AI Regulation Tracker  /  Regulation in force

AI Underwriting Is Now Governed in 24 States and DC. The NAIC Framework Insurers Owe

The NAIC Model Bulletin sets state regulators' expectations for how insurers govern AI in underwriting, pricing, claims, and fraud. By April 2026, 24 states and DC had adopted it, about half the country, and the NAIC built an examination tool to check it. What insurers and compliance teams owe now.

By Anthony Guerriero  ·  Reviewed by The Leveraged Years Editorial Desk  ·  Published June 28, 2026  ·  Last updated June 28, 2026

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted by the NAIC on December 4, 2023, tells insurers what state regulators expect when AI is used in underwriting, pricing, claims, marketing, or fraud detection: a written AI Systems program with board and senior accountability, risk management, testing for unfair discrimination, documentation, and third-party vendor oversight. As of the NAIC adoption map dated April 1, 2026, 24 states and the District of Columbia had adopted it, about half of US states, with four more states (CA, CO, NY, TX) running their own insurance-specific AI rules. Primary source: the NAIC Model Bulletin and the NAIC AI Model Bulletin State Adoption Map.

AI underwriting now answers to a framework most states have adopted

For years, an insurer that used AI to set a price or screen a risk could treat the model as its own business. That assumption is gone across much of the country. The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted by the NAIC on December 4, 2023, tells insurers what regulators expect when AI sits inside underwriting, pricing, claims, marketing, or fraud detection. It has now been adopted by 24 states and the District of Columbia, according to the NAIC's own adoption map dated April 1, 2026, with four more states running their own insurance-specific AI rules.

That spread is the story. A piece of model guidance that some insurers could once watch from a distance is now live policy in about half the states, and in 2026 the NAIC built the machinery to check it: an AI Issue Brief published March 3, a 12-state pilot of an AI Systems Evaluation Tool running through September, and an updated tool slated for adoption at the Fall 2026 National Meeting.

What the bulletin actually asks for

The bulletin is not a ban on AI and it does not prescribe a technology. It also does not create new substantive prohibitions or add to the list of forbidden underwriting factors. It does two things. First, it reminds insurers that existing insurance law still applies when a decision is made or supported by AI, including the rules against unfair discrimination. An algorithm does not get a pass that a human underwriter would not. Second, it sets out the regulator's expectations for how an insurer governs AI: a written AI Systems program, senior management and board accountability, risk management proportionate to the potential for consumer harm, testing and validation, documentation, and oversight of the third-party data and models the insurer relies on.

In plain terms, the regulator expects you to be able to show how your AI is governed, not just that it works. The bulletin then describes the kind of information and documentation a department may request during an investigation or examination, which is the part that should focus a compliance team's attention.

Why "guidance" is the wrong word to relax about

It is fair to say the Model Bulletin is not a statute. It is guidance that states issue as a bulletin to communicate expectations. But two things make that a thin comfort. The first is that the bulletin rests on law that already binds insurers. The duties around fair pricing, accuracy, and unfair discrimination predate AI, and the bulletin simply states that those duties follow the decision wherever the decision is made, by a person, an algorithm, or a vendor. The second is that once a state issues the bulletin, it becomes that department's stated examination standard. When an insurer is examined, the questions come from this framework, and "we did not think it was binding" is not an answer a market conduct exam accepts.

So the precise way to read it is this: the bulletin itself is regulator expectation, but it becomes enforceable as each state adopts it and applies it through the laws and the examination authority the department already holds. More than half the states have now taken that step.

The NAIC built the examination tool to match

The clearest signal that this is a sustained priority, not a one-time memo, came in 2026. The NAIC published an AI Issue Brief in March 2026 staking out its position that state-based oversight of insurer AI should hold, and it launched a pilot of an AI Systems Evaluation Tool. The tool gives regulators a structured way to review an insurer's AI systems and governance during market conduct and financial examinations. Twelve states are running the pilot from early 2026 through September 2026, including Colorado, Maryland, Louisiana, Virginia, Connecticut, Pennsylvania, Wisconsin, Florida, Rhode Island, Iowa, Vermont, and California, and the NAIC anticipates adopting an updated tool at its Fall 2026 National Meeting.

Two details matter for planning. The tool is not mandatory, so a regulator is not required to use it, which is exactly why a compliance team should. It is the clearest published picture of what an examiner will look for, which makes it a free self-assessment benchmark. And the NAIC's parallel work on third-party data and model vendors signals that the vendor models behind your pricing and underwriting are squarely in scope.

What insurers and compliance teams owe now

The work starts with an inventory. List every AI and algorithmic system that touches underwriting, pricing, claims, marketing, or fraud, and include the third-party vendor models, because the framework reaches algorithms that make material decisions about consumers regardless of who built them. From there, the defensible position is a written AI Systems program: named board and senior accountability, documented policies, a risk assessment that scales attention to the systems that can cause the most harm, recurring testing for unfair discrimination, and vendor diligence that secures audit rights and cooperation in a regulatory inquiry.

Then test it against the NAIC's Evaluation Tool as if your state were in the pilot. The point is not to chase a certificate. It is to be able to answer, in an examination, the one question this framework now lets a regulator ask across much of the country: show us how your AI is governed.

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.