# Texas Regulates Insurer AI Without Requiring a Single New Document > Texas asks insurers for no written AI program but expects a person to approve consequential AI decisions before they take effect. - Source: https://insureaiwire.com/texas-insurance-ai-rules/ - Publication: InsureAI Wire - Author: Simon Li - Updated: 2026-09-23 --- An AI governance file built on the NAIC model bulletin has a recognizable shape: a written AIS Program, an inventory of predictive models, an accountability line running up to senior management, validation and monitoring records, third-party diligence. It is real work, and in a state that adopted that text it is legible on sight. Texas asks for none of it by name. What the Texas Department of Insurance put in writing is one sentence about how a decision has to run: "If a regulated entity uses AI to make a consequential decision, TDI expects a person to review and agree with all decisions before action is taken."[^1] That sentence is the whole shift. A file built on the model bulletin is organized around a program, and the Texas bulletin never uses the word. The thing Texas describes is a step in a transaction, and a program description is an awkward instrument for showing that a particular step happened. Anyone mapping [AI governance across states](/ai-governance-in-insurance/) will find Texas easy to read and hard to file against. ## What kind of instrument this is Commissioner's Bulletin B-0003-26 carries the date June 12, 2026 and the header lines "To: All regulated entities and their agents and representatives" and "Re: Use of artificial intelligence."[^1] Its opening paragraph puts consumer-facing decisions inside existing law. Where such a decision is made or supported by "advanced analytical and computational technologies, including artificial intelligence (AI)," it "must comply with all applicable insurance laws and regulations."[^1] Unfair trade practices and [unfair discrimination](/glossary/unfair-discrimination/) are named among the laws that apply.[^1] The obligation in that sentence sits in the laws themselves, and the bulletin only points at them. Under the heading Legislative Authority, TDI lists ten chapters of the Texas Insurance Code it says already apply when AI is in use.[^1] In the order the bulletin gives them, the first five are Chapter 541 on unfair methods of competition, 542 on processing and settlement of claims, 544 on prohibited discrimination, 831 on corporate governance annual disclosure, and 560 on prohibited rates.[^1] The other five are 4001 on agent licensing, 4101 on insurance adjusters, 4201 on utilization review agents, 751 on market conduct surveillance, and 401 on audits and examinations.[^1] The list asserts reach; it adds no duty of its own. One of the ten does carry a filing. Chapter 831 is the corporate governance annual disclosure, which the bulletin describes as "requir[ing] reporting on governance practices and corporate governance structure, policies, and practices."[^1] That is a standing requirement of the code chapter, listed here among the laws the bulletin says already apply, and the bulletin does not say what, if anything, AI adds to it. One item on that list is a statutory ban rather than an expectation: the bulletin states that Chapter 4201, concerning utilization review agents, "prohibits using AI to make an adverse determination."[^1] A Commissioner's bulletin is a statement of how the department reads existing law. This one sets no effective date, takes no public comment, and asks for no filing. It closes by preserving TDI's discretion: investigations and market conduct actions "may be performed using procedures that vary in nature, extent, and timing in accordance with regulatory judgment," and nothing in the bulletin limits the department's authority to investigate, examine, or enforce.[^1] The publication event itself, and the document number that goes with it, are recorded in our [dispatch on B-0003-26](/news/texas-tdi-bulletin-b-0003-26-ai-governance/). Where the bulletin does point outward, it points somewhere other than the document the reader's file was built on. Under Background it says TDI "recognizes the Principles on Artificial Intelligence, adopted by the National Association of Insurance Commissioners in 2020, as an appropriate guide in AI's development and use."[^1] It adds that TDI "also recommends companies review the AI Code of Ethics and Minimum Standards adopted by the Texas Department of Information Resources for use by state agencies."[^1] Recognizes as a guide and recommends a review are the softest verbs available, and the NAIC text named here is the 2020 Principles, not the 2023 model bulletin. Texas also enacted general-purpose and health-care AI statutes in June 2025, HB 149 and SB 1188, which are statewide laws rather than insurance-AI instruments; where they reach a carrier is the subject of a [separate dispatch](/news/texas-hb-149-sb-1188-ai/). The posted bulletin was read again on September 22, 2026, and the sentences quoted in this article are present in the department's current version, which carries a page footer dated July 16, 2026.[^1] ## The sentence that does the work Three things in that sentence carry weight. The first is the actor: a person, where a program document would name a control or an owner. The second is the standard of review, which has to end in agreement, and agreement read plainly is more than being informed or being able to intervene. The third is timing: before action is taken puts the step ahead of the moment the customer is affected, where an audit would sit after it. Scope is the part most likely to be underestimated. The bulletin is addressed to all regulated entities and their agents and representatives, and its authority list reaches the agent and adjuster licensing chapters directly.[^1] So this is not a claims rule with a wider preamble. Whether a given review is meaningful rather than nominal is the question our [agentic claims analysis](/agentic-ai-in-claims/) works through in one workflow; Texas turns that same question into a decision rule with far wider reach, covering underwriting, rating, servicing, and distribution alike wherever a consequential decision is being made. Which brings up the word the bulletin leaves open. Consequential appears exactly once in B-0003-26, in the review sentence, and the Texas bulletin defines nothing.[^1] Colorado uses the same adjective as a defined statutory term whose covered domains name insurance, and we treat that definition in our analysis of [Colorado's SB 26-189](/colorado-sb-26-189/). The two are not versions of one standard. Colorado's meaning comes from a statute in Colorado; Texas leaves the word to ordinary usage inside a bulletin. A team that has already drawn its Colorado line should not assume the line travels to Texas.
