a breach of an AI model or application, 92% had no proper AI access controls, which is an Exhibit B answer waiting to be written down. IBM, Cost of a Data Breach 2026

Business Lines

Shumaker mapped what carriers are writing into commercial forms while the case law is still empty. ISO’s CG 40 47 takes generative AI out of general liability and Berkley has gone to an absolute AI exclusion across several specialty lines; the firm’s argument is that wording is never more open to negotiation than in the year it appears, and what it says to press for is specific: tighter causation, a carve-back for routine business use, and cover preserved where the tool was only an instrument. Shumaker

CFC announced on July 29 that affirmative AI coverage goes into its Media policy effective July 30, on the stated ground that using AI to help produce the work should not on its own put the grant in doubt. The market has spent since 2025 writing AI out of forms rather than into them, so a carrier writing it back in is worth watching, though the definition has not been circulated. CFC

One data point

Eleven. That is how many conditions the Massachusetts bill would place on an AI tool used in utilization review, items 1 through 11, before the separate prohibition on sole-basis denials is even reached. State AI rules keep arriving in this shape, as a list an examiner can walk rather than a standard someone has to interpret, which is also the shape the governance elements in Exhibit B take.

If one item here deserves a deeper follow-up, hit reply and tell us which one. Every reply gets read.

– The Editor, InsureAI Wire