What the NAIC Is, and What It Cannot Do

Insurance compliance runs on documents the National Association of Insurance Commissioners (NAIC) writes and cannot enforce. Model laws, bulletins, handbooks, evaluation tools: they arrive numbered, formal, and cited everywhere as though they were binding. None of them is.

Behind them sits a nonprofit whose members are the state officials who can pass rules, open examinations, levy fines, and pull licenses. The organization itself can do none of those things. That gap produces two expensive misreads, one in each direction: treating an NAIC document as law the day it is issued, and treating “our state never adopted it” as safety. Both come from the same root, so the root is worth getting right.

The organization behind the documents

The NAIC is a standard-setting and support organization. Founded in 1871, it is governed by the chief insurance regulators of every state, plus the District of Columbia and five U.S. territories.¹ Its own description of its mission is narrow: to support those regulators. Not to regulate insurers. To support the people who do.

Legally, it is a nonprofit. It has no statutory authority over any insurer, producer, or policyholder. It cannot open an examination, issue a fine, revoke a license, or order a company to stop doing anything. No insurance company has ever answered to the NAIC in the way it answers to a state insurance department.

What the NAIC does have is convening power and infrastructure. It drafts model laws and model regulations for state legislatures to pick up. It issues guidance, like the NAIC Model Bulletin on AI, that tells state regulators how to read their existing law against a new practice. It runs the shared plumbing of state regulation: the filing systems, the financial databases, the producer licensing registry, the accreditation program that state solvency regulation runs on. And it coordinates, so that when a problem crosses state lines, the state regulators who do hold the authority can move together.

That is a large operational footprint, and it is exactly why the confusion persists. An organization that runs the filing systems and writes the model text looks like a regulator from the outside. The difference only shows when you ask the one question that matters: who can make you do something?

The three things it cannot do

It cannot write law. A model law is a draft statute. It has no legal force anywhere until a state legislature enacts it, and legislatures routinely modify the model text, adopt it in part, or ignore it entirely. The same is true down the line: a model regulation needs a state regulator to promulgate it, and a bulletin needs a state to issue it. The NAIC produces templates. States produce law.

It cannot enforce. Enforcement in U.S. insurance belongs to state insurance departments, acting under state law. The examination, the consent order, the fine, the license action, all of it runs through a state department of insurance, not through Kansas City. The NAIC can coordinate a multi-state exam and supply the framework for it, but the legal action against a company is always a state’s action.

It cannot bind you by publishing. This is the one that costs people money. When the NAIC adopts a bulletin, the document is real and the expectations in it are real, but nothing obligates an insurer until a state acts on it. Publication opens the adoption question; your state closes it.

Where its power comes from

If the NAIC can do none of these things, why does everyone read its documents like rules? Because the states do.

The mechanism works like this. The NAIC’s members are the state regulators themselves. When those members adopt a product at the NAIC, they are signaling what they intend to ask for back home, in their own exams, under their own authority. A bulletin previews how your regulator may read the law you are already under. By the time the document exists, the conversation that produced it has already happened among the people who will examine you.

That is why the practical effect of an NAIC product is often near-national even though nothing national issued it. When enough states adopt the same model, the template becomes the de facto baseline, and operating against it in one state while ignoring it in the next stops making sense. The NAIC AI Model Bulletin is the cleanest current case: adopted at the NAIC on December 4, 2023, picked up by roughly half the states in one form or another, and pointed everywhere it went at authority that already existed.² What that document actually asks carriers to build is the subject of our NAIC Model Bulletin guide. The point here is narrower: whatever force it carries in your state was supplied by your state.

There is also a second channel, quieter but real: accreditation. The NAIC runs the program that lets one state rely on another’s financial oversight instead of repeating it, which is why a company licensed in an accredited state is not examined financially by every jurisdiction it writes in.³ States care about their standing in that program, and that gives the NAIC’s standards a gravitational pull a trade association would never have. The pull is still exercised through the states. The NAIC does not discipline the companies its members regulate. It shapes what those members ask for.

The coordination problem it was built for

The NAIC exists because nobody else coordinates this. Congress put insurance in the states’ hands in 1945 and left it there, subject to one exception whose wording is narrower than the way it usually gets quoted: a federal statute overrides state insurance law only where that statute “specifically relates to the business of insurance.”⁴ Those last three words carry the test. The question is not whether a federal law touches insurance somewhere; it is whether Congress was legislating about the insurance business itself. That allocation lives in the McCarran-Ferguson Act, and the system built on top of it is laid out in how U.S. insurance regulation actually works.

Fifty-plus regulators, each with its own statute, have an obvious coordination problem, and the NAIC is the answer they built for themselves: draft once and adopt locally, share the examination infrastructure, speak to Washington with one voice when they choose to. Which is how the most influential body in U.S. insurance regulation ended up being one that cannot regulate anyone.

The two mistakes this prevents

Once the structure is clear, two common errors read differently.

The first is treating an NAIC document as binding on publication day. It is not, and acting as if it is leads to misallocated compliance work: building to a model your state modified, or ignoring one your state adopted with extra teeth. The document tells you what is coming. What your state did with it tells you what arrived.

The second is the mirror image: treating non-adoption as safety. The unfair-trade-practices and unfair-discrimination laws that NAIC products point at exist in every state already, with or without the model text. A state that never adopted the AI bulletin can still examine your AI under the authority it always had. The bulletin changes how predictable the questions are, not whether they can be asked.

Both errors come from reading the document instead of the authority behind it. The authority was there first, and it is the only thing in the room that can open a file on you.

The useful habit is a two-step check for every NAIC document that lands on your desk. First: what is this, a model law, a regulation, a bulletin, a handbook? That tells you the adoption path. Second: what has my state done with it, enacted, issued, modified, ignored? That tells you your actual exposure. The state adoption tracker exists for exactly that second step; the layer above it, where the AI rules sit inside this structure, is the AI governance in insurance guide. The NAIC writes the template. Your state decides what it costs you.

Footnotes

1. NAIC, “Our Story,” about page: the National Association of Insurance Commissioners “provides expertise, data, and analysis for insurance commissioners to effectively regulate the industry and protect consumers,” “Founded in 1871,” and “governed by the chief insurance regulators from the 50 states, the District of Columbia, and five U.S. territories to coordinate regulation of multistate insurers.” https://content.naic.org/about ↩

2. NAIC, Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted December 4, 2023: https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf. State adoption status per the NAIC’s implementation map (24 states plus the District of Columbia on the map’s Reference List, status as of April 1, 2026): https://content.naic.org/sites/default/files/cmte-h-big-data-artificial-intelligence-wg-map-ai-model-bulletin.pdf. This site’s per-state record, with each jurisdiction’s own document, is at /states/. ↩

3. NAIC, “Accreditation,” insurance topics page: the Financial Regulation Standards and Accreditation Program “allows non-domestic states to rely on the accredited domestic regulator to fulfill a baseline level of effective financial regulatory oversight,” with the result that companies licensed in accredited states “are then not subject to financial examinations or other financial oversight by multiple jurisdictions.” The program covers financial regulation only; market conduct is standardized separately, through the Market Regulation Handbook. https://content.naic.org/insurance-topics/accreditation ↩

4. McCarran-Ferguson Act, 15 U.S.C. §§ 1011–1015 (1945), enacted after United States v. South-Eastern Underwriters Association, 322 U.S. 533 (1944). Section 1012(b): no Act of Congress “shall be construed to invalidate, impair, or supersede any law enacted by any State for the purpose of regulating the business of insurance” unless “such Act specifically relates to the business of insurance.” https://www.law.cornell.edu/uscode/text/15/1012 ↩