NAIC AI Bulletin Compliance: What Insurance Carriers Need to Evidence

Key takeaways

• The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (adopted December 4, 2023) says decisions made or supported by AI must follow existing insurance law, including unfair trade practices and unfair discrimination rules.
• Section 4 tells insurers that in an investigation or market conduct action, they can expect to be asked about how they develop, deploy and use AI systems, the outcomes of those systems, and their governance framework—regardless of whether they have a written AI Systems Program.
• About half of U.S. jurisdictions have adopted the bulletin (25, per the NAIC map with status as of April 1, 2026), and California, Colorado, New York and Texas have their own insurance-specific regulation or guidance.
• A per-claim file checklist and a program-level inventory help insurers prepare for exam questions before they arrive.

The NAIC bulletin is not a new set of rules. It is a reminder that AI-supported decisions are still insurance decisions, and the existing rules that apply to those decisions still apply to the AI that supports them.

What the bulletin says

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted December 4, 2023, states that decisions made or supported by AI systems must follow existing insurance law, including unfair trade practices and unfair discrimination rules. It directs insurers to apply their existing governance frameworks to AI use and to document how they do so.

Section 4 of the bulletin says that in an investigation or market conduct action, an insurer can expect to be asked about:

• How it develops, deploys and uses AI systems, or any specific model or application
• The outcomes of those systems, including adverse consumer outcomes
• Its governance framework, risk management and internal controls

The bulletin expects every insurer to “develop, implement, and maintain a written program (an “AIS Program”)” for AI systems that make or support regulated decisions. Section 4 adds that the examination questions apply “regardless of the existence or scope of a written AIS Program.” So a carrier that has not yet written its program is still expected to answer the same questions about its AI use.

The NAIC’s implementation map (status as of April 1, 2026) shows 25 jurisdictions as having adopted the bulletin, and four more (California, Colorado, New York and Texas) with insurance-specific regulation or guidance of their own. Carriers should check the map for the states where they operate.

One claim can involve multiple AI systems

Consider a claims triage workflow. An agent might retrieve policy details, flag a claim for priority, assemble documents for review and route it to a handler. Each of those steps could involve a different AI system.

If an examiner asks about that claim, the file should let the reviewer distinguish what happened at each step. Which system flagged the claim? Which system assembled the documents? Which system recommended the routing? Who made the final decision, and on what basis?

Describing the workflow at the component level is more useful than applying a single “AI” label to the whole claim. It lets the examiner see which systems were involved, what they did, and how the carrier controlled each step.

Per-claim file checklist

For each claim where an AI system prepared, ranked or routed work, the file should let a reviewer find:

• Which AI system and version touched it
• What data it used (and from which systems)
• What it produced (documents assembled, flags raised, priority set)
• The decision made, and the named person who owned it
• What evidence supported the decision, kept with the claim
• Whether the outcome was checked for adverse consumer impact, and how
• Whether a third-party vendor model was involved

This checklist is not a requirement imposed by the NAIC bulletin. It is a practical starting point for building claim files that can survive review. The bulletin says examiners will ask about AI use; this checklist helps you be ready to answer.

Program-level checklist

The bulletin also asks about governance frameworks, risk management and internal controls at the program level. A carrier should be able to show:

• Inventory: A current list of AI systems used in underwriting, claims, pricing and fraud, with owners
• Testing: How each system is tested before changes go live, including for unfair discrimination
• Governance: Who approves a new AI use, who reviews it, how often
• Documentation: Where a regulator would look, and who can produce it fast
• Third parties: What you require of vendors that supply AI, and how you check

These are the same questions a carrier would expect to answer about any significant system that affects policyholder decisions. The bulletin makes clear that AI systems are not exempt from that expectation.

Questions to bring to the review

The following is a suggested discussion checklist for an AI-supported insurance workflow. It is not a list of requirements imposed by the NAIC bulletin, and your compliance, legal and risk teams should determine which questions apply to your specific workflows.

• What does each AI system do? Identify retrieval, scoring, routing and decision support separately.
• How does the carrier classify them? Record the basis for the governance decision and who owns it.
• Which decision does the work support? Make the relationship to the actual business process clear.
• What can the system access or change? Describe specific permissions, including any approval conditions.
• How will you evaluate its contribution? Examine representative cases, adverse outcomes and the work the reviewer still performs.
• What happens when information is missing or inconsistent? Identify the receiving person and the context provided.
• What will the record explain? Include enough to connect the sources, attempted actions and human decision.
• What changes trigger another review? Consider changes to purpose, data, tools, models and permitted actions.

The right answer differs by workflow. A system preparing internal actuarial analysis and one contributing to a claims routing decision deserve examination in their own contexts.

Governance before exam day

The NAIC bulletin does not require carriers to build a new governance framework from scratch. It directs them to apply the frameworks they already have to AI use, and to document how they do so. For the framework itself, our AI agent governance overview covers the control points examiners ask about. If you are new to the terminology, what AI agent governance means in practice is the shorter starting point. For how these controls land in a live claim, underwriting or servicing workflow, see governed insurance AI agents.

For carriers that already have governance processes in place for underwriting, claims, pricing and fraud, the task is to extend those processes to cover AI systems that support those functions. That means adding AI systems to the inventory, testing them before deployment, reviewing them regularly, and documenting the controls that apply.

Carriers that are building new AI workflows should plan for exam readiness from the start. A faster cycle time helps nobody if the claim file cannot survive review. Governed means reviewable.

Frequently asked questions

Does the NAIC bulletin apply to all AI use in insurance?

The bulletin applies to decisions made or supported by AI systems in insurance operations. That includes underwriting, claims, pricing, fraud and other areas where AI affects policyholder decisions. The bulletin says these decisions must follow existing insurance law, including unfair trade practices and unfair discrimination rules.

Does the bulletin require a written AI Systems Program?

The bulletin says insurers are expected to develop, implement and maintain a written AIS Program. It is a model bulletin, so its legal effect depends on whether and how your state adopted it. Section 4 also makes clear that examiners can ask about your AI use “regardless of the existence or scope of a written AIS Program,” so not having one does not narrow the questions.

What states have adopted the NAIC bulletin?

The NAIC’s implementation map (status as of April 1, 2026) shows 25 jurisdictions as having adopted the bulletin. California, Colorado, New York and Texas have insurance-specific regulation or guidance of their own. Carriers should check the map for the states where they operate.

What will examiners ask about AI systems?

Section 4 of the bulletin says examiners can expect to ask about how carriers develop, deploy and use AI systems, the outcomes of those systems (including adverse consumer outcomes), and their governance frameworks, risk management and internal controls.

What should a claim file include for AI-supported decisions?

For each claim where an AI system prepared, ranked or routed work, the file should identify which AI system and version touched it, what data it used, what it produced, the decision made and the named person who owned it, the evidence supporting the decision, whether the outcome was checked for adverse consumer impact, and whether a third-party vendor model was involved.

Does the bulletin apply to third-party vendor models?

Yes. The bulletin’s expectation applies to AI systems regardless of whether they are built in-house or supplied by a third-party vendor. Carriers should document what they require of vendors that supply AI, and how they check that those requirements are met.

Sources

• NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers
• NAIC implementation map for the bulletin (status as of April 1, 2026)

Frequently asked questions

About the author

Arya SharanProduct Marketing & GTM, Moring AIChennai

Owns product marketing and go-to-market at Moring AI across positioning, demand and enablement. Works with regulated buyers on how governed AI agents are scoped, evaluated and bought. Writes about the operating questions that decide whether an agent reaches production.

LinkedIn profile →