How U.S. Insurance Regulation Actually Works

If you arrive in insurance from banking, tech, privacy, or AI policy, you bring a mental model with you: there is a federal agency, it writes rules, and compliance means answering to it. Securities has the SEC. Banks have the OCC and the Fed. Privacy people are learning the FTC. You open the insurance equivalent of that map and find nothing at the center.

There is no primary federal insurance regulator, and there has not been one for over a century and a half. This page is the map that replaces the one you brought: why the system is built this way, who the actors are, what they control across the life of a policy, and where the rules you will actually deal with, including the AI ones, attach to it.

Insurance companies in the United States are regulated state by state. The authority sits with the insurance department of each of the fifty states, plus the District of Columbia and the U.S. territories: it decides who may sell insurance there, what the policy may say, in many states what it may cost, and whether the company is treating policyholders fairly and holding enough money to pay them. The National Association of Insurance Commissioners writes the model texts those departments work from and runs the systems they share, but it holds no enforcement power of its own. The arrangement dates to the McCarran-Ferguson Act of 1945.¹

If your gap runs the other way, start elsewhere. Readers who have worked in insurance for years, and find that the technology is the new part, want the business-line map: where the systems already sit, and which of them a regulator has started asking about.

Why the states, and not Washington

The allocation was not inevitable. The Supreme Court spent decades treating insurance as a local matter, then reversed course in 1944 and pulled it into federal reach as interstate commerce.¹ Congress answered within a year with the McCarran-Ferguson Act, returning primary authority over the business of insurance to the states. Its operative rule still runs the table: no Act of Congress displaces a state insurance law unless that Act specifically relates to the business of insurance.¹

The practical consequence, eighty years on, is a system with no center. Every one of those fifty-plus jurisdictions licenses its own insurers, regulates what their products may say and in many states what they may cost, examines their behavior, and enforces its own law. A carrier writing business nationally answers to all of them at once.

This is the first place the outsider’s model breaks. Federal actors touch insurance at the edges, the Treasury’s Federal Insurance Office studies and convenes, the Gramm-Leach-Bliley Act sets a data floor and then hands insurance enforcement to the states,² and the executive order aimed at state AI laws never names insurance at all. McCarran-Ferguson is the shield state regulators say they would raise, and it speaks to Acts of Congress, not to executive orders.¹ But none of these is a supervisor. The supervisor is the state.

The actors

Three actors account for nearly everything that happens in this system.

Start with the state department of insurance, headed by a commissioner, superintendent, or director depending on the state. This is the regulator in the full sense of the word. It licenses companies and the people who sell for them, approves or reviews policy forms and in many states the rates themselves, examines insurers’ finances and conduct, investigates complaints, and disciplines licensees. When you read that an insurer was fined, ordered to repay policyholders, or had a product withdrawn, a state department did that.

Those departments built a second actor for themselves: the NAIC, a member organization founded in 1871 and run by the regulators to this day.³ It drafts model laws and bulletins, runs the shared filing systems and databases, and coordinates multi-state work. Its products shape what the states require, but it is a standard-setter, not a supervisor: it cannot pass a law, open an exam, or fine anyone, and everything it produces binds only after a state adopts it. That distinction has its own full treatment in what the NAIC is, and what it cannot do.

Then there is the licensed population: insurers, and the producers, agencies, and other entities holding state insurance licenses. The obligations in this system run to licensees. If your company holds the license, your company holds the duty, whatever vendor or partner actually performed the work. That principle decides more real compliance questions than the doctrine above it.

What regulators control across the life of a policy

The cleanest way to see the system’s reach is to follow a policy through its life.

At the front end sits the license. No one sells insurance in a state without the state’s permission, and the license is the hook everything else hangs from. Before a product reaches the market, most states require the policy forms to be filed, and many require the rates to be filed as well, with some states approving rates before use and others allowing filing with later review. The underwriting and pricing that follow are lawful only within what the state allows: states restrict which factors can be used, and unfair-discrimination law runs underneath all of it.

Once the policy exists, the behavior rules take over. Claims must be investigated and paid on statutory clocks. Marketing and sales practices are regulated, and producers answer personally for them. Consumer complaints go to the department, and the complaint record follows the company. And behind the conduct sits the money: solvency regulation watches whether the company can pay what it promises, through financial statements, reserve requirements, and examinations.

Supervision runs through two examination regimes. One reads the company’s books. The other reads its files: claim samples, complaint logs, procedure manuals. Its standard areas span the whole lifecycle, from producer licensing through marketing, underwriting and rating, and claims.⁴ That second one is the market conduct exam, and it is the room where most consumer-facing rules, old or new, are actually enforced.

