Reference · Insurance
NAIC Model Bulletin on the Use of AI by Insurers, Explained
Model Bulletin: Use of Artificial Intelligence Systems by Insurers
The NAIC Model Bulletin sets out how state insurance regulators expect insurers to govern the artificial intelligence systems that make or support regulated decisions: underwriting, rating, claims, marketing, and fraud detection. It was adopted by the NAIC on 4 December 2023 and, as a bulletin rather than a model law, takes effect in each state when that state's insurance department issues it. As of the NAIC's Spring 2026 meeting it is in effect in 24 states and the District of Columbia.
Who it applies to
Insurers licensed in an adopting state, across life, property and casualty, and health lines. The bulletin applies existing law (the Unfair Trade Practices Act, the Unfair Claims Settlement Practices Act, corporate governance and market-conduct examination laws) to decisions made or supported by AI. It creates no new statute; it tells insurers how the department will read the statutes it already enforces.
Expectations are proportionate to the insurer's use of AI and the degree of potential harm to consumers. A carrier using a servicing chatbot faces a lighter program than one using AI in underwriting.
What Section 3 expects: the AIS Program
- A written AI Systems Program, proportionate to the insurer's use of AI, with senior management accountable to the board.
- Governance: policies, procedures, and a documented risk-tiering approach based on the degree of potential harm.
- Risk management and internal controls: inventories of AI Systems and predictive models, traceability, record retention, and lifecycle oversight from development through retirement.
- Protection of non-public consumer information reaching an AI System.
- Third-party diligence: contracts with AI and data vendors that include audit rights and regulator cooperation. An LLM provider is a third party under the bulletin.
What Section 4 asks for on examination
Section 4 lists what a market-conduct examination may request: the written program and evidence of its adoption, the AI System inventory and per-system documentation, validation and testing records, third-party contracts, and the insurer's process for handling consumer complaints about AI-supported decisions. It names generative AI explicitly.
The state layers
- Colorado Regulation 10-1-1 (3 CCR 702-10), amended effective 15 October 2025, adds governance and risk-management requirements for life insurers, and from 1 July 2026 for private passenger auto and health benefit plans, that use external consumer data and information sources. It requires evidence on request and an annual officer-attested report.
- New York DFS Circular Letter No. 7 (11 July 2024) addresses AI and external consumer data in underwriting and pricing.
- Texas Bulletin B-0003-26 (12 June 2026) expects a person to review consequential AI-supported decisions before action.
- Connecticut Bulletin MC-25 (26 February 2024) requires an annual AI certification from each domestic insurer.
Control mapping
What a reviewer expects to be able to see.
| Obligation | What the system must do | Evidence a reviewer expects |
|---|---|---|
| AI System inventory | Maintain a current inventory of AI Systems that make or support regulated decisions, with the third-party providers behind them | Inventory with system purpose, decision type, degree-of-harm tier, and provider |
| Written AIS Program | Adopt a written program with board-level accountability and proportionate controls | The program document, its adoption record, and evidence it operates |
| Non-public information | Control what consumer data reaches an AI System and what comes back | Data-flow records and detection findings per system |
| Change control | Detect unapproved changes to a deployed system and show the approved controls were in force | Configuration history, drift findings, and enforcement records |
| Testing and validation | Test for unfair discrimination and document validation of predictive models | Testing methodology, results, and remediation records |
| Third-party diligence | Contract for audit rights and regulator cooperation with AI and data vendors | Contracts, diligence files, and vendor documentation |
Key dates
- 4 December 2023NAIC adopts the Model Bulletin.
- 26 February 2024Connecticut issues Bulletin MC-25 with an annual AI certification.
- 11 July 2024New York DFS issues Circular Letter No. 7 on AI in underwriting and pricing.
- 15 October 2025Colorado's amended Regulation 10-1-1 takes effect.
- Spring 2026Bulletin in effect in 24 states and DC.
- 12 June 2026Texas issues Bulletin B-0003-26.
- 1 July 2026Colorado Regulation 10-1-1 reaches private passenger auto and health benefit plans.
Primary sources
Common gaps
Where insurers most often struggle when examined against the bulletin.
- An inventory built from a survey. Inventories assembled by asking business units miss the chatbot a team switched on last quarter. Examiners find it in the complaint file.
- A program with no operating evidence. A written AIS Program answers the first Section 4 request. The second request is for evidence it operates, and a policy document cannot supply that.
- Generative AI treated as out of scope. The bulletin names generative AI. A servicing assistant that summarizes a claim file supports a regulated decision.
- Vendor contracts without audit rights. An LLM provider is a third party under the bulletin. Standard API terms rarely include the audit and regulator-cooperation clauses the bulletin expects.
- State layers tracked separately. Colorado's evidence-on-request and annual report, Connecticut's certification, and Texas's human-review expectation each have a date. Firms track the bulletin and miss the layers.
In practice
Related
Last reviewed September 4, 2026. This reference summarises publicly available regulatory guidance and is provided for general information. It is not legal advice. Obligations depend on an institution's charter, registration status, size, and activities. Verify against the primary sources cited above and consult counsel before relying on any summary here.