Insurance is one of the few industries where a regulator has spelled out in writing how AI use inside a business should be governed. The National Association of Insurance Commissioners (NAIC) adopted a model bulletin on December 4, 2023, and a status map dated October 8, 2026 lists 29 jurisdictions that have issued it: 27 states, the District of Columbia, and Puerto Rico. The bulletin does not create new law. It tells insurers that decisions made or supported by AI must meet the unfair-discrimination and unfair-practice rules that already apply to them.
Key takeaways
- The NAIC model bulletin is guidance that each state issues on its own; it takes effect only where a state insurance department adopts it.
- Insurers are expected to keep a written AI Systems Program covering governance, risk controls, and outside vendors.
- Regulators may ask for model inventories, validation records, data lineage, and vendor contracts during an examination, with or without a written program.
- Four other states, California, Colorado, New York, and Texas, are listed on the NAIC map under separate insurance-specific rules or guidance.
Why insurance is a useful case for AI in business
The bulletin itself lists where insurers use AI: product development, marketing, sales and distribution, underwriting and pricing, policy servicing, claim management, and fraud detection. Each of those touches a customer's price, coverage, or payout, which is why regulators care. The text names four consumer risks: inaccuracy, unfair discrimination, data vulnerability, and lack of transparency and explainability. It also says AI may help insurers simplify processes and improve accuracy, so the bulletin treats AI as permitted and conditions its use.
The legal hooks are older statutes. The bulletin cites the Unfair Trade Practices Model Act, the Unfair Claims Settlement Practices Model Act, the Property and Casualty Model Rating Law (rates must not be excessive, inadequate, or unfairly discriminatory), the Corporate Governance Annual Disclosure Model Act, and the Market Conduct Surveillance Model Law. An insurer is responsible for these outcomes regardless of the tools it used to reach them.
What the written program covers
The bulletin calls the expected document an AIS Program, short for artificial intelligence systems program. It should be proportionate: the controls scale with the nature of the decision, the degree of potential harm to consumers, how much a human is involved in the final decision, how well outcomes can be explained to the customer, and how much the insurer relies on third-party data and models. Senior management accountable to the board or a board committee should own it. It may sit inside existing enterprise risk management and may build on a recognized framework, and the bulletin names the NIST AI Risk Management Framework 1.0 as an example. The program should also cover every life-cycle stage from design to retirement and include a process for notifying consumers that AI systems are in use.
What an examiner may ask for
The bulletin states that an insurer should expect questions during an investigation or market conduct action even if no written program exists. The list is specific enough to work as a records checklist.
| Area | Documentation a regulator may request |
|---|---|
| Governance | The written program, how it was adopted, what AI systems it leaves out, training materials |
| Models | Inventories and descriptions of predictive models, plus compliance records for any model under review |
| Data | Source, provenance, lineage, quality, bias analysis, and how current the data is |
| Testing | Validation, retesting, and evaluation of model drift, meaning the decay of performance as real-world data changes |
| Vendors | Due diligence, contracts, audit results, and cooperation terms for third-party data and AI systems |
Vendor contracts: the clauses the bulletin names
Many insurers buy scoring models and data rather than build them, so the bulletin gives vendor oversight its own section. The following list restates its contract and oversight points; the contract terms apply where appropriate and available, in the bulletin's wording.
- Audit rights, or the right to receive audit reports from qualified auditors.
- A duty for the vendor to cooperate with regulatory inquiries about the insurer's use of the product.
- Terms covering representations and warranties, data security and privacy, data sourcing, intellectual property, and confidentiality, which the bulletin lists as things a regulator may ask to see.
- Actual use of those audit rights, not just their presence in the contract.
Where the bulletin applies, and where it does not
The NAIC adoption map shows how uneven the picture is. Alaska adopted its version on February 1, 2024, Pennsylvania on April 6, 2024, and Hawaii on December 10, 2025. Mississippi followed on July 22, 2026, South Carolina on September 24, 2026, and North Dakota on October 5, 2026. Separately, the map lists Colorado (3 CCR 702-10, effective November 13, 2023, amended effective October 15, 2025), New York (Insurance Circular Letter No. 7, July 11, 2024), California (Bulletin 2022-5), and Texas (Bulletin B-0036-20) under insurance-specific rules or guidance. The map warns that it does not judge whether a state's version contains every element of the model. The model also carries a drafting note that states may define terms differently.
The bulletin text adds that insurers may show compliance by other means and that its goal is not to prescribe particular practices or documents. Readers with a specific compliance question should consult counsel or the relevant state insurance department; this page is general information and not legal advice. Canadian insurers answer to different regulators, and this page does not cover them.
FAQ
Is the NAIC bulletin a law?
No. The NAIC is an association of state insurance commissioners, and its bulletin is a model that each state department may issue. The obligations come from existing state insurance statutes, which the bulletin reminds insurers still apply to AI-assisted decisions.
Does it prohibit AI in underwriting or claims?
No. The text encourages innovation that supports safe and stable markets. It requires that outcomes not be inaccurate, arbitrary, capricious, or unfairly discriminatory.
Must insurers tell customers when AI is used?
The model says the program should include processes for notice to affected consumers that AI systems are in use, with information appropriate to the stage of the insurance life cycle. How a given state turns that into a requirement depends on the state.
Does the bulletin cover generative AI?
Yes. It defines generative AI as systems that produce content such as text, images, or sound, and says validation and testing should fit whether a system rests on predictive models or generative AI.
Related reading
- What federal rules ask of high-impact AI systems
- FTC cases involving AI sales claims
- Field experiments on whether AI cuts business costs
- What business surveys say AI changed in jobs, tasks, and time
More in AI Policy and Ethics.
Last verified: October 2026
Sources
- Model Bulletin: Use of Artificial Intelligence Systems by Insurers, National Association of Insurance Commissioners, adopted December 4, 2023
- Implementation of NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers, status as of October 8, 2026, NAIC
- Artificial Intelligence topic page, NAIC, updated 2026