How do states adopt NAIC model laws and regulations? Read the diff

States adopt NAIC model laws and regulations by enacting their own version of the model's text: a legislature passes a model law as a statute, an insurance department adopts a model regulation as a rule, and a commissioner issues a model bulletin under existing authority. The NAIC itself cannot make law; it says it works "primarily through the states’ adoption of our model laws and regulations" (NAIC). Every adoption is therefore a new document, usually close to the model and sometimes not, and for an insurer licensed in several states the work is to read each state's text against the version already implemented and find what differs. Botminds' Regulatory Change Management for Insurers does that comparison section by section as each adoption is published, and marks only what is new.

This guide follows a model from the NAIC's drafting process to a state's text, then reads one real adoption against the model sentence by sentence. Product examples are sample data on a fictional carrier.

This requires states to adopt the model in its entirety but does allow for variations in style and format.

NAIC state page key, Insurance Data Security Model Law, Summer 2026

That is the NAIC Legal Division's test for listing a state under "Model Adoption". It allows the wording to move. A carrier cannot assume that a state listed as an adopter used the model's words, and the NAIC itself warns that states and readers may not share its reading, as a guide to the state adoption charts explains column by column.

What is an NAIC model law?

An NAIC model law is a draft statute written and adopted by the National Association of Insurance Commissioners for state legislatures to enact. The NAIC publishes three kinds of model text, which it calls model laws, regulations and guidelines, and its compendium gathers every one of them, each closing with a state action page that cites each state's enacted version or similar law (NAIC; how to read those pages is in NAIC model law state adoption charts). A model law is meant for a legislature; a model regulation for an insurance department's rulemaking. The AI document of December 2023 is a fourth kind, a model bulletin, written for a commissioner to issue.

Models are numbered, which is how practitioners refer to them: the Insurance Data Security Model Law is #668, the Unfair Trade Practices Act #880, the Unfair Claims Settlement Practices Act #900. Some models are titled "Act", which is why people search for "the NAIC model act"; a model act is a model law. Each model's text includes drafting notes and, where the model leaves a choice to the state, a blank.

How an NAIC model is made: the form that asks how likely states are to adopt it

A model starts with a request that two NAIC bodies must approve. The NAIC's "Request for NAIC Model Law Development" form says: "Prior to development of a new or amended model law, approval of the respective Parent Committee and the NAIC’s Executive Committee is required" (NAIC request form, draft of 29 June 2026). The form then asks the drafting group to rate three likelihoods on a scale of one to five.

The questions are revealing, because they show the NAIC's own view of adoption. Can the committee "draft and adopt the model law within one year from the date of Executive Committee approval"? Would "a minimum two-thirds majority of NAIC members" ultimately vote to adopt it? And "What is the likelihood that state legislatures will adopt the model law in a uniform manner within three years of adoption by the NAIC?" Uniform adoption within three years is a question on the form, not an expectation.

The 2026 request to amend the Annuity Disclosure Model Regulation (#245) answers it candidly: "While the existing model law has not been widely adopted, it is important to note that, in the jurisdictions where it has been implemented, there is evidence that it has contributed to reducing problematic practices." It also answers the form's last question, whether the model is an accreditation standard, with "Not an accreditation standard."

How do states adopt NAIC model laws? Three routes, three instruments

States adopt NAIC models through whichever body has the power to make the rule. A model law goes through the legislature and becomes a statute with the state's code citation: the NAIC's state page for the Data Security Model Law cites Alabama's Code sections 27-62-1 to 27-62-12 of 2019, for example. A model regulation goes through the insurance department's rulemaking, with notice and comment under the state's administrative procedure law. A model bulletin is issued by the commissioner as guidance under authority the department already has.

The route sets the dates a carrier must track. A statute has an effective date set by the legislature, and sometimes separate dates for parts of it; a rule has the date in its adoption notice; a bulletin usually takes effect on issue. It also sets what can change later and how fast: a bulletin can be revised by the next commissioner's bulletin, a statute only by the next session.

And the route decides the delay. The Insurance Data Security Model Law dates from the fourth quarter of 2017; its state page for Summer 2026 still lists new enactments in Alaska and Missouri dated 2026. The AI model bulletin, which needed no legislature, was adopted by 21 jurisdictions before the end of 2024, a year after the NAIC adopted it on 4 December 2023.

The accreditation exception: solvency models with a two-year clock

One family of models comes with a strong incentive to adopt them consistently. The NAIC's Financial Regulation Standards and Accreditation Program, in the NAIC's words, "provides the impetus for states to adopt in a consistent manner the NAIC model laws, regulations and requirements that make up the U.S. insurance financial solvency framework" (NAIC note on accreditation, January 2024). When a model becomes an accreditation standard, "states are given a two year time-frame to implement new standards before they take effect." The note reports that all 50 states, the District of Columbia and the U.S. Virgin Islands were accredited.

Accreditation is about solvency regulation. Market conduct models, such as unfair trade and claims practices, and the AI model bulletin, spread without that clock, which is why their adoption is uneven and their text varies more. The 2026 request form's answer for the annuity disclosure model, "Not an accreditation standard", is the common case for the rules a market-facing compliance team reads.

What "adopted" means on an NAIC state page

On the NAIC's state pages, "adopted" means substantially similar, not identical. The key on the Data Security Model Law page defines the Model Adoption column as states that "adopted the most recent version of the NAIC model in a substantially similar manner", with room for differences of style and format (NAIC state page #668). States that adopted only part of the model are listed there "with an explanatory note"; Tennessee's entry carries "(portions of model)". States with laws on the same subject that are not substantially similar go under "Related Activity", and the page lists New York there, under its own cybersecurity regulation.

The AI model bulletin's map is looser still: it records "state action", and says it does not determine whether a state's text "contains all elements of the model". Two different tests, both called adoption, and neither tells a carrier what its own compliance team needs to know, which is the list of sentences that differ.

A diff, worked: Connecticut and the NAIC AI model bulletin

Connecticut adopted the AI model bulletin as Bulletin No. MC-25 on 26 February 2024, one of the first adopters on the NAIC's map. Read beside the model, most of it is the model's text. The differences fall into three kinds, and each kind matters differently to a carrier.

The blanks, filled. The model leaves places for the state: its addressee line reads "All Insurers Licensed to Do Business In (Insert Name of Jurisdiction)", and its authority section repeatedly says "[insert citation to state statute" for each law it relies on (NAIC model bulletin). Connecticut fills them with its own Unfair Insurance Practices Act, rating laws and examination statutes. These differences change citations, not obligations; a matcher should recognise them and move on.

A definition, changed. The model defines "Degree of Potential Harm to Consumers" as "the severity of adverse economic impact that a consumer might experience as a result of an Adverse Consumer Outcome." Connecticut's text defines it as "the severity of an unfair or deceptive act or practice prohibited under Connecticut Law in relation to the impact that a consumer might experience as a result of an Adverse Consumer Outcome" (Connecticut MC-25). The term is used to scale controls to risk, so a program that sized controls by economic impact alone was measuring against the model's yardstick, not Connecticut's.

A requirement, added. Connecticut's bulletin opens with a duty the model does not contain: domestic insurers must complete an Artificial Intelligence Certification, due on or before 1 September 2024 and annually after that. It also says the bulletin "updates and replaces the Department’s Notice issued on April 20, 2022, concerning the usage of big data and avoidance of discriminatory practices", which closes an earlier row in the carrier's own records.

Reading the diff as a carrier: what to do with each kind of difference

Each kind of difference calls for a different action, and sorting them is most of the analyst's judgement. Filled blanks need a citation update in the policy's authority list and nothing else. A changed definition needs the owner of every procedure that uses the term to check whether the procedure still holds. An added requirement needs a new obligation, an owner and a date, and in Connecticut's case an officer's signature every year.

Seven of nine sections already covered: the matcher's result under the publication's row

In the solution, every adoption is compared with the model and with the carrier's own earlier change records, and the rule is strict: "Any wording difference counts as new." On the fictional carrier's sample, an invented AI bulletin came back with seven of nine sections covered by a named earlier change and two new, each mapped to the paragraph that must change. Whether a new sentence matters is the lead's call, but the lead sees every one. The NAIC AI model bulletin adoption map lists the 29 adoptions that call for this comparison, and Regulatory Change Management for Insurers runs it on your own records.

The new sentence, against the paragraph it changes

Questions people ask

What is the purpose of NAIC model laws?

To give states a common text to enact, so that rules for insurers that operate in many states converge. The NAIC works mainly through states adopting its models, not by making rules of its own; for solvency models, the accreditation program gives states two years to implement a new standard.

Are NAIC model laws binding on insurers?

No. A model binds nobody until a state enacts it; the insurer is bound by the state's statute, rule or bulletin, in that state's words. The NAIC's state pages count a state as adopting when its text is substantially similar, which allows variations in style and format.

Where is the list of NAIC model laws?

The NAIC publishes its model laws, regulations and guidelines as one compendium, with a state action page for each model citing each state's enacted version or related law. Models are known by number, such as #668 for data security and #880 for unfair trade practices.

How long does it take states to adopt an NAIC model law?

It varies by route. The AI model bulletin, issued by commissioners, had 21 adopting jurisdictions by the end of 2024; the Data Security Model Law of 2017 was still being enacted in 2026, in Alaska and Missouri. The NAIC's request form asks whether legislatures will adopt uniformly within three years.

What is the difference between NAIC model laws, regulations and guidelines?

A model law is written for a legislature to enact as a statute; a model regulation for an insurance department to adopt as a rule; guidelines are published alongside them. The AI document of 2023 is a model bulletin, written for a commissioner to issue.