AI governance committee charter for insurers: who signs each system

An AI governance committee charter for an insurer sets out the committee's authority, who sits on it, what it decides and how it reports to the board, and the part that matters most is a table: for each AI system, who signs before it is used, who signs again after a material change, and who signs it off at retirement. That is what the NAIC's model bulletin means when it asks a governance framework to define scope of authority, chains of command and decision hierarchies, and what the NAIC's draft evaluation tool asks examiners to probe. A charter that names a committee but cannot say who approved a given system on a given date fails the first question an examiner asks. Botminds' AI Governance & Model Inventory keeps that answer for every system, as a sign-off chain on each row of the register.

Few insurers had that written down when regulators first asked. In the NAIC's survey of homeowners insurers, about half said fairness and ethics, accountability, transparency and safety were documented in a governance program; in its earlier private passenger auto survey, about a quarter said so (NAIC Home AI/ML Survey memo, 2023).

What is an AI governance committee charter?

It is the document that gives a committee its authority over the insurer's AI systems and says how that authority is used. A good charter answers six things: what counts as an AI system for the committee's purposes; who sits on it and how independent they are; what it approves and at which stage of a system's life; who signs each approval; what reopens an approval; and how it reports to senior management and the board.

Insurers rarely need a new body. The NAIC bulletin says an insurer “may consider adopting new internal governance structures or rely on the Insurer’s existing governance structures,” and lets the AI program sit inside the enterprise risk management program (NAIC Model Bulletin, 1.5 and 2.0). Many carriers extend an existing model risk committee. What changes is the scope: vendor features, generative assistants and tools bought by business units now come before it, alongside the pricing and reserving models it already saw.

What does the NAIC bulletin say an AI governance committee structure should look like?

It describes a structure without prescribing one. Guideline 1.3 vests responsibility for the AI program, and for the insurer's AI strategy, in senior management accountable to the board or a board committee. Guideline 2.3 then lists what an accountability structure should address: committees, “centralized, federated, or otherwise constituted,” drawn from appropriate disciplines; scope of authority and chains of command; independent decision-makers and lines of defense at each successive stage of a system's life cycle; monitoring, auditing, escalation and reporting; and training and supervision of staff.

Two ideas in that list do the work of a charter. Successive stages means approval is not a single event; the committee or its delegates approve at design, before use, after change and at retirement. Independent decision-makers means the person who built or bought a system is not the only one who signs it. Guideline 3.1 adds the approval itself: an oversight and approval process for the development, adoption or acquisition of AI systems.

Who should sit on an AI governance committee?

The people who own, test, check and use the systems, with the second line in the chair's seat. The NAIC bulletin lists business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance and legal as examples. Colorado's regulation requires a documented cross-functional group for life, private passenger auto and health insurers that use external consumer data, drawn from “legal, compliance, risk management, product development, underwriting, actuarial, data science, marketing, and customer service, as applicable” (3 CCR 702-10, 5.A.4). New York's circular letter asks senior management to engage the relevant areas “such as through a cross-functional management committee with representatives from key function areas” for AI in underwriting and pricing (CL7 ¶24).

Membership by function is the easy part. The harder choice is who signs. A committee of twelve cannot sign 148 systems; it sets the policy, hears the exceptions and approves the High-risk ones, while named people sign each system in an order the charter fixes. The roles below are the ones that recur across insurers' programs, shown on a fictional sample carrier.

The heart of the charter: who signs each AI system, at each stage

Put the sign-off rule in a table and attach the table to the charter. Each row is a stage of a system's life; each column a role; each cell says whether that role signs, reviews or is told. The bulletin's successive stages and its life-cycle list, from design to retirement, give the rows. The table below is one insurer's answer, from the sample used throughout this page; the cells are choices a charter must make, not rules any regulator sets.

The order is deliberate. The owner signs first because nothing should be validated that nobody owns. The validator signs before compliance because a discrimination review needs tested outputs. The business owner signs last because approving use is the decision the other three inform. And a material change breaks every link at once: in the sample, a personal auto rating plan refit on 22 September reopened its sign-off chain, and an SIU referral score whose vendor retrained it in a release on 6 October reopened its validation.

Registering a found system and naming its owner in AI Governance & Model Inventory

What are an AI governance committee's responsibilities?

Four, in practice: set the policy, approve the riskiest uses, deal with exceptions, and report. The policy is the risk-tier rule, the validation cadence, the sign-off order and the list of what counts as a material change. Approval is for High-risk systems, where the bulletin's proportionality test puts the most control. Exceptions are the broken chains: systems found in vendor documents, validations past due, changes not yet re-signed. Reporting runs up to the board and out to regulators.

