NAIC AI Model Bulletin in 2026: What an Agency Must Document

The NAIC’s Model Bulletin on the Use of Artificial Intelligence Systems by Insurers is written to carriers, not to you. Read the addressee line and it says so directly: “TO: All Insurers Licensed to Do Business In [Jurisdiction].” But 25 states have now adopted it, your carrier’s own compliance duty under it reaches into how it vets the agencies it works with, and a handful of states wrote their own version that names agents by name. So the honest answer to “do I need to document my AI use under the NAIC AI Model Bulletin” is: probably not by that exact name, yet — but build the file anyway, because you’re going to get asked for pieces of it either by a carrier’s due-diligence team or by your own state going the way Texas already did. This article gives you the actual written document to build, section by section, straight from the bulletin’s own text.

What the NAIC AI Model Bulletin actually says, and who it’s written for

The National Association of Insurance Commissioners adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023, through its Executive Committee, Plenary, and Innovation, Cybersecurity, and Technology (H) Committee (NAIC, Model Bulletin). It’s a template, meant for a state insurance department to issue as its own bulletin, reminding “all Insurers that hold certificates of authority to do business in the state that decisions or actions impacting consumers that are made or supported by… Artificial Intelligence (AI) Systems… must comply with all applicable insurance laws and regulations.” The bulletin ties that duty to two existing bodies of law every state already has: the Unfair Trade Practices Act and the Unfair Claims Settlement Practices Act. Actions taken using AI “must not violate the UTPA or the UCSPA,” the bulletin states, “regardless of the methods the Insurer used to determine or support its actions.”

Read that again and the scope is plain: this is a carrier obligation, addressed to the entity holding the certificate of authority. If you’re a licensed producer reading this at your own desk, the bulletin’s text does not name you. That matters, because a lot of secondhand summaries of this bulletin blur “insurer” and “agency” together, and the distinction isn’t just semantic — it determines who actually gets asked for documentation, and under what legal authority.

What the bulletin asks every insurer to build is what it calls a written “AIS Program” — a documented, board-accountable program for the responsible use of AI systems that make or support decisions tied to regulated insurance practices. “All Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program… for the responsible use of AI Systems,” the bulletin reads, “designed to mitigate the risk of Adverse Consumer Outcomes.” The rest of this article is built around that program, piece by piece.

Why an agency gets pulled in anyway

If the bulletin only names insurers, why does an agency need to care? Two reasons, and neither one is a stretch.

The first is built into the bulletin’s own Section 4.0, titled “Third-Party AI Systems and Data.” It directs each insurer’s AIS Program to address “the Insurer’s process for acquiring, using, or relying on” third-party data and third-party AI systems, including “due diligence and the methods employed by the Insurer to assess the third party,” contract terms that “provide audit rights” and “require the third party to cooperate with the Insurer with regard to regulatory inquiries,” and ongoing confirmation of “the third-party’s compliance with contractual and, where applicable, regulatory requirements.” If your agency uses an AI tool to draft marketing copy, score calls, or quote plans in work you do for a carrier, you are the third party that section describes. A carrier building out its own AIS Program under state pressure has to document how it vets exactly that kind of vendor — which means the due-diligence questions eventually land on your desk, framed as “show us your AI governance,” whether or not your state ever adopted the NAIC bulletin by name.

The second reason is that some states didn’t stop at the NAIC’s language. Texas is the clean example. Texas never adopted the NAIC model bulletin at all — it’s one of four jurisdictions (alongside California, Colorado, and New York) that regulate insurer AI through its own separate framework instead (NAIC, Implementation map, April 1, 2026). The Texas Department of Insurance issued its own AI-specific bulletin, B-0003-26, on June 12, 2026, and where the NAIC’s bulletin addresses only “Insurers,” Texas’s own bulletin is addressed to “All regulated entities and their agents and representatives,” with its expectations stated to “extend to any third party working with a regulated entity” (TDI, Bulletin B-0003-26, June 12, 2026). That’s not a vendor-oversight clause an agency gets swept into. That’s an agent named directly in the bulletin’s own scope.

How many states have adopted it, and how fast that number is moving

The NAIC publishes its own tracker of adoption, updated periodically, and the most recent version is dated April 1, 2026. As of that date, 25 jurisdictions have adopted the bulletin: Alaska, Arkansas, Connecticut, Delaware, the District of Columbia, Hawaii, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, Oklahoma, Pennsylvania, Rhode Island, Vermont, Virginia, Washington, Wisconsin, and West Virginia (NAIC, Implementation map, April 1, 2026). Four more jurisdictions — California, Colorado, New York, and Texas — regulate insurer AI through an existing, separate framework of their own rather than adopting the NAIC’s text, which the same map tracks under a different legend color.

