The NAIC AI bulletin's requirements for insurance companies come down to one document and the evidence behind it: a written program for the responsible use of AI systems that make or support decisions in regulated insurance practices, covering every such system whether the insurer built it or bought it, with governance, risk controls, model documentation and vendor oversight in proportion to the harm a system could do. The bulletin, adopted by the NAIC on 4 December 2023, then tells insurers what a department may ask to see in an investigation or market conduct exam, down to the inventory of models and the vendor contracts (NAIC Model Bulletin). The hard part is not writing the program. It is proving the inventory is complete when much of the AI arrived inside software from vendors, which is the job Botminds' AI Governance & Model Inventory was built to do.
A bulletin is not a statute. It binds an insurer only where a department issues it, and each department issues its own text. As of 8 October 2026 the NAIC's map lists 29 adopting jurisdictions, 27 states plus the District of Columbia and Puerto Rico, and four more states with their own insurance-specific AI rules: California, Colorado, New York and Texas (NAIC adoption map). An insurer licensed in all fifty states meets the bulletin in 27 of them and an insurance-specific AI text in four more.
The NAIC AI bulletin, by the numbers that decide whether it reaches you
29
jurisdictions had adopted the model bulletin as of 8 October 2026
27 states, DC and Puerto Rico
4
states run their own insurance-specific AI rules instead: CA, CO, NY, TX
21
of the 29 adoptions came in 2024; four each in 2025 and 2026
our count from the map’s dates
42%
of 2,413 models in the NAIC’s homeowners AI survey were developed by a third party
What does the NAIC AI bulletin require? One written program for every AI system
The bulletin's core expectation is a written AIS Program, its name for an AI systems program, with controls that match the risk each system carries. Section 3 expects each insurer to develop, implement and maintain a written program for “the responsible use of AI Systems that make, or support decisions related to regulated insurance practices”, designed to mitigate the risk of adverse consumer outcomes. Everything else in the document hangs off that sentence: who owns the program, what it must cover, how vendors are handled and what the department can ask for.
The legal standard does not change. The bulletin opens by reminding insurers that decisions made or supported by AI are held to the laws already on the books, naming the unfair trade practices and unfair claims settlement practices acts, the corporate governance disclosure law, the property and casualty rating law and the market conduct surveillance law. It is explicit that the tool changes nothing: compliance with those standards is required whatever tools and methods the insurer uses to reach a decision. What is new is the expectation of a governance program around the tools, and of documents that show it works.
The bulletin is also modest about method. Near the end it says “The goal of the bulletin is not to prescribe specific practices or to prescribe specific documentation requirements,” and it accepts that insurers may show compliance “through alternative means.” Read that as latitude in form, not in substance: an examiner will still expect to see the inventory, the testing and the vendor diligence the program promises.
Which AI systems does the bulletin cover, and what counts as AI?
It covers any AI system used in a regulated insurance practice, from marketing and underwriting to claims and fraud detection, and its definition is broad. An AI system is any machine-based system that, for a given set of objectives, produces predictions, recommendations or content, text and images included, that influence decisions, and the bulletin adds that such systems “are designed to operate with varying levels of autonomy.” Machine learning is a subset; generative AI has its own definition; and a predictive model is any use of algorithms or machine learning on historic data to predict outcomes that support decisions. Model drift gets its own definition too, as the decay of a model's performance as the data it meets moves away from the data it learned from, which is why the bulletin treats monitoring as part of the program rather than an extra.
Two definitions set the stakes. An adverse consumer outcome is a decision subject to insurance regulatory standards that harms a consumer in a way that breaks those standards. The Degree of Potential Harm to Consumers measures how severe the economic harm to a consumer from such an outcome could be. Connecticut rewrote that definition in its own bulletin, a difference traced in how states adopt NAIC model laws. A claims reserve suggestion, a fraud referral score and a call-centre summary are all AI systems under these words; what separates them is how much harm a wrong output could cause, and so how much control each needs. Guides on particular lines apply the same test to fraud risk scoring models and to AI in homeowners underwriting.
The program must reach the whole life cycle of each system, not just its launch. Guideline 1.7 lists the phases: “design, development, validation, implementation (both systems and business), use, on-going monitoring, updating and retirement.” A system switched off last year is still inside the program, and its documentation is still something an examiner can ask about.
