NAIC Model Bulletin on the Use of AI by Insurers, Explained

The bulletin creates no new statute. It tells insurers how the department reads the laws it already enforces when a decision is made or supported by AI: the Unfair Trade Practices Act, the Unfair Claims Settlement Practices Act, the Corporate Governance Annual Disclosure Act and its regulation, the Property and Casualty Model Rating Law, and the Market Conduct Surveillance Model Law.NAIC Model Bulletin · Section 1↗ Those laws require decisions that are not inaccurate, arbitrary, capricious or unfairly discriminatory, and compliance is required "regardless of the tools and methods" an insurer uses.NAIC Model Bulletin · Section 3↗

It is addressed to every insurer licensed in the adopting state. The program it expects is tailored to and proportionate with the insurer's use of and reliance on AI, and its controls follow the degree of potential harm to consumers.NAIC Model Bulletin · Section 3, 1.4↗

The table lists every jurisdiction the NAIC's implementation map shows as having adopted the bulletin, with the instrument and date the map cites. Twenty-three issued a bulletin; six used a commissioner memorandum, guidance document, notice, administrative letter, technical assistance advisory or ruling letter. The most recent adoptions are Puerto Rico on 11 June 2026, Mississippi on 22 July 2026, South Carolina on 24 September 2026 and North Dakota on 5 October 2026. The remaining 19 states show no action on the map.NAIC map↗

Adoption counts published elsewhere vary with their cut-off date and with how they treat the four states in the next section. This page follows the NAIC map alone.

The NAIC map places four states in a separate category, insurance-specific regulation or guidance.NAIC map↗ Each reaches insurer use of AI or external consumer data through its own instrument, with its own scope.

• California: Bulletin 2022-5 of 30 June 2022 addresses racial bias and unfair discrimination in marketing, rating, underwriting and claims practices, including bias that can result from artificial intelligence and other forms of big data.CDI Bulletin 2022-5↗
• Colorado: Regulation 10-1-1 (3 CCR 702-10) has applied to life insurers since 14 November 2023 and, as amended effective 15 October 2025, to private passenger auto and health benefit plan insurers that use external consumer data. It requires a governance framework available on request and an annual report signed by an officer.3 CCR 702-10 · Sections 3, 5, 6↗
• New York: DFS Insurance Circular Letter No. 7 of 11 July 2024 covers AI systems and external consumer data and information sources in underwriting and pricing.DFS Circular Letter 7↗
• Texas: the map cites Bulletin B-0036-20 of 30 September 2020, which holds regulated entities responsible for the accuracy of data used in rating, underwriting and claims handling, even when a third party supplies it.TDI B-0036-20↗ The Department's Bulletin B-0003-26 of 12 June 2026, which the map does not yet list, sets its expectations for AI: where a regulated entity uses AI to make a consequential decision, the Department expects a person to review and agree with all decisions before action is taken.TDI B-0003-26↗

• Colorado Regulation 10-1-1, explained →

Every insurer is expected to develop, implement and maintain a written program for the responsible use of AI Systems that make or support decisions related to regulated insurance practices, the AIS Program.NAIC Model Bulletin · Section 3↗ Its guidelines cover:

• Accountability: senior management accountable to the board or an appropriate board committee.NAIC Model Bulletin · Section 3, 1.3↗
• Scope: AI Systems across the insurance life cycle, from product development and design, marketing, underwriting, rating and pricing to case management, claim administration and payment, and fraud detection, whether the insurer built them or a third-party vendor did.NAIC Model Bulletin · Section 3, 1.6, 1.8↗
• Governance: committees drawn from the relevant disciplines, with monitoring, auditing, escalation and reporting protocols and ongoing training and supervision of personnel.NAIC Model Bulletin · Section 3, 2.3↗
• Risk management and internal controls: an approval process, data practices covering lineage, quality and bias analysis, inventories, documentation and drift assessment of predictive models, validation and testing, protection of non-public information, and record retention.NAIC Model Bulletin · Section 3, 3.1 to 3.6↗
• Third parties: due diligence on AI Systems and data acquired from others and, where appropriate and available, contract terms that give audit rights and require cooperation with regulatory inquiries.NAIC Model Bulletin · Section 3, 4.1 to 4.3↗
• Consumer notice: telling impacted consumers that AI Systems are in use.NAIC Model Bulletin · Section 3, 1.9↗

Section 4 lists what a department may request in an investigation or market conduct examination: the written program and evidence of its adoption; evidence that it is implemented and followed; inventories and descriptions of the predictive models and AI Systems that can result in adverse consumer outcomes; the data sources, provenance, lineage, techniques and thresholds behind a system; validation and testing records, including evaluation of model drift, whether a system is built on predictive models or generative AI; and the diligence, contracts and audits for third-party systems.NAIC Model Bulletin · Section 4↗

The bulletin has no separate provision for life or annuity business; it applies to every insurer licensed in an adopting state.NAIC Model Bulletin↗ For a life or annuity carrier, its legal anchors are the Unfair Trade Practices Act, the Unfair Claims Settlement Practices Act, the corporate governance annual disclosure rules and the market conduct surveillance law. The Property and Casualty Model Rating Law it also cites reaches property and casualty rates only.NAIC Model Bulletin · Section 1↗

The AIS Program covers AI Systems used in product development and design, marketing, underwriting, rating and pricing, case management, claim administration and payment, and fraud detection, whether the insurer built them or bought them.NAIC Model Bulletin · Section 3, 1.6, 1.8↗ For a life or annuity carrier's systems, Section 3 expects:

• Governance: senior management accountable to the board, a committee drawing on actuarial, underwriting, claims, data science, compliance and legal, and documented monitoring, escalation and training protocols.NAIC Model Bulletin · Section 3, 1.3, 2.3↗
• Risk management: an approval process before an AI System is used, data lineage and bias analysis for the data behind underwriting and pricing, inventories and documentation of predictive models, validation and drift assessment, protection of non-public consumer information, and record retention.NAIC Model Bulletin · Section 3, 3.1 to 3.6↗
• Third-party AI: diligence on the vendors behind underwriting data, scoring engines and generative AI tools, with audit rights and regulator cooperation in contracts where appropriate and available.NAIC Model Bulletin · Section 3, 4.1 to 4.3↗
• Consumer notice: processes that tell impacted consumers AI Systems are in use, with information suited to the phase of the insurance life cycle.NAIC Model Bulletin · Section 3, 1.9↗

Section 4 applies to life and annuity carriers as written. An examiner can request the written program and evidence it was adopted and operates; the inventory of predictive models and AI Systems that can result in adverse consumer outcomes; the data sources, techniques and thresholds behind a specific system; validation, testing and drift records; and the diligence, contracts and audits for third-party systems.NAIC Model Bulletin · Section 4↗ An AI System that supports annuity sales, marketing or servicing sits in the same program.

Colorado's Regulation 10-1-1 has applied to individually issued life insurance since 14 November 2023. It requires a governance and risk management framework aimed at unfair discrimination with respect to race, a version-controlled inventory of external consumer data sources, algorithms and predictive models, a description of the quantitative testing conducted, the framework available on request since 1 December 2024, and an annual compliance report signed by an officer and filed in SERFF. For life insurers, its definition of external consumer data adds occupation without a direct relationship to mortality, morbidity or longevity risk.3 CCR 702-10 · Sections 4.D, 5, 6↗

• Colorado Regulation 10-1-1: the life insurer requirements →