Two layers. The upper layer is the file a carrier builds on the NAIC model bulletin: a written AIS Program plus model inventory, validation, and vendor files, legible on sight in a state that adopted that text. Word counts in Texas Bulletin B-0003-26 show program zero times and inventory zero times, while consequential and third party each appear once. The lower layer is the expectation Texas states as a sequence: AI makes a consequential decision, then a person reviews and agrees, and only then is action taken. THE FILE BUILT ON THE MODEL BULLETIN WRITTEN AIS PROGRAM INVENTORY, VALIDATION, VENDOR FILES Legible in a state that adopted it. IN B-0003-26: PROGRAM 0 · INVENTORY 0 CONSEQUENTIAL 1 · THIRD PARTY 1 AI MAKES A CONSEQUENTIAL DECISION A PERSON REVIEWS AND AGREES ACTION IS TAKEN B-0003-26: "TDI expects a person to review and agree with all decisions before action is taken."
FIG. 1: WHERE THE TEXAS EXPECTATION ATTACHESSOURCE: TDI COMMISSIONER'S BULLETIN B-0003-26, JUNE 12, 2026; NAIC MODEL BULLETIN, ADOPTED DECEMBER 4, 2023
TDI has since described its own bulletin in firmer language than the bulletin uses. The department returned to the subject on September 14, 2026, in a letter to Governor Greg Abbott inside a memorandum on property and casualty affordability.[^4] It wrote that "[t]hrough a recently issued bulletin, TDI has made it clear to companies that any use of AI in making a consequential decision for policyholders must include a human review of the decision."[^4] The bulletin's own verb is expects; the letter's is must. Nothing in the letter amends the bulletin, and our dispatch on that letter treats it as the dated event it is. The other thing it commits the department to is at the end of this article. ## Counting what is not there The readings below are word-boundary regular expressions run over the bulletin's body text, the 7,501 characters between the dateline and the closing contact line, verified against the posted HTML on August 18, 2026 and re-read on September 22, 2026.[^1] **Table [row-headers]:** Model-bulletin vocabulary and how often each term appears in Texas Bulletin B-0003-26 | Term searched in B-0003-26 | Times it appears | |---|---| | `program` | 0 | | `inventory` | 0 | | `attest*` | 0 | | `quantitative` | 0 | | `notice` | 0 | | `third[- ]part*` | 1 | | `consequential` | 1 | These are counts in one document, and their reach ends at its edge. They say nothing about the rest of Texas law, including the ten code chapters the bulletin itself lists and the general AI statutes outside the insurance code. They are also not evidence about what the department values, only about what this text says. Put the first row beside the model bulletin and the contrast is structural. The NAIC text states that "all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices."[^2] On the Texas side, program is absent. What a written AIS Program contains, and how far its four guideline sections reach, belongs to our [analysis of the model bulletin](/naic-model-bulletin/). The reverse reading is just as blunt. In the model bulletin, consequential appears zero times and the phrase "review and agree" appears zero times; human involvement enters there as one of five factors that set how strong controls should be, phrased as "the extent to which humans are involved in the final decision-making process."[^2] Texas took a weighting factor in one document and made it a gate in another. Both texts decline to prescribe, and that similarity is worth stating precisely before anyone builds an argument on it. Texas writes: "The goal of this bulletin is not to prescribe specific practices or documentation requirements."[^1] The model bulletin closes its Section 4 with nearly the same sentence.[^2] So the disclaimer does not separate the two texts. What separates them is what survives it. The model bulletin declines to prescribe the contents of a written program it still expects to exist; the Texas text has no such program to leave unspecified. Third parties get one clause. The bulletin's second paragraph says the expectations "extend to any third party working with a regulated entity," and that clause is the only place the phrase appears.[^1] The model bulletin gives third-party data and systems a section of their own, covering due diligence and, where appropriate and available, contract terms providing audit rights and cooperation with regulatory inquiries.[^2] Texas supplies no contract mechanics at all, which is worth knowing before a vendor negotiation and is as far as this article goes; the diligence work itself lives in our [vendor risk assessment](/ai-vendor-risk-assessment/). Texas does have an older position on outside data, in Commissioner's Bulletin B-0036-20 from September 30, 2020.[^3] That bulletin makes the regulated entity answerable for the accuracy of third-party data used in rating, underwriting, and claims handling, and it states plainly that it creates no new legal duty, obligation, or standard of care. It never mentions AI.