Summary
- The NAIC adopted the model on 4 Dec 2023. It is a template: it has no force until a state insurance department issues it as its own bulletin.
- It does not create new law. It reminds insurers that decisions made or supported by AI must still meet existing laws on unfair trade practices, unfair claims settlement, corporate governance disclosure and rating.
- Insurers are expected to keep a written AIS Program (AI Systems Program), proportionate to their AI use, covering governance, risk controls and internal audit across the whole insurance life cycle (product design, marketing, underwriting, pricing, claims, fraud).
- The programme must also cover third-party AI and data: due diligence on vendors, contract terms giving audit rights and cooperation with regulator inquiries, and checks that vendors comply.
- It lists the documents a regulator may request in an investigation or market conduct exam (inventories, governance records, testing and validation, drift monitoring, vendor contracts and audits).
Who it applies to
- Insurers licensed in a state that has adopted the bulletin.
- Indirectly: vendors supplying AI models, scores or data to those insurers, through due diligence and contract terms.
- Adoption (NAIC map, status as of 8 Oct 2026): 27 states plus the District of Columbia and Puerto Rico. Adopted states: Alaska, Arkansas, Connecticut, Delaware, Hawaii, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Mississippi, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, North Dakota, Oklahoma, Pennsylvania, Rhode Island, South Carolina, Vermont, Virginia, Washington, West Virginia, Wisconsin.
- California, Colorado, New York and Texas have their own insurance AI rules instead (listed separately on the map). The NAIC notes the map does not judge whether each state copied every element.
- Not extraterritorial: it binds insurers through their state licence.
Key dates
- Adopted by NAIC Innovation, Cybersecurity, and Technology (H) Committee
- Adopted by NAIC Executive Committee and Plenary
- Alaska becomes first state on the NAIC list to adopt
- North Dakota adopts; NAIC map (status 8 Oct 2026) shows 27 states plus DC and Puerto Rico
Full date record
| Date | Event |
|---|---|
| 2023-12-04 | NAIC adopts the model bulletin |
| 2024-02-01 | First state adoption on the NAIC list (Alaska) |
| 2026-10-05 | Latest adoption on the map (North Dakota) |
| 2026-10-08 | NAIC map status date: 27 states, DC, Puerto Rico |
Penalties and enforcement
- No penalties in the bulletin itself.
- Enforcement is through each state's existing insurance laws and market conduct examinations, where regulators can ask for the AIS Program documents.
- No public enforcement action under an adopted bulletin was found as of 2026-10-19 (one secondary source said none by early 2026).
What it means for an Indian company
- Indian insurtech, analytics and IT vendors serving US insurers (claims automation, underwriting models, fraud scoring, chatbots) will face the insurer's AIS Program due diligence. Expect:
- Questionnaires and audit-rights clauses (SC-AI-007 Third-party and vendor AI due diligence).
- Requests for model documentation, validation and drift reports (SC-AI-014 Model documentation (model cards, system cards), SC-AI-016 Independent model validation, SC-AI-020 Performance monitoring and drift detection).
- Bias and unfair discrimination testing evidence (SC-AI-017 Fairness and discrimination testing of outputs, SC-AI-013 Data bias and representativeness checks).
- A duty to cooperate with regulator inquiries about your product.
- The bulletin lets insurers base their programme on recognised frameworks such as NIST AI RMF and GenAI Profile, so mapping your controls to NIST makes sales easier.
- Indian insurers' captive tech centres doing work for US parents should put this in their applicability register (SC-AI-009 Regulatory applicability register and horizon scanning).
Obligations
Full obligation breakdown coming
We break the most requested policies down into numbered obligations mapped to controls. Leave your details and we’ll tell you when NAIC AI Model Bulletin is done.
Glossary
- NAIC: National Association of Insurance Commissioners, the body of US state insurance regulators.
- Model bulletin: a template guidance document states can adopt.
- AIS Program: the insurer's written programme for responsible use of AI systems.
- Market conduct examination: a regulator's review of how an insurer treats consumers.
- Unfair discrimination: treating similar risks differently without actuarial justification, or using prohibited factors.
- Model drift: a model's performance changing over time as data changes.
Key takeaways
- Supervisory guidance, binding in practice only where a state adopts it; 27 states plus DC and Puerto Rico as of 8 Oct 2026.
- Insurers need a written, risk-based AI programme covering governance, testing and vendors.
- Vendors are pulled in through due diligence, audit rights and regulator cooperation clauses.
Official sources
- NAIC Model Bulletin (PDF), accessed 2026-10-19
- NAIC implementation map, status as of 8 Oct 2026 (PDF), accessed 2026-10-19
- NAIC Big Data and AI (H) Working Group, accessed 2026-10-19
This is general information, not legal advice. Last verified 19 Oct 2026 against the official source. Laws change; confirm the current position with qualified counsel before acting.