AI Governance & Model Inventory: where 148 AI systems sit in one sample insurer
148 systems by business area
- Claims 38 · 26%
- Underwriting 22 · 15%
- Operations 20 · 13%
- Pricing 19 · 13%
- Service 17 · 11%
- Marketing, fraud and life 32 · 22%
148 systems by who built them
- From vendors 87 · 59%
- Built in-house 61 · 41%
The program's four parts, section by section
The AIS Program guidelines in Section 3 fall into four groups: general guidelines (1.1 to 1.9), governance (2.0), risk management and internal controls (3.0) and third-party AI systems and data (4.0). Each group turns into a handful of things an insurer either has on file or does not. The checklist below follows the bulletin's own order, in plain words, with the section each item comes from so a reader can check it against the text.
What the NAIC AI bulletin expects, in its own order
- A written program, owned by senior management (1.2, 1.3)
Governance, risk controls and internal audit, with senior management accountable to the board or a board committee.
- Scaled to your use of AI (1.4, 1.5)
Controls proportionate to the harm each use case could do; the program may sit inside ERM and may adopt the NIST AI Risk Management Framework.
- Every practice and every phase (1.6, 1.7)
From product design and marketing to claims and fraud detection; from design to retirement.
- Built and bought systems alike (1.8)
Vendor systems used in regulated practices are inside the program, not beside it.
- Notice to consumers (1.9)
Processes that tell affected consumers AI is in use, with information suited to the stage of the insurance life cycle.
- A governance structure on paper (2.1 to 2.4)
Policies at each life-cycle stage, documentation requirements, committees, decision rights, independence of decision-makers, escalation and training.
- Risk controls and model documentation (3.1 to 3.7)
Approval of new or acquired systems, data practices, an inventory and description of predictive models, validation and retesting, security, retention, and a narrative of each model’s goals.
- Third-party diligence and contract terms (4.1 to 4.3)
Due diligence on vendors and their data, audit and regulator-cooperation terms where appropriate and available, and actually using those rights.
Two of the eight items carry most of the weight in practice. The governance structure (2.3) names the kinds of people a committee should include, from actuarial and data science to claims, compliance and legal, and asks the insurer to set out each person's scope of authority, the chain of command and who decides what. The model documentation item (3.3) asks for inventories and descriptions of predictive models, detailed documentation of their development and use, and assessments of drift and auditability. A charter that names a committee but cannot say who approved a given model, and an inventory that lists models but not the vendor features switched on last quarter, fail the two items an examiner tests first. Our guide to an AI governance committee charter turns 2.3 into a sign-off table.
How much governance is enough? The bulletin's proportionality test
Enough to match the harm a system could do: the bulletin asks each insurer to scale its controls to its own assessment of risk, using five factors. They are the kind of decision the system makes or informs; the type and degree of harm a consumer could suffer; how far humans are involved in the final decision; how transparent and explainable the outcome is to the consumer; and how much the insurer relies on data, models and AI systems from third parties.
That gives an insurer room, and a duty to show its reasoning. A chatbot that answers billing questions and a model that sets the first reserve on an injury claim are both AI systems; only one decides money a consumer receives. The bulletin expects the second to carry more validation, more oversight and more documentation, and it expects the insurer to be able to explain why. The same factors reappear in the NAIC's evaluation tool, which asks companies to say which of their systems they themselves classify as high risk, and how (NAIC AI Systems Evaluation Tool, draft 4.0).
In practice a risk-tier rule written in one sentence does the work. In the sample insurer's policy, a system is High risk when its output sets or changes a consumer's price, eligibility, claim payment or fraud referral; Medium when it reaches a consumer without deciding anything; Low when it is internal only. Each tier carries a validation cycle (12, 24 and 36 months in the sample) and a rule that a material change reopens sign-off. That is a policy the five factors can be traced through, and a policy an examiner can test system by system.
The bulletin does not ask whether an insurer has an AI policy. It asks whether the insurer can show, system by system, what each one does, who approved it and how it was tested, including the ones it bought.