[^3] The text-by-text comparison of B-0003-26 against the NAIC model bulletin, each row carrying its quote and locator, sits on our [Texas state page](/states/texas/). ## What a Texas examination can cover One sentence in the bulletin describes the subject matter of an inquiry: "Regulated entities should expect TDI's monitoring of AI procedures and protections to include inquiries concerning governance frameworks, risk management, data and privacy protections, and internal controls."[^1] Two more set the mechanics. All regulated entities using AI "should be able to furnish procedures and protections upon request by TDI," and TDI says it "will monitor the use of AI through examinations and product filings," with consumer complaints as a third route into an investigation.[^1] The department also reserves the right to ask about any specific use of AI or its application, beyond the items the bulletin lists.[^1] Those four headings are the only account of an inquiry's subject matter this bulletin gives, and the reservation that follows them widens the ground again. What a given examination will actually request is not settled by the text, and no document in front of us settles it. A more specific list would be a projection, including ours, so this article does not offer one. Two sentences cut against the reading this article is built on, and they are the strongest evidence on the other side. The opening section says: "This bulletin also advises regulated entities of the type of information and documentation that TDI may request during an investigation or examination."[^1] The closing disclaimer runs the same way past the point usually quoted from it. The goal, it continues, "is to ensure that regulated entities are aware of TDI's expectations as to how AI will be governed and managed, as well as the kinds of information and documents TDI expects a regulated entity to produce when requested."[^1] The bulletin thus describes itself twice as being partly about documents, and a reader who stopped at either sentence would take Texas for a documentation regime. The distinction this article draws is narrower than either sentence and survives both: naming the kinds of information and documents TDI may request is not the same as requiring that any document be created. Both sentences speak to production on request, and neither brings into existence a document that a regulated entity did not otherwise have. Chapter 401 is where a request acquires teeth. That chapter requires "the maintenance of and, upon request from TDI, the production of all books and papers that relate to business and affairs."[^1] Read alongside the bulletin's disclaimer, our view is that this reaches records that exist rather than calling new records into being, which is a meaningful distinction for a company deciding how much of its Texas AI activity to write down. The NAIC evaluation tool is the obvious thing to fill that blank with, and it does not reach here. Texas is not among the twelve jurisdictions running the AI Systems Evaluation Tool pilot; the roster is in the footnote.[^5] Exhibits A through D therefore say nothing about the shape of a Texas [market conduct examination](/glossary/market-conduct-exam/). The two channels the bulletin names are TDI's own examinations and product filings, and of those two it is the filings a carrier supplies itself. Two pieces of work sit adjacent to this and are owned elsewhere. Assembling an organization-level readiness file, with a log of what is missing, belongs to our [exam documentation article](/market-conduct-exam-ai-docs-ready/). Reconstructing one AI-assisted decision, including who reviewed it and what they could change, belongs to the [decision evidence pack](/insurance-ai-decision-evidence-pack/). The Texas bulletin asks for neither, and being useful does not turn either one into a Texas obligation. ## The question the file does not answer What follows is this publication's reading, not a rule in the bulletin. A written AIS Program is a description of intent: here are our systems, our owners, our controls, our testing. Against the four inquiry headings it performs well, because those headings ask about frameworks, risk management, data protections, and controls, which is what a program document is made of. Against the review sentence it performs badly, because the review sentence is about an event. It asks whether, on a particular decision, a particular person saw the output and agreed with it before anything reached the customer. A policy stating that [human review](/glossary/human-in-the-loop/) occurs is an assertion that the event happens, which is not the same as the event. The second half of the difficulty is the undefined word. Because Texas does not say what makes a decision consequential, each company draws its own line, and two defensible lines produce very different workloads. Draw it at declinations, cancellations, and claim denials and the review population is small. Draw it at any decision that changes what a customer is offered or charged and it reaches quoting, renewal pricing, and servicing triage. Both readings