A committee's agenda should be built from the register, not from presentations. The sample insurer's register on 12 October 2026 shows what that agenda looks like: 148 systems, 139 with all four signatures, 9 open with an owner and a date to close; 23 High-risk systems, 17 inside their validation cadence and 6 listed as exceptions in the draft board attestation.

Committee or board? What an AI governance board charter must cover

The board oversees; management runs the program; the committee is how management runs it. New York draws the line plainly: “The role of an insurer's board of directors, or other governing body, is to provide oversight of the insurer's activities,” while “Senior management is responsible for day-to-day implementation of the insurer’s development and management of ECDIS and AIS” (NY DFS Circular Letter No. 7, ¶21 and ¶23). It also asks that the board, a board committee or delegated senior management review and approve the AI policies at least annually (¶26).

Colorado is stricter for the insurers its regulation reaches: the governance structure and risk management framework “must be overseen by the board of directors or a committee of the board” (3 CCR 702-10, 5.A.2), and senior management carries responsibility for strategy and direction (5.A.3). Its annual compliance report, ten pages at most, names the title and qualifications of each person responsible for each requirement and is signed by an officer attesting compliance. A board charter for AI therefore needs three things: the frequency of reporting, what the report contains and who attests to it.

What will an examiner ask about the committee?

The NAIC's draft evaluation tool asks it directly. Its governance exhibit, in the narrative option, asks “What role maintains the framework?”, asks the company to discuss “the governance structure, Board reporting and frequency,” and how “responsibility for governance within the organization is assigned”; the checklist option asks whether the board or management was involved in adopting the program and what the board's role is (NAIC AI Systems Evaluation Tool, draft 4.0, Exhibit B). The bulletin's document list adds evidence of “the formation and ongoing operation of the Insurer’s coordinating bodies” for AI.

That last item is where charters fail: minutes show that a committee met, not that each system was approved. An examiner who picks one system from the inventory and asks who approved it, when, on what evidence, and who approved its last change, needs a sign-off history per system. Our guide to the NAIC evaluation tool covers the rest of the governance exhibit, and our model risk guide covers the questions about validation.

An AI governance committee charter template, section by section

Keep it short and attach the tables. The outline below follows what the NAIC bulletin, New York and Colorado ask a governance structure to cover; the sign-off table above and the insurer's risk-tier rule are its two attachments.

How does the charter fit an AI governance framework for insurance companies?

The charter is the governance piece of a larger framework. The NAIC bulletin's program has three other parts: risk management and internal controls, model documentation, and vendor oversight. NIST's framework puts accountability first in its GOVERN function, asking that roles and responsibilities for AI risks be “documented and are clear to individuals and teams throughout the organization” (GOVERN 2.1) and that executive leadership take responsibility for decisions about AI risks (GOVERN 2.3) (NIST AI 100-1).

For insurers the framework also has to meet the existing risk machinery. The NAIC tool asks how AI systems are integrated into the Own Risk and Solvency Assessment and enterprise risk management, and the bulletin ties its governance item to the corporate governance annual disclosure law. A charter that sits apart from ERM will be asked why. Our guide to the NAIC bulletin covers the program's other three parts.

Who signs, set once in AI Governance & Model Inventory and applied to every system

Questions people ask

Is there an AI governance committee charter template?

The twelve-section outline and the sign-off table on this page form a working template. Fill the tier rule and the cadence from your model risk policy, and keep the sign-off table as an attachment so it can change without re-approving the whole charter.

How often should an AI governance committee meet?

No insurance text sets a frequency. Monthly is common where the register produces exceptions weekly; New York asks for at least annual review and approval of AI policies, and the NAIC tool asks about board reporting frequency, so the charter should state both.

Should the AI governance committee be separate from the model risk committee?

Not necessarily. The NAIC bulletin lets insurers rely on existing governance structures and fold the program into ERM. What matters is that the committee's scope reaches vendor features and generative tools, not only models the insurer built.

Does the board have to approve the AI program?

The NAIC bulletin vests the program in senior management accountable to the board or a board committee, and its evaluation tool asks whether the board or management was involved in adopting it. Colorado requires board or board committee oversight of the framework for the insurers its regulation covers.

Who should chair an AI governance committee at an insurer?

Usually the Chief Risk Officer or a delegate in the second line, because the committee approves risk and reports to the board. Model owners and business owners sit on it but should not chair the body that approves their own systems.