Lines of business, and why the layers matter

“Insurance” is three industries sharing a name, and the rules know it. Property and casualty, life and annuities, and health are licensed separately, priced differently, and in important ways regulated under different chapters of state law. Health sits under the heaviest additional overlay, including federal statutes that do specifically relate to the business of insurance and therefore coexist with McCarran-Ferguson. One of them cuts the other way: ERISA, the federal employee-benefits statute, preserves state regulation of insurance but bars a state from treating a self-funded employer health plan as an insurer, which puts those plans outside the state insurance department’s reach.⁵

The layering matters because every rule has a reach, usually drawn by line. A rate-filing rule that governs auto insurance says nothing about life insurance. A prior-authorization rule runs through health and stops there. When you evaluate any obligation, the first question after “which states” is “which lines,” and the answer is rarely “all of them.”

How the pieces stay coordinated

A system of fifty-plus regulators sounds like chaos. The NAIC’s machinery is most of the reason it is not. Model laws let fifty legislatures start from the same text. Accreditation spares the other states from re-doing the domestic regulator’s solvency review.⁶ Shared systems, the filing platforms, the complaint and enforcement databases, the Market Conduct Annual Statement, give every state the same operating picture. When an issue crosses state lines, a data breach at a shared vendor, a market practice spreading across the industry, the coordination happens through those channels. The data security model law shows the result: one template, enacted state by state, until it reads like a national standard without ever having been one.

Federal pressure on the arrangement arrives periodically, and the current round on AI is not the first. The 1944 case described above is the sharpest instance on record, and what it produced was McCarran-Ferguson, not a federal regulator.¹ Gramm-Leach-Bliley took the quieter route in 1999: a federal floor, with enforcement of it assigned to the state insurance authorities.² Neither displaced the state system, and both left the supervisory relationship where it was.

Where the AI rules land on this map

Nothing about insurance AI regulation escapes this structure. The NAIC Model Bulletin is an NAIC template a state issues to its own insurers, resting on authority the state already held. The states that moved on their own, Colorado, New York, California, Texas, did so as states, through their own statutes, letters, and rules; which jurisdiction has done what is recorded in the state AI regulation tracker.

The enforcement channel for all of it is the market conduct machinery described above, with AI folded into the existing exam rather than given a new one. The full treatment of that layer is the AI governance in insurance guide, and if you are still working out whether any of it reaches your organization, the plain-language self-check runs five questions against your own book.

Every question in this field resolves into three names: which state, which license, which instrument, the filing, the exam, or the enforcement letter. Supply those three and any specific rule has somewhere to sit. The guide map above takes the parts that carry the most weight one level down; everything else the desk holds is in the topic index, sorted by instrument and by line.

FAQ

Footnotes

1. McCarran-Ferguson Act, 15 U.S.C. §§ 1011–1015 (1945), enacted the year after United States v. South-Eastern Underwriters Association, 322 U.S. 533 (1944), held insurance to be interstate commerce. Section 1012(b) bars any Act of Congress from superseding a state law “enacted for the purpose of regulating the business of insurance” unless “such Act specifically relates to the business of insurance.” https://www.law.cornell.edu/uscode/text/15/1012 ↩ ↩² ↩³ ↩⁴ ↩⁵

2. Gramm-Leach-Bliley Act, 15 U.S.C. § 6805(a)(6): enforcement of the Act’s privacy and safeguards provisions with respect to persons engaged in providing insurance is assigned to state insurance authorities, not to a federal agency. https://www.law.cornell.edu/uscode/text/15/6805 ↩ ↩²

3. NAIC, “Our Story”: founded in 1871, the association is run by the chief insurance regulators of the states, the District of Columbia, and the U.S. territories, and exists to coordinate their regulation of multistate insurers. https://content.naic.org/about ↩

4. NAIC, Market Regulation Handbook: Examination Standards Summary (2025 ed., ISBN 978-1-64179-497-8). Chapter 20, General Examination Standards, lists seven standard areas of review: Operations/Management, Complaint Handling, Marketing and Sales, Producer Licensing, Policyholder Service, Underwriting and Rating, and Claims. The Summary is “a compilation of the market conduct examination standards found in the 2025 edition of the Market Regulation Handbook” and states that it “does not represent all examination standards, methodologies and areas of review that may be utilized by a department of insurance.” https://content.naic.org/sites/default/files/publication-mes-hb-market-handbook-examination.pdf ↩

5. Employee Retirement Income Security Act § 514, 29 U.S.C. § 1144(b)(2). Subparagraph (A) saves “any law of any State which regulates insurance” from ERISA preemption; subparagraph (B), the deemer clause, provides that an employee benefit plan shall not “be deemed to be an insurance company or other insurer … or to be engaged in the business of insurance … for purposes of any law of any State purporting to regulate insurance companies, insurance contracts, banks, trust companies, or investment companies.” https://www.law.cornell.edu/uscode/text/29/1144 ↩

6. NAIC, “Accreditation,” insurance topics page: the Financial Regulation Standards and Accreditation Program “allows non-domestic states to rely on the accredited domestic regulator to fulfill a baseline level of effective financial regulatory oversight,” with the result that companies licensed in accredited states “are then not subject to financial examinations or other financial oversight by multiple jurisdictions.” https://content.naic.org/insurance-topics/accreditation ↩