sit comfortably inside a text that chooses between them nowhere, and the choice is the company's alone. There is a third asymmetry, and it cuts in the carrier's favor until it does not. The bulletin asks for the review and asks for no record of it, while Chapter 401 reaches books and papers that exist. A company can therefore satisfy the stated expectation with a workflow that leaves no trace, and then have nothing to show for it when asked how AI decisions are handled. Nothing on the face of the text makes that a Texas violation. What it becomes is uncomfortable, the first time someone outside the company wants to know what happened on one file. ## What is still open B-0003-26 is not a rule, and nothing in it announces one. The bulletin fixes no deadline, and it carries none of the written-program structure the model bulletin sets out. The live item is the one the September letter adds, and on the department's own list of planned administrative actions it is an analysis rather than a rulemaking. It is worth quoting rather than summarizing: "Using data from TDI exams and company surveys, TDI will produce a concise analysis of P&C insurers' use of AI prior to the legislative session."[^4] For a Texas AI file that is a reason to keep the account current rather than a new thing to build, and what the letter does and does not settle is worked through in the [dispatch that owns it](/news/texas-tdi-ai-analysis-directive-response/). What a Texas program can do this quarter needs no new instrument. Write down which decisions the company itself calls consequential and why; for each one, name who sees the AI output before the customer does, and say whether that person can change the outcome. The bulletin asks for none of that on paper. It is still the account that answers the one expectation Texas actually states, whether the question arrives from an examiner, a complaint, or a survey TDI has not reported sending. [^1]: Texas Department of Insurance, Commissioner's Bulletin # B-0003-26, "Use of artificial intelligence," June 12, 2026 (sections referenced above: header and opening paragraphs; Background; Legislative Authority, listing Texas Insurance Code Chapters 541, 542, 544, 831, 560, 4001, 4101, 4201, 751, and 401; Guidance and Expectations, including the consequential-decision review sentence, the four inquiry headings, the examinations-and-product-filings sentence, and the closing paragraphs on prescribing practices and on regulatory judgment). Word-boundary counts in the article were run over the 7,501 characters of body text between the June 12, 2026 dateline and the closing contact line, verified August 18, 2026; the posted page, whose footer reads "Last updated: 7/16/2026," was retrieved again on September 22, 2026 (HTTP 200) and the quoted sentences were present unchanged: https://www.tdi.texas.gov/bulletins/2026/b-0003-26.html [^2]: National Association of Insurance Commissioners, "Model Bulletin: Use of Artificial Intelligence Systems by Insurers," adopted by the Executive (EX) Committee and Plenary December 4, 2023 (Section 3 introduction, pp. 4 to 5, for the five factors including the extent of human involvement in final decision-making, and p. 4 for the written AIS Program sentence; Section 4.0 third-party guidelines at §§4.1 and 4.2, p. 7; the closing paragraph of SECTION 4, p. 9, for the statement that the goal of the bulletin is not to prescribe specific practices or documentation requirements). Counts of "consequential" and "review and agree" were run over the 9-page, 28,577-character text: https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf [^3]: Texas Department of Insurance, Commissioner's Bulletin # B-0036-20, "Insurers' use of third-party data," September 30, 2020 (body text, which states that regulated entities are responsible for the accuracy of data used in rating, underwriting, and claims handling even when a third party provides it, and that the bulletin does not create a new legal duty, obligation, or standard of care; "artificial intelligence," "AI," "algorithm," "model," and "machine learning" each appear zero times across its 876 characters of body text, checked August 18, 2026): https://www.tdi.texas.gov/bulletins/2020/B-0036-20.html [^4]: Texas Department of Insurance, Commissioner of Insurance Amanda Crawford, letter to Governor Greg Abbott responding to his directive, September 14, 2026 (Section B, "Additional Administrative Actions," first item, "Analysis of the use of AI in property and casualty (P&C) claims handling and underwriting"): https://www.tdi.texas.gov/reports/documents/tdi-oog-directive-response.pdf [^5]: National Association of Insurance Commissioners, "AI Systems Evaluation Tool Pilot: Pilot Project Summary," p. 1, participating states list (California, Colorado, Connecticut, Florida, Iowa, Louisiana, Maryland, Pennsylvania, Rhode Island, Vermont, Virginia, Wisconsin; Texas is not listed). The NAIC's call-materials path now redirects to this address: https://content.naic.org/sites/default/files/inline-files/Pilot%20Project%20Summary_1.pdf