The NAIC AI Model Bulletin: what it expects insurers to keep
Adopted by the NAIC on December 4, 2023 and, as of August 31, 2026, by 25 states and the District of Columbia. Here is what it expects, what it does not, and what examiners are now piloting on top of it.
The core expectation, in the Bulletin's words
"all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an "AIS Program") for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices."
The program "should address governance, risk management controls, and internal audit functions," with senior management "accountable to the board or an appropriate committee of the board," proportionate to the insurer's use of AI, covering the whole insurance life cycle and the whole AI life cycle, including systems "developed by the insurer or embedded within an affiliate or third-party vendor process." It may sit inside enterprise risk management and "may adopt, incorporate or rely upon" the NIST AI Risk Management Framework 1.0.
The four sections of an AIS program
| Section | What it covers | What an examiner would ask to see |
|---|---|---|
| 1. General | Purpose (mitigating adverse consumer outcomes), accountability, proportionality, scope, consumer notice that AI is in use | The written program and evidence of its adoption |
| 2. Governance | Life-cycle policies; documentation requirements "developed with Section 4 in mind"; committees and chains of command; "monitoring, auditing, escalation, and reporting protocols"; training | Minutes, org charts, escalation records, training records |
| 3. Risk management and internal controls | Approvals; data practices (currency, lineage, quality, integrity, bias analysis, suitability); model "inventories and descriptions"; "detailed documentation of the development and use"; assessments including "model drift, and the auditability of these measurements"; validation and retesting; nonpublic information; "data and record retention" | The inventory, per-model documentation, test results with dates, retention policy, the decision records themselves |
| 4. Third-party AI systems and data | Due diligence; contract terms for "audit rights and/or ... audit reports by qualified auditing entities" and cooperation with regulators; exercising those rights | Diligence files, contracts, SOC 2 or equivalent reports covering the AI |
What it does not do
"The goal of the bulletin is not to prescribe specific practices or to prescribe specific documentation requirements." It creates no new law; it tells insurers what regulators expect under existing unfair-trade-practice, claims-settlement, corporate-governance and examination laws, and what they may ask for. States adopt it as a bulletin or notice (Pennsylvania's is Notice 2024-04, nearly word for word).
What is happening in 2026
- Twelve states, Pennsylvania among them, piloted the NAIC's AI Systems Evaluation Tool, a set of optional exhibits for examiners, in market conduct exams, financial analysis and financial exams from March to September 2026, "focusing on using the Tool with domestic insurers."
- The NAIC Big Data and Artificial Intelligence (H) Working Group then exposed the AI Risk Evaluation Supplement v5.0, with the same four-exhibit structure, for comment through September 29, 2026. Exhibit A counts systems and asks for a model inventory with an "Inherent Risk Level"; Exhibit B asks for the AIS program and "whether there is a human in the loop"; Exhibit C asks, per high-risk model, for the "AI model name and version number" and the "last date of model testing"; Exhibit D asks for data sources including vendor names.
- The draft states plainly that ordinary rating models are in scope: "GLMs are not without risk of causing unfair discrimination or other adverse consumer outcomes and require effective governance."
- The March pilot plan was to consider an updated tool for adoption at the Fall National Meeting, November 14–17, 2026. A plan, not a decision.
Sources
- NAIC Model Bulletin (PDF): naic.org
- Big Data and Artificial Intelligence (H) Working Group, with the v5.0 draft and the Evaluation Tool 4.0: naic.org
- Pilot Project Summary, March 2, 2026: naic.org
Related
- Pennsylvania Insurance Notice 2024-04: the AI documentation checklist
- What "Not evidenced" means, and why it is scored like a gap
- How to verify an AI decision log, and prove nobody edited it
- The AI Workflow Evidence Pack: find out which of these you can evidence today, from one decision-log export.