AI governance software for insurance companies keeps one inventory of every AI system the insurer uses, built or bought, with its risk tier, owner, tests and sign-offs, and maps each system to the AI rules of each state where it is used, so the insurer can answer a regulator from evidence rather than email. Whether it pays shows in four numbers: how many AI systems it finds that nobody filed, how many days an examiner's AI questionnaire takes, how many validations are on time, and how quickly a vendor's change reaches the register. This guide sets out how to measure each from the first quarter, using Botminds' AI Governance & Model Inventory on a fictional sample insurer as the worked example, and is plain about what software of this kind cannot do.
The demand is regulatory. As of 8 October 2026, 29 jurisdictions had adopted the NAIC's model bulletin on insurers' use of AI, and California, Colorado, New York and Texas run insurance-specific rules of their own (NAIC adoption map). Twelve states piloted the NAIC's AI Systems Evaluation Tool in market conduct and financial exams from March to September 2026 (NAIC pilot summary). The question an examiner now asks is not whether the insurer has an AI policy but whether it can list, describe and evidence every system.
What AI governance software is asked to fix
4–6weeks
to answer an examiner’s AI questionnaire by email, by our estimate
1day
from the register: the design target of AI Governance & Model Inventory
55%
of health insurers use third-party components in their AI systems
NAIC health survey, 93 companies
42%
of models listed in the NAIC’s homeowners survey came from a third party
1,006 of 2,413
What is an AI governance platform for insurers?
An AI governance platform is the authoritative register of an insurer's AI: one inventory, the documentation and test evidence behind each entry, the approvals, and the map from each system to the rules that apply to it. It is not the place where models are built or run. Model development and monitoring tools produce some of the evidence; the governance platform holds it, asks for what is missing and shows it to the people who sign.
Insurance shapes the requirement in three ways. The rules are state by state, so the map from a system to its rules has to know which states and lines each system touches. Much of the AI is bought: in the NAIC's homeowners survey, 1,006 of 2,413 listed models were developed by a third party (NAIC, 2023). And the examiner's request is specific. The NAIC bulletin lists what a department may ask for, from the written program to model inventories, validation and drift evidence, and vendor contracts (NAIC Model Bulletin, Section 4). Software that cannot produce those documents from its own contents is a catalogue, not a governance platform.
Four measures that show a return in year one
Measure the four things the regulators measure, from the first quarter, on your own systems. Each has a clean baseline that can be taken before the software is switched on, and each moves in weeks rather than years if the software does its job. The bars below show the sample insurer's position on 12 October 2026, the morning a vendor amendment arrived; read them as the shape of a baseline, not as anyone's result.
AI Governance & Model Inventory: four measures on one sample register
How many AI systems did you find that nobody filed?
This is the measure that tells you whether the inventory can be trusted, and it should be counted, not estimated. Every system that reaches the register from a contract, a release note or an invoice, rather than from an owner's filing, is a system the old process missed. In the sample insurer's register, 17 of 148 systems arrived that way: a call-summary tool found in an order form, a letter-drafting assistant found on an invoice for 180 seats, a claim document summariser found in release notes, and, on 12 October, a reserve recommender found in a contract amendment.
Count two numbers each quarter: systems found in documents, and days from a system's switch-on to its registration. The second is the honest measure of exposure. The sample reserve recommender went live inside a claims platform on 3 September and was registered on 12 October: 39 days in which it suggested initial reserves on 2,316 injury claims with no owner, no model card and no validation. In year one the first number should rise, because the software is finding what was always there, and the second should fall toward the day a document arrives.
A row nobody filed: the reserve recommender found in a contract amendment
How many days does an AI questionnaire take?
Time an actual request, end to end, before the software arrives. The NAIC's evaluation tool asks for counts of AI systems by business area, a governance narrative or checklist, details of each high-risk system and the data each uses (NAIC AI Systems Evaluation Tool, draft 4.0). By email, the days go on finding things, not on writing. The product's own estimate for a mid-size multi-line insurer splits 26 working days as below; the target with a maintained register is one day, with most of it left for the people who approve the answers.
Where an AI questionnaire's working days go, by email and from a register
| Step | By email (days) | From the register (days) |
|---|---|---|
| Surveying business units for the list of AI systems | 6 | 0.1 |
| Finding vendor AI and its contract terms | 5 | 0.1 |
| Collecting validation and discrimination test evidence | 6 | 0.2 |
| Mapping each system to each state’s rules | 3 | 0.1 |
| Drafting the answers | 4 | 0.2 |
| Review and approval of the answers | 2 | 0.3 |
| Total | 26 | 1.0 |
The useful year-one measure is not the one-day figure but the trend: days per questionnaire, and the share of answers that needed a figure nobody could find. In the sample, a fictional market conduct exam asks ten AI questions due on 14 November; on 12 October all ten answers were drafted from the register and six were approved, with each answer marked when a figure in it changed. Our guide to the NAIC evaluation tool sets out what each exhibit asks for.
Examiner answers drafted from the register in AI Governance & Model Inventory
How many validations are on time, and does a change reopen them?
Count High-risk systems whose last validation is inside their cadence and postdates their last material change. Calendar cadence is the easy half. The hard half is the change: a rating plan refit, new inputs, a new use or a vendor release that retrains the model. The NAIC bulletin asks for validating, testing and retesting “as necessary” to assess how outputs generalize after implementation, and New York's Circular Letter No. 7 asks for discrimination testing before production, on a regular cadence and again after any material change to the data or the model (NY DFS, 2024; the timing rules are read in the letter's testing requirements).
In the sample, 17 of 23 High-risk systems were inside cadence on 12 October. The six exceptions show the two ways a validation goes stale: an auto claim severity model whose 12-month validation expired in March, and an SIU referral score whose vendor retrained it in a release on 6 October, which reopened the validator's sign-off. The solution's design target is 100% of High-risk systems re-validated within 12 months and after every material change. Measure monthly; the number that matters is how long an exception stays open.
How quickly does a vendor's change reach the register?
Measure days from a vendor document's arrival to a decision on it, and the share of vendor AI tools whose contract gives model audit rights and regulator cooperation. The bulletin suggests both terms where appropriate and available, and asks insurers to use the rights they have (NAIC Model Bulletin, 4.2 and 4.3). The sample's vendor screen lists 31 vendors and 87 AI tools; 15 tools from 5 vendors had no audit rights over the model, and each renewal date is the moment to fix it.
Release notes are the leading indicator. In the sample quarter the AI finder read 412 documents: 61 contracts, 118 release notes, 203 invoices and 30 vendor questionnaires. Most changed nothing. The few that did, a retrained fraud score, a feature switched on by default, a new generative summariser, each reopened a sign-off or proposed a row. Our guide to vendor AI questionnaires explains why those documents answer the vendor questions better than the vendor's own form.
What kinds of AI governance software do insurers buy?
Four kinds, and most insurers end up with two. The difference that matters is where each gets its list of systems and its evidence: from people filling forms, from the systems it monitors, or from the documents where AI actually arrives.
Four kinds of AI governance software, and where each gets its inventory
| Kind | Inventory comes from | Strong at | Blind spot |
|---|---|---|---|
| GRC or policy-management module | Owners filling a form or an annual survey | Policies, attestations, issue tracking | Vendor AI nobody files; changes between surveys |
| Model development and monitoring platform | Models deployed through the platform | Drift, performance and lineage for models it runs | Vendor AI and anything built elsewhere |
| Spreadsheet and shared drive | Whoever updates it | Cheap, flexible, familiar | Completeness, sign-off history, rule mapping |
| Agents reading contracts, release notes and invoices | Documents as they arrive, plus owner filings | Vendor AI and changes the day they land | Needs access to the document stores; does not run validations |
The categories are layers, not rivals. A monitoring platform is the right home for drift statistics on the models it runs, and a GRC tool may already hold the insurer's policies and issues. What the first two cannot do is see the AI that arrives inside software someone else built. That gap is exactly what the NAIC's health survey describes: 55% of health insurers use third-party components in their AI and machine-learning systems, and 15% rely entirely on third-party solutions (NAIC, 2025).
