NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers

What it is

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers was adopted by the National Association of Insurance Commissioners on 4 December 2023. The NAIC is the standard-setting body of US state insurance regulators. Its model bulletins are templates that each state’s insurance department can issue, with or without changes, under its own authority.

The bulletin does not create new law. It reminds insurers that decisions they make or support with AI must comply with all applicable insurance laws, including those on unfair trade practices, unfair claims settlement and unfair discrimination. It then sets out what regulators expect an insurer to have in place, and what they may ask to see.

Who it applies to

Once a state issues it, the bulletin applies to insurers licensed in that state that use AI systems to make or support decisions affecting consumers. It covers AI across the insurance life cycle, including product development, marketing, underwriting, rating and pricing, case management, claims and fraud detection. It defines an AI System broadly, as a machine-based system that can generate outputs such as predictions, recommendations or content that influence decisions, and also addresses predictive models.

What it requires

The core expectation is a written AIS Program for the responsible use of AI systems that make or support decisions related to regulated insurance practices. It should be designed to mitigate the risk of adverse consumer outcomes, meaning decisions that adversely affect consumers in a way that breaches insurance regulatory standards. Controls should be proportionate to the insurer’s use of AI and the degree of potential harm to consumers.

General guidelines. The programme addresses governance, risk management controls and internal audit. Senior management, accountable to the board or a board committee, is responsible for it. It covers every phase of an AI system’s life cycle from design to retirement, applies whether the system was built in-house or by a vendor, and includes notice to consumers that AI is in use, with information suited to the stage of the insurance life cycle. It can sit within the insurer’s enterprise risk management programme and can rely on a framework such as the NIST AI RMF.

Governance. Policies and procedures for each life cycle stage, documentation requirements, and an accountability structure. That may include cross-functional committees drawing on business units, actuarial, data science, underwriting, claims, compliance and legal, with clear authority, independence between lines of defence, monitoring and escalation protocols and ongoing training.

Risk management and internal controls. An approval process for developing, adopting or acquiring AI systems. Data practices covering currency, lineage, quality, integrity, bias analysis and suitability. An inventory and documentation of predictive models, with assessments of interpretability, robustness, reproducibility, traceability and model drift. Validation and retesting after implementation, protection of non-public information and record retention.

Third-party AI systems and data. Due diligence on vendors and their data or systems, so that decisions they support meet the standards that apply to the insurer itself. Contract terms, where available, giving audit rights or access to audit reports and requiring cooperation with regulatory inquiries, and use of those rights in practice.

Regulatory oversight. Section 4 lists what a department may request in an investigation or market conduct examination, such as the written programme and its scope, the policies, procedures and training behind it, documentation of risk management and testing for specific models, and information about third-party systems and data. An insurer should expect those questions whether or not it has a written programme.

Key dates

• 4 December 2023. Adopted by the NAIC.
• 1 February 2024. Alaska becomes the first state to issue it, with other states following through 2024, 2025 and 2026.

The NAIC’s Big Data and Artificial Intelligence (H) Working Group has since developed an AI Systems Evaluation Tool to help regulators examine insurers’ AI use, which a group of states piloted in 2026.

How it relates to other frameworks

The bulletin is the main AI expectation for US insurers, but not the only one. Colorado’s Division of Insurance has its own regulations on insurers’ use of external consumer data and algorithms, and from 2027 Colorado SB 26-189 adds notice, explanation and human review for insurance decisions. Some states have issued separate guidance instead of the bulletin.

The bulletin’s structure, a written programme, an inventory, life cycle controls and vendor oversight, mirrors the NIST AI RMF and ISO/IEC 42001, and an insurer with either in place has most of the content an AIS Program needs. For banks, the equivalent expectations sit in the federal agencies’ model risk management guidance.