The NAIC AI model bulletin asks insurers to govern AI according to the consumer decisions it influences. It sets out expectations for a written AI systems program and the evidence an insurance department may examine. Its adoption by the NAIC on December 4, 2023 did not create one nationwide AI insurance law.
For an insurance product team, the first question is therefore jurisdictional: which state requirements apply to the insurer and the particular decision? The next question is operational: can the team explain who owns that decision and how the AI contribution was checked?
What the bulletin is
The NAIC describes its adopted model bulletin as guidance for state insurance regulators, rather than a model law or regulation. It aims to make expectations more consistent while reminding insurers that existing insurance rules still apply when AI supports their work.
A reader should distinguish the NAIC document, a state department’s adopted bulletin and the underlying law. A reference to the national model alone cannot establish the exact obligations of an insurer in every jurisdiction. This guide explains the model’s structure; it does not provide a state adoption inventory or a legal opinion.
New York has its own guidance. Read our explanation of NYDFS Circular Letter 7 for the separate underwriting and pricing context.
Where AI enters the insurance process
The NAIC’s AI topic page describes uses across marketing, underwriting, pricing and claims. An AI system can influence a customer’s outcome even when an employee makes the final click.
Consider a hypothetical claim-review assistant. One version retrieves policy wording for an employee. Another recommends whether a claim should be paid. Both use software, but the second affects a decision much more directly. The review should identify the task, the data supplied, the output and what an employee does with it.
That process map is useful before debating model names. A team cannot assign effective controls if it has not recorded where a recommendation becomes an action.
What belongs in an AIS Program
The model bulletin’s program guidelines address governance, risk controls and audit. They place oversight with senior management accountable to the board or an appropriate board committee, cover the system life cycle and include third-party systems.
A practical implementation could connect each use case to a business owner, approval record, test evidence and escalation route. Those are proposed working records, not a mandatory form supplied by the NAIC:
| Working record | Question it should answer |
|---|---|
| Use-case description | Which insurance decision does the system influence? |
| Responsibility record | Who can approve, restrict or stop its use? |
| Review evidence | What was checked before deployment? |
| Change record | What changed after the original approval? |
| Incident record | What happened and who decided the response? |
A small number of useful records is preferable to a large folder that cannot reconstruct an actual decision. The test is whether another reviewer can follow the process without relying on the developer’s memory.
Buying a model does not remove the review
The bulletin addresses diligence on external AI and data, with contractual audit and regulator-cooperation considerations where appropriate and available. It also anticipates examination of testing, documentation and model drift. Controls should reflect potential consumer harm.
For a proposed vendor integration, ask who can supply information when a result is challenged. Does the insurer receive version identifiers? Can it identify the data used for a particular decision? What happens when the vendor changes the model or withdraws a feature?
These are procurement questions to resolve before launch. A contract promising high accuracy does not itself show how an individual output can be investigated. Our guide to third-party AI risk in financial services develops that wider operational problem.
Keep later NAIC work separate
The NAIC’s Big Data and Artificial Intelligence Working Group also publishes work on regulatory evaluation tools. Its current page lists an AI Risk Evaluation Supplement version 6.0 exposure with a comment period ending October 30, 2026, and a November 2 meeting to continue discussion.
An exposure draft is not evidence of final adoption. Teams should record the document title, version and status when using later materials, instead of treating every NAIC AI document as the same instrument.
The distinction also matters when a vendor presents a compliance checklist. Ask which document the checklist implements, which version it uses and whether the relevant state has issued its own text.