What should you ask before buying AI governance software?
Ask to see each answer on your own documents, not the vendor's sample. The questions below are drawn from what the NAIC bulletin and New York's circular letter say a department may request; a product that cannot show them is leaving the work for your team at exam time.
Ten questions to ask AI governance software, with the evidence to request
- Where does the inventory come from?
Ask how a vendor feature switched on in a release reaches the register, and how fast.
- Does it hold systems in development and retired ones?
New York’s inventory includes both; a list of production models does not answer it.
- Can every line of a model description be traced?
Each statement should point to the document and page it came from.
- What reopens a sign-off?
A refit, new inputs, a new use and a vendor retrain should each break the chain until it is signed again.
- Who can register, sign and send?
Agents may propose and draft; registration, signatures and anything sent to a regulator should need a named person.
- Does it map each system to each state’s rules?
By line and state, with a citation for any rule marked not applicable.
- Does it keep the vendor’s evidence, not the vendor’s assurance?
Audit rights, model card, test results and regulator-cooperation terms per tool.
- Can it draft an examiner’s answers from its own contents?
Ask for answers to the NAIC tool’s exhibits on your data, with each figure traced.
- Are tiers, cadence and signers settings?
Your model risk policy should configure it, not a services project.
- What does it never do?
It should never mark a test passed, run tests on production data or send to a regulator on its own.
Your model risk policy as settings in AI Governance & Model Inventory
Where AI Governance & Model Inventory fits, and where it does not
It fits where the inventory is incomplete because AI arrives inside bought software, and where answering a regulator means weeks of collecting. Six agents do the reading and drafting: the AI finder reads contracts, amendments, release notes, vendor questionnaires and invoices above a threshold; the model card writer drafts each system's description with a citation on every line; the test evidence checker compares tests with the cadence for the system's tier and its latest change; the rule mapper maps each system to the NAIC bulletin states, New York, Colorado and the insurer's own policy; the change watcher reopens sign-off when a model changes; and a drafting agent prepares examiner answers and the annual attestation. Four named people sign each system, and the Chief Risk Officer attests.
It does not fit as a replacement for model development or monitoring tools: it holds their evidence but runs no validation and never tests on production data. It does not decide whether a system is acceptable; the validator, compliance and the business owner do. It needs read access to the contract repository, vendor release channels, accounts payable and the model repository to find what nobody filed, and without that access it is a well-organised register and little more. And it drafts for regulators but never sends. Those limits are deliberate, and they are the questions a model risk team should ask of any product in this category.
The fastest way to judge it is the same as for any product here: run it on a quarter of your own vendor contracts and release notes, and count what it finds that your register does not hold. Our inventory template guide lists the fields to compare against.
Questions people ask
What is AI governance software?
Software that keeps the inventory of an organisation's AI systems with the evidence and approvals behind each one, and maps each system to the rules that apply. For insurers, the NAIC bulletin's Section 4 is a good test of scope: the software should hold, or point to, every document listed there.
Do insurers need AI governance software, or is a spreadsheet enough?
A spreadsheet can hold an inventory, and many programs start there. It cannot find vendor AI nobody filed, keep a sign-off history, or reopen a validation when a vendor retrains a model; those need either people doing it weekly or software. The measure is the questionnaire: if answering one takes weeks, the spreadsheet is not enough.
How is AI governance software different from model risk management software?
Model risk tools grew up around statistical models a team builds, validates and monitors. AI governance adds systems nobody in model risk built: vendor features, generative assistants and tools bought by business units. In insurance the two converge, because the NAIC bulletin covers both predictive models and other AI systems in one program.
How long does AI governance software take to implement?
The register can load from an existing inventory in days; the value comes when the document feeds are connected and the first quarter of contracts and release notes has been read. Plan to measure the four year-one numbers from the first full quarter, against baselines taken before go-live.
Which AI governance platforms are built for insurance?
Few general platforms carry insurance rules out of the box. Ask whether a product knows the NAIC bulletin's adopting states, New York's Circular Letter No. 7 and Colorado's regulation 10-1-1, and whether it maps each system by state and line rather than as one enterprise list.