Does the bulletin cover AI from vendors? Yes, on the insurer's own standard
It does, explicitly. Guideline 1.8 reads: “The AIS Program should address the AI Systems used with respect to regulated insurance practices whether developed by the Insurer or a third-party vendor.” The third-party section asks for diligence that holds bought systems to the legal standards imposed on the insurer itself. Guideline 4.1 frames it as due diligence on the vendor and its data or AI systems, aimed at one result: decisions those systems make or support must meet the same legal standards as decisions the insurer makes itself. A vendor's assurance is an input to that diligence, not a substitute for it.
Contracts are where that diligence becomes enforceable. Guideline 4.2 suggests, where appropriate and available, terms that give the insurer audit rights or audit reports from qualified auditors, and terms that require the vendor to cooperate with regulatory inquiries. Guideline 4.3 then asks insurers to use those rights. Section 4 lists what the department may request if an exam touches vendor AI: diligence files, the contracts themselves (including terms on representations, warranties, data security, data sourcing and cooperation with regulators), audits of vendor compliance, and validation and drift documentation.
The scale is not small. In the NAIC's homeowners survey, insurers listed 2,413 models, and 1,006 of them, 42%, were developed by a third party (NAIC Home AI/ML Survey memo, 2023). Many vendor features never arrive as a purchase at all: they arrive in a release of software the insurer already licenses. That is why an annual survey of business units misses them, and why a vendor questionnaire is best answered from the contract rather than from the vendor's own form.
Vendor AI evidence in AI Governance & Model Inventory: what the insurer holds, not what the vendor says
What can a department ask for in an AI exam?
A great deal, and regardless of whether the insurer wrote a program: Section 4 says an insurer can expect questions about its AI systems “Regardless of the existence or scope of a written AIS Program.” The list that follows is the most practical part of the bulletin, because it is a document request in waiting. It runs from the written program and evidence of its adoption, through policies, training materials and data governance, to model-level files for any specific system under examination.
The documents the bulletin says a department may request, and what answers each
| Request (Section 4) | What it means in practice | Where it usually lives |
|---|---|---|
| The written AIS Program and evidence of its adoption | The program document, board or committee minutes approving it | Policy library, board papers |
| The scope of the program, including systems it leaves out | A list of exclusions and the reason for each | Rarely written down |
| Inventories and descriptions of predictive models and AI systems | One list of every system that can affect a consumer, with a description of each | Model repository plus spreadsheets per business unit |
| Documentation for a specific system | Compliance with the program, data used, techniques, thresholds and controls | Model owner’s files, validation reports |
| Validation, testing and auditing, including model drift | Test results, monitoring reports, audit findings | Validation team, monitoring dashboards |
| Third-party diligence, contracts and audits | Due diligence files, vendor contracts, audits of vendor compliance | Procurement, third-party risk, legal |
One request deserves attention because few programs answer it: “The scope of the Insurer’s AIS Program, including any AI Systems and technologies not included in or addressed by the AIS Program.” An insurer that cannot list what it left out cannot show it knows what it has. The NAIC's evaluation tool, piloted by twelve states from March to September 2026, turns these requests into four exhibits and a count of systems by business area; our guide to the tool walks through each one.
Is the NAIC AI bulletin law in every state?
No. It is a model that the NAIC adopted for states to issue, and it carries force only where a department has issued it, in that department's words. The map's own note says it does not determine whether each state's action carries every element of the model, so an insurer reads the issued text in each state, not the model alone.
The instruments vary. The map lists bulletins, an insurance commissioner memorandum (Hawaii), an administrative letter (Virginia), a technical assistance advisory (Washington), an insurance guidance document (Nebraska) and an insurance notice published in the Pennsylvania Bulletin. The latest adoptions on the map are South Carolina (24 September 2026) and North Dakota (5 October 2026). Four states regulate the subject through their own texts: California's Bulletin 2022-5, Colorado's regulation 3 CCR 702-10 with its amendments effective 15 October 2025, New York's Circular Letter No. 7 of 11 July 2024 and Texas's Bulletin B-0036-20 (NAIC adoption map). Texas has since issued a fuller AI bulletin, B-0003-26 of 12 June 2026, which sets out what its examiners may ask for and which the map of 8 October 2026 does not yet list (TDI Bulletin B-0003-26).
Even where a state has not issued it, the bulletin's content reaches insurers another way. Its authority section rests on NAIC model laws that states have enacted in their own forms, unfair trade practices and unfair claims settlement practices among them, and an examiner in a state with such laws can ask how an AI-supported decision complied with them. The bulletin is best read as the most detailed public statement of what that question will look like.
