State AI Compliance

What is the NAIC AI Model Bulletin?

Last reviewed: Tech Savvy Insurance Data Desk
← All answers

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers — adopted by the National Association of Insurance Commissioners on December 4, 2023 — is regulatory guidance that tells insurers to run a written AI Systems (AIS) Program: governance with accountable senior management, risk management and testing (including for unfair discrimination), documentation a regulator can request, and due-diligence oversight of the third-party AI systems and data they rely on. It creates no new statute; it states how existing law — chiefly each state’s Unfair Trade Practices Act, corporate-governance, and market-conduct requirements — applies when decisions are made or supported by AI (NAIC, model bulletin full text, adopted December 4, 2023).

The qualifier that matters: it is a model. The NAIC cannot bind anyone directly, so the bulletin only has force in a state once that state’s insurance department issues it — which 24 states plus the District of Columbia had done as of the NAIC’s implementation map dated April 1, 2026. The dated, state-by-state list is in Which states have adopted the NAIC AI Model Bulletin?

What the bulletin expects, per its own text

ElementWhat the bulletin asks for
Written AIS ProgramA written program for the responsible use of AI systems that make or support decisions impacting consumers, proportionate to the risk of each use case
GovernanceSenior management accountable to the board (or committee) for the program; clear roles, responsibilities, and documented oversight
Risk management & controlsInternal controls over data, models, and outputs — including validation and testing for accuracy, drift, and unfair discrimination
DocumentationRecords showing how AI systems are developed, used, and reviewed — producible in a market-conduct exam or investigation
Third-party oversightDue diligence and contractual oversight of third-party AI systems, models, and data — including audit rights and cooperation with regulator inquiries

Source: NAIC, Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, full text as adopted December 4, 2023. The bulletin builds on the NAIC’s 2020 Principles on Artificial Intelligence — fair and ethical, accountable, compliant, transparent, and secure/safe/robust.

Why it reaches further than insurers

Two mechanisms carry the bulletin’s expectations beyond carriers. First, the third-party section: insurers adopting an AIS Program are expected to vet the AI systems and data of the parties they work with, which turns “what AI tool does your agency use, and how is it governed?” into a question your upline can ask. Second, the exam trail: the bulletin lists the kinds of AI documentation a regulator may request, and the NAIC began piloting a standardized AI Systems Evaluation Tool with 12 states in 2026 to do exactly that during market conduct exams.

Note the model is not the only path a state can take — California, Colorado, New York, and Texas regulate insurer AI through their own frameworks instead, and Texas’s June 2026 addition is covered in What does Texas TDI Bulletin B-0003-26 require? For how to build a one-page governance policy that satisfies these expectations in a working agency, see AI compliance for insurance agents in 2026.

Related questions

No. It is model regulatory guidance. The NAIC has no direct regulatory authority; each state's insurance department chooses whether to issue the bulletin under its own name. Where adopted, it interprets how the state's existing insurance laws — chiefly unfair trade practices and market conduct — apply to AI, rather than creating a new statute.
It is directed at insurers, but its expectations flow downstream. The bulletin's third-party section expects insurers to exercise due diligence over the AI systems and data of third parties they work with — which includes agencies and vendors in their distribution channel. Agents also remain independently bound by unfair-trade-practice laws, CMS marketing rules where Medicare is involved, and their own E&O obligations.
The bulletin's central ask: a written 'Artificial Intelligence Systems Program' governing how the insurer develops, acquires, uses, and oversees AI. Per the bulletin's text it should cover governance (accountable senior management), risk management and internal controls proportionate to the risk of the use case, testing for accuracy and unfair discrimination, documentation, and oversight of third-party AI systems and data.

Sources

  1. NAIC — Model Bulletin: Use of Artificial Intelligence Systems by Insurers (full text, adopted Dec. 4, 2023) — content.naic.org
  2. NAIC — Members Approve Model Bulletin on Use of AI by Insurers (Dec. 4, 2023) — content.naic.org
  3. NAIC — Principles on Artificial Intelligence (adopted 2020) — content.naic.org
  4. NAIC — Implementation of NAIC Model Bulletin (status as of Apr. 1, 2026) — content.naic.org

Every number on this page names its source and date. Browse all answers or the fuller discussions on the blog. Tech Savvy Insurance is a training and software community — not an insurance company, agency, or law firm — and does not provide insurance, legal, tax, or compliance advice. You are responsible for your own licensure and for complying with all applicable CMS, HIPAA, state, and carrier regulations.