NAIC Model AI Bulletin

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers is the U.S. insurance industry's principal regulatory framework for AI governance. It was adopted by the National Association of Insurance Commissioners (the standard-setting body for state insurance regulators) on December 4, 2023, at the 2023 Fall National Meeting. It sets out the standards licensed insurers are expected to meet when AI systems make or support decisions affecting consumers, and the documentation state regulators may request in an examination or market conduct investigation.

The bulletin requires each insurer to develop and maintain a written Artificial Intelligence Systems Program (the AIS Program), commensurate with the risk and scale of its AI use. The program must address governance (a documented accountability structure spanning actuarial, data science, underwriting, claims, legal, and compliance, with senior management or board oversight), risk management and internal controls, validation and testing for accuracy and unfair discrimination, third-party vendor oversight (written standards for acquiring, validating, and contractually controlling AI built or hosted by outside vendors), consumer protection, and documentation sufficient to demonstrate compliance to a regulator.

The NAIC has no direct rulemaking authority. The model bulletin becomes binding only when each state insurance department issues its own bulletin, regulation, or guidance referencing or paralleling the NAIC text. As of early 2026, roughly 25 states plus the District of Columbia have done so, including Alaska, Arkansas, Connecticut, Oklahoma, Pennsylvania, Rhode Island, Vermont, Washington, and West Virginia, with additional states expected to follow. (New York regulates insurer AI use through its own Insurance Circular Letter No. 7 of 2024 rather than the NAIC bulletin.) Substance is largely harmonized across adopting states; specific filing, examination, and enforcement details vary jurisdiction by jurisdiction.

The bulletin affects two audiences. Insurers must operate the AIS Program and produce its artifacts on demand. Insureds (companies that deploy AI in their own products) are increasingly seeing renewal data requests, application questions, and underwriting calls that mirror the AIS Program elements (governance ownership, testing protocols, vendor controls, incident logging). A mature governance posture that maps onto these elements can shorten underwriting and serve as evidence of reasonable care if an AI claim later reaches litigation.