That’s a near-tripling of adoptions in two years, and it hasn’t leveled off. If your own state hasn’t adopted it yet, that’s a snapshot, not a guarantee it won’t. Check your own state Department of Insurance’s bulletin archive directly rather than assuming last year’s answer still holds.

The eight things your written AIS Program needs to cover

Here’s the part most summaries of this bulletin skip: the actual checklist, pulled directly from the bulletin’s own section numbers, not paraphrased into something vaguer. You can build this as a real document this week, with zero software, using nothing but the text below and your own agency’s actual practices.

Everything above works whether you ever join anything or not. It’s eight sections, drawn straight from a public document, and an afternoon with a blank page gets you a first draft.

What a regulator, or a carrier’s due-diligence team, can actually ask you to produce

Section 4 of the bulletin spells out what a department can request “in the context of an investigation or market conduct action,” and the list is longer and more specific than most agents expect. It names, among other things: the written AIS Program itself; documentation of how and when it was adopted; the program’s scope and what it excludes; an explanation of how the program is “tailored to and proportionate with” the insurer’s actual AI use; the policies, procedures, training materials, and guidance behind it; due-diligence records on any third-party data or AI system; an inventory and description of every predictive model in use; and, for any specific model under review, documentation of its data source, lineage, and bias testing, plus the vendor contracts and audit confirmations behind any third-party tool.

That list matters for a reason beyond regulators: it’s effectively the same checklist a carrier’s own compliance team reaches for when it’s deciding how much AI-assisted marketing or quoting work to let an agency partner do. “Regardless of the existence or scope of a written AIS Program,” the bulletin notes, an insurer under examination “can expect to be asked about its development, deployment, and use of AI Systems.” A carrier facing that question from its own regulator has every incentive to ask the same question of you first, on its own timeline, before a regulator asks it of them.

What it actually costs to not have this on file

The bulletin ties AI-driven decisions directly back to each state’s existing Unfair Trade Practices Act, so it’s worth seeing what one of those statutes actually puts on the table. Florida’s version, Section 626.9521 of the 2026 Florida Statutes, opens with “No person shall engage in this state in any trade practice” that the statute defines as unfair — language that isn’t limited to insurers. Subsection 2 sets the fine schedule: “not greater than $12,500 for each nonwillful violation” and “not greater than $100,000 for each willful violation,” with a separate aggregate cap of “$50,000 for all nonwillful violations arising out of the same action” and “$500,000 for all willful violations” when the violator is an insurer specifically. A later subsection of the same statute addresses a “licensee” directly, which is a strong signal the broader “person” language in subsection 1 reaches licensed agencies, not just the carrier’s own corporate entity.

Florida is one state, and every state’s Unfair Trade Practices Act is its own statute with its own numbers — this isn’t a national figure, and you should check your own state’s version before assuming Florida’s caps apply to you. What it illustrates is the mechanism: the NAIC bulletin doesn’t create a new penalty by itself. It takes a law that already applies to you and tells examiners to look at your AI use through it.

Build the one-page policy right now

None of this needs a vendor, a consultant, or a template you have to buy. Here’s the actual outline, built directly from the eight items above, written so you can copy the headers into a blank document today.

1. Scope. One sentence: which AI tools this policy covers, and which parts of your work they touch (marketing copy, lead scoring, call review, quoting assistance — name them).
2. Owner. One name. The person who reviews new tools before they’re adopted and reviews this document at least once a year.
3. Tool inventory. A table: tool name, vendor, what it does, what data goes into it, who uses it. Update it when a tool gets added or dropped.
4. Human review checkpoint. One sentence per tool category: what a human checks before AI-assisted output reaches a client. For marketing copy, that might be “a licensed agent reviews every piece before it’s published or sent.” For quoting assistance, “a licensed agent confirms every quote against the carrier’s own rate sheet before presenting it.”
5. Data handling boundary. What data never goes into a general-purpose AI tool — specifically, any protected health information tied to a named client, unless the tool has a signed Business Associate Agreement in place.
6. Vendor notes. For each tool in your inventory: why you picked it, and a link to its terms of service or contract.
7. Training record. A line noting when each team member was walked through this policy, and by whom.
8. Retention. How long you keep the records this policy generates — the inventory updates, the training sign-offs, any incident notes.

Write that out once, date it, and you’ve built the document that answers almost everything Section 4 lists. It’s not legal advice and it’s not a substitute for your own counsel reviewing it against your specific state’s rules, but it’s a real document instead of a blank page the first time someone asks.

How Ambrose turns the policy into a living record

Writing the policy is a one-afternoon task. Keeping it true six months later, after your tool stack has changed twice and three people have used it without reading it again, is the part that actually fails in most agencies. This is where a second, automatic layer of record-keeping earns its place next to the document itself.

Per Ambrose’s own documentation, every model call the platform makes is logged with “model, provider, tokens, cost, and latency,” and separately, “every action an agent takes is logged” (Ambrose docs, What is Ambrose). That’s not a marketing claim about compliance — it’s a factual description of what gets recorded automatically, which is a different thing from the governance document itself, and this article isn’t going to blur the two. The written AIS-style policy is still something you write and adopt. What Ambrose’s logging gives you is the evidence trail underneath it: when item 04 of your policy says “a human reviews AI-assisted output before it reaches a client,” Ambrose backs that specific claim with a real mechanism — anything that writes to your CRM “waits for your approval with Allow, Deny, or Always Allow” before it goes out, which is an enforced checkpoint, not a policy statement someone has to remember to follow (Ambrose docs, What is Ambrose).

For the “who owns this” piece of the policy, Ambrose’s War Room adds a standing second opinion rather than a single person checking a box alone. The War Room is a roster of nine executive personas, and one of them, Dr. Elena Reyes, is specifically the Compliance persona (Ambrose docs, War Room). Ask it a question about how a specific AI-assisted workflow is being governed, and Ambrose “decides which head answers, or convenes a small group, and synthesizes the response” — the Compliance persona is reachable the same way the others are, as a standing resource rather than a document that goes stale.

And for the data-boundary piece, Ambrose’s PHI handling only runs against model providers under a signed Business Associate Agreement — specifically Claude through Amazon Bedrock in US regions — which is the mechanism behind “HIPAA-aware by default,” not “HIPAA certified,” because there’s no such thing as HIPAA certification for a software platform (Ambrose docs, How client data is protected).

What you get by joining

One Ambrose seat, including everything described above, comes with a Tech Savvy Insurance membership: $97 a month, billed monthly, cancel anytime, with the founding rate locked in while the membership stays active. Alongside the seat: weekly Zoom calls with open Q&A and build-with-you sessions, 30+ hours of recorded training, Meta Ads, AI, and marketing training built for this industry specifically, pre-built AI templates and bot deployments, and a free annual in-person member workshop. It’s an explicit no-recruiting zone, too, which matters here specifically: you can bring your actual AI use policy to a Tuesday call and have someone look at it with you, without the conversation turning into a pitch for a downline.

Writing this policy with AI, without creating a new problem

If you draft the policy itself with a general AI tool, that’s fine — it’s generic language, no client data involved. The place to be careful is when you’re testing the policy against real examples. Don’t paste a real client’s name, health condition, or specific plan details into a general-purpose AI tool that hasn’t signed a Business Associate Agreement with you, even as a “just checking how this reads” exercise. That’s protected health information leaving your control with no accountability on the other end for how it’s stored or reused. The NAIC’s bulletin itself frames the underlying expectation plainly: a written program, a named accountability structure, and documentation a regulator or carrier could ask to see.

Compliance: what this touches, and what it doesn’t

This article explains what the NAIC’s Model Bulletin says, who it’s formally addressed to, how states have adopted or diverged from it, and a practical written-policy outline an agency can build on its own initiative. It is not legal advice, and it does not tell you whether your specific state has adopted the bulletin, in what form, or whether your agency’s conduct would be found to violate your state’s Unfair Trade Practices Act. Confirm your own state’s current bulletin status directly with your state Department of Insurance, and have your own counsel review any policy before you treat it as your agency’s official compliance document. This article also doesn’t cover the separate NAIC Data Security Model Law, which governs how insurance licensees protect nonpublic information generally — we cover that one separately in our NAIC Data Security Law guide.

The close

The NAIC AI Model Bulletin is written to carriers, not to you, by name — but 25 states have adopted it, your own carrier’s compliance duty under it reaches your agency through ordinary vendor due diligence, and states like Texas have already closed the gap by naming agents directly. The eight-item checklist above is the real document, pulled straight from the bulletin’s own section numbers, and you can write a first draft of it this afternoon with nothing but a blank page. If you’d rather have an automatic record underneath that document instead of a policy nobody checks again until someone asks, one Ambrose seat comes with a Tech Savvy membership, and it’s the kind of thing the weekly build-with-you calls walk through directly: https://techsavvyinsurance.com/.