If you are an insurer using AI anywhere that touches consumers, regulators in many states now expect you to have a written program that governs it. That expectation comes from one document: the NAIC model bulletin on the Use of Artificial Intelligence Systems by Insurers.
Short answer: the bulletin does not create new law. It reminds insurers that existing insurance laws apply to decisions made or supported by AI, and it asks each insurer to keep a written AI Systems program (an "AIS Program") covering governance, risk management, internal controls and third-party vendors. Regulators can ask to see that program, and the evidence behind it, during an investigation or market conduct exam.
What is the NAIC AI model bulletin?
The National Association of Insurance Commissioners adopted the model bulletin on December 4, 2023. A model bulletin is a template. It has no force in a state until that state's insurance department issues it, sometimes with its own edits.
The bulletin is framed as a reminder rather than a new rule. It states that actions taken by insurers "must not violate the UTPA or the UCSPA, regardless of the methods" used to reach them. UTPA and UCSPA are the Unfair Trade Practices Act and the Unfair Claims Settlement Practices Act, which most states already have in some form. It also says that "the goal of the bulletin is not to prescribe specific practices or to prescribe specific documentation requirements."
Its definition of an AI System is broad: machine-based systems whose outputs, such as predictions, recommendations or content, influence decisions. That reaches past underwriting into claims, fraud, marketing and service tools.
Which states have adopted it?
As of October 8, 2026, the NAIC's own adoption map lists 29 jurisdictions that have adopted the bulletin, including the District of Columbia and Puerto Rico. Four more states, California, Colorado, New York and Texas, are listed separately as having insurance-specific AI regulation or guidance.
Check the current NAIC implementation map and the bulletin as issued by each state where you hold a certificate of authority. A state's version can differ in wording from the model.
What the bulletin asks insurers to do
The core expectation is that insurers "develop, implement, and maintain a written program" for the responsible use of AI Systems. The bulletin adds that "the AIS Program should be designed to mitigate the risk of Adverse Consumer Outcomes," meaning decisions that break insurance standards and harm a consumer.
The program does not have to be the same size for every company. It should be "tailored to and proportionate with the Insurer's use and reliance on AI and AI Systems." A carrier with one FAQ chatbot needs lighter controls than one pricing policies with machine learning. The bulletin also lets insurers rely on existing standards, naming the NIST AI Risk Management Framework as one example.
The guidelines fall into four parts:
| Part of the AIS Program | What the bulletin asks for | What to have ready |
|---|---|---|
| General guidelines | A written program, proportionate to how much the insurer relies on AI, designed to reduce the risk of Adverse Consumer Outcomes | The program document, its scope, and a record of its adoption |
| Governance | Senior management responsible, accountable to the board or a board committee | Named owner, committee charter, roles across business and technical teams |
| Risk management and internal controls | Controls across the AI life cycle, data quality and bias checks, monitoring for drift | Model inventory, testing and validation records, data lineage notes |
| Third-party AI systems and data | Due diligence and contract terms for vendor data and AI | Vendor assessments, audit rights, cooperation clauses |
Governance and board oversight
The bulletin wants named accountability. The AIS Program should vest responsibility for its development, implementation, monitoring and oversight in senior management, and senior management should be "accountable to the board or an appropriate committee of the board."
In practice, an executive owns AI risk, a committee reports to the board, and roles across underwriting, claims, compliance and IT are written down. Governance should also cover transparency, fairness and accountability.
Risk management, testing and data
The bulletin asks insurers to document how they identify, mitigate and manage AI risk across the whole life cycle. It lists stages from "design, development, validation, implementation (both systems and business), use, on-going monitoring" through updating and retirement.
Data gets specific attention. The program should cover "data practices and accountability procedures, including data currency, lineage, quality, integrity," along with bias analysis and minimization.
Illustrative example: an agency uses AI to read loss runs and pre-fill underwriting submissions. A proportionate control set might include a record of which model and prompt version produced each extraction, field validation rules, a person who approves every submission before it reaches an underwriter, and a monthly sample check for errors. None of that is a bulletin requirement word for word, but it is the kind of evidence that answers its questions.
Third-party AI vendors
Buying AI from a vendor does not move the responsibility. Each AIS Program should address how the insurer acquires, uses or relies on third-party data and AI Systems, including due diligence before signing.
Where appropriate, vendor contracts should "provide audit rights and/or entitle the Insurer to receive audit reports by qualified auditing entities." They should also require the vendor to cooperate with regulatory inquiries and investigations. Insurers are expected to follow through on those rights, not just hold them on paper.
What regulators can ask for in an exam
Section 4 of the bulletin sets out what an insurer "can expect to be asked about" during an investigation or market conduct action. The list includes:
- The written AIS Program and records showing it was adopted
- Policies, procedures and training materials
- An inventory of AI Systems and models in use
- Documentation of validation, testing and auditing, including checks for model drift
- Due diligence on third parties and their data, models or AI Systems
- Vendor contracts and records of audits or compliance checks
Regulators are also building their own tools. The NAIC's AI Systems Evaluation Tool was scheduled for a pilot from March 2026 to September 2026 in 12 states, including California, Colorado, Connecticut, Florida and Pennsylvania, for use in market conduct exams, financial analysis and financial exams.
How to prepare in five steps
- Inventory every AI System in use, including vendor tools, and note which ones touch underwriting, pricing, claims, fraud or marketing decisions.
- Rank them by consumer impact. A claims triage model needs more control than an internal meeting summarizer.
- Write the AIS Program at a size that matches that ranking, and assign an executive owner with a reporting line to the board.
- Set up testing, logging and drift monitoring for the higher-impact systems, and keep the records.
- Review vendor contracts for audit rights and regulatory cooperation, and add them at renewal where they are missing.
This is a plain-terms summary, not legal advice. Your counsel should confirm how each state's version applies to you.
How Lean Discovery Group helps
Lean Discovery Group builds AI automation for insurance carriers, agencies and insurtechs. We designed AngleHealth's self-serve enrollment tool and Agile Health Insurance's plan recommendation flow. Every system we build includes human review for underwriting and claims decisions, full logs of what the AI did and why, access controls on sensitive data, and model providers and hosting that meet your security requirements.
Much of insurance automation starts with documents, which our AI document processing work covers with confidence scoring, validation and an audit trail. If you want to know where AI fits and where human review is required before you build, our AI consulting services start with an automation audit and include a data and risk review. Book a discovery call to talk it through.
Frequently asked questions
Is the NAIC AI model bulletin a law?
No. It is a model that state insurance departments can issue, often with edits. It reminds insurers that existing laws, such as the Unfair Trade Practices Act and the Unfair Claims Settlement Practices Act, apply to decisions made or supported by AI.
How many states have adopted the NAIC AI bulletin?
The NAIC adoption map lists 29 jurisdictions as of October 8, 2026, including the District of Columbia and Puerto Rico. California, Colorado, New York and Texas are listed separately as having insurance-specific AI regulation or guidance.
What is an AIS Program?
It is the written program the bulletin asks insurers to keep for the responsible use of AI Systems. It covers governance, risk management and internal controls, and the use of third-party AI systems and data, sized to how much the insurer relies on AI.
Does the bulletin apply to AI tools bought from vendors?
Yes. Insurers stay responsible for third-party AI systems and data. The bulletin expects due diligence on vendors and, where appropriate, contracts with audit rights and a duty to cooperate with regulatory inquiries.
Can insurers use the NIST AI Risk Management Framework?
Yes. The bulletin says insurers may adopt, incorporate or rely on existing standards and names the NIST AI Risk Management Framework as an example.