Can the NIST AI Risk Management Framework satisfy the bulletin?
It can carry much of the structure, and the bulletin says so: guideline 1.5 lets the program “adopt, incorporate, or rely upon” a framework from a standards organization such as the NIST AI RMF 1.0. NIST's framework already asks for the same building blocks. GOVERN 1.6 says “Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities,” GOVERN 1.7 covers decommissioning, and GOVERN 6.1 covers risks from third-party software and data (NIST AI 100-1).
What NIST does not supply is the insurance law. The framework is voluntary and sector-neutral; it says nothing about unfair discrimination in rating, claims settlement standards or what a market conduct examiner samples. An insurer that maps its program to NIST still needs a second map, from each system to the insurance rules of each state where it is used. That second map is where most programs are thinnest.
What a bulletin-ready inventory looks like in AI Governance & Model Inventory
It looks like one register that answers the department's requests without a scramble. In AI Governance & Model Inventory each AI system is one row with its source (built or from which vendor), its owner, its risk tier, its last validation and a four-link sign-off chain: model owner, independent validator, compliance and business owner. Six agents keep it current. The AI finder reads contracts, amendments, release notes and invoices for AI features nobody filed and proposes a row; the model card writer drafts each system's description with every line cited; the test evidence checker compares tests with the tier's cadence; the rule mapper maps each system to the rules of each state where it is used; the change watcher reopens sign-off when a model is refit or a vendor retrains it; and a drafting agent prepares examiner answers from the register. People register systems, sign them and approve every answer.
The sample insurer shows why the vendor part matters. On the morning of 12 October 2026 its register held 147 systems, 16 of them found in vendor documents rather than filed by anyone. Overnight the AI finder read a 38-page amendment to a claims platform contract that let the vendor switch on machine-learning features without notice, matched it to a release that had been suggesting initial reserves on injury claims since 3 September, and proposed a 148th row: a High-risk system already used on 2,316 claims, with no owner, no validation and no model card.
One register in AI Governance & Model Inventory, broken chains first
None of that replaces judgment. The agents never register a system, sign a link or send anything to a regulator; the AI governance lead decides what goes on the register, four named people sign each system, and the Chief Risk Officer signs the annual attestation to the board. The register's job is to make the bulletin's requests answerable in a day rather than weeks: the solution's design target is one day to answer an examiner's AI questionnaire from the register, against an estimate of four to six weeks by email.
Questions people ask
Where can I find the NAIC AI bulletin PDF?
The NAIC publishes the model as a PDF on content.naic.org: NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers, adopted by the Executive Committee and Plenary on 4 December 2023. The text that binds you is your state's issued version; the NAIC's adoption map lists each state's instrument and date on its second page.
Does the NAIC AI bulletin apply to generative AI?
Yes. The bulletin defines generative AI as a class of AI systems, and its definition of an AI system includes outputs such as text, images, video and sound. Section 4 adds that validation, testing and auditing should reflect whether a system rests on predictive models or generative AI, so a claims-letter drafting tool belongs on the inventory too.
Does the bulletin require notice to consumers?
Guideline 1.9 asks for processes that notify affected consumers that AI systems are in use and give access to information suited to the phase of the insurance life cycle. It does not prescribe a form of words. Colorado's regulation separately requires processes for consumer complaints and inquiries about external data and models.
Does the bulletin cover claims and fraud models?
Yes. Guideline 1.6 names claim administration and payment and fraud detection among the areas the program must address, and the bulletin's legal authority includes the unfair claims settlement practices act. In the NAIC's homeowners survey, claims was the area where the most companies used AI or machine learning.
Is an insurer in a non-adopting state exempt?
Not from the underlying law. The bulletin restates standards that apply regardless of the tools used, and a state can examine how an AI-supported decision met its unfair trade and claims settlement laws. Four states, California, Colorado, New York and Texas, apply their own insurance-specific AI texts instead.
Who should own the AIS Program?
Guideline 1.3 vests responsibility for the program, and for the insurer's AI strategy, in senior management accountable to the board or a board committee. Day-to-day work usually sits with a second-line AI or model risk lead, with a cross-functional committee approving systems; the bulletin lists business units, actuarial, data science, underwriting, claims, compliance and legal as typical members.