The NAIC model bulletin on AI: what insurