AI Regulation Tracker / Regulatory guidance
NAIC AI Bulletin: An Underwriter Compliance Checklist
More than half of US states now enforce the NAIC Model Bulletin on insurer use of AI. Underwriters, actuaries, and compliance officers need an AIS program and exam-ready evidence, not a vendor promise.
The honest read
The NAIC Model Bulletin is guidance, not a statute. But in each state that adopts it, the commissioner issues it as an enforceable statement of how existing unfair-trade-practice and market-conduct law already applies to AI. As of 2026, a majority of states (more than 25 plus DC, per NAIC and third-party trackers) have done so, and the exact count keeps moving, so confirm your own states. If you write in an adopting state, the expectation is live today, and "the vendor handles it" is not a defense.
The rule in plain English
On December 4, 2023, NAIC members approved the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (NAIC press release). It does not create new law. It tells insurers that when they use AI, existing prohibitions on unfair discrimination and unfair trade practices still apply, and that regulators expect a documented AI Systems (AIS) Program that is risk-based and commensurate with the materiality of each AI use.
The program has clear pillars. First, governance: an accountable structure pulling in compliance, legal, actuarial, and data science, with board or senior-management oversight. Second, risk management and internal controls across the AI lifecycle, covering data quality, bias and unfair-discrimination testing, validation, privacy, and record retention. Third, third-party and vendor oversight: due diligence on acquired data and vendor AI, plus contract terms that preserve audit rights and cooperation with regulators. On top of those, the bulletin expects testing for unfair discrimination, documentation a Department of Insurance can request during a market-conduct exam, and consumer transparency that AI is in use. Each adopting state applies this per its own timeline; there is no single national effective date. NAIC's AI topics page (last updated April 3, 2026) tracks the wider framework.
Who it hits
Underwriters who use AI or ML for risk selection, tiering, or automated decisions. Actuaries who build or validate pricing models. Compliance and legal teams who own the AIS program and exam readiness. Any insurer holding a certificate of authority in an adopting state is bound, including small and mid-size carriers. The biggest gap sits with smaller carriers that rely entirely on third-party vendor models and assumed the vendor carried the compliance load; vendor oversight is your obligation, not theirs. Multistate carriers are bound wherever any single adopting state applies it, so your most-regulated state effectively sets your floor.
What to do this week
1. Build or refresh an AI model inventory, and flag every model that is vendor-supplied. 2. Confirm a written AIS Program exists with a single named owner across compliance, legal, actuarial, and data science. 3. Pull validation and unfair-discrimination testing documentation for each model in use. 4. Secure vendor attestations and audit-rights clauses that preserve your ability to cooperate with regulators. 5. Wire adverse-action explainability and a consumer notice that AI is in use into your decision flow. 6. Assemble an exam-ready evidence folder a Department of Insurance could request tomorrow. 7. Map your writing footprint to adopting states so you scope obligations to where they actually apply, and confirm any state-specific modifications to the model bulletin with your Department of Insurance or counsel.
Related tracker rows
Frequently Asked Questions
Is the NAIC AI model bulletin binding on my company?
It is guidance, but in each adopting state the commissioner issues it as an enforceable statement of how existing unfair-trade-practice and market-conduct law applies to AI. It binds you in the states that adopted it.
How many states have adopted it?
A majority of states, more than 25 plus DC, as of 2026, per NAIC and third-party trackers, and the exact count keeps changing. There is no single national effective date; it applies per state on issuance.
We only use a vendor's model. Are we covered?
No. The bulletin's third-party oversight pillar makes the insurer responsible for vendor AI. You need vendor attestations, audit-rights clauses, and the vendor's testing documentation on file.
Sponsored Training
Browse the full AI Regulation News tracker
Informational analysis for working professionals, not legal advice. Confirm how any rule applies to your situation with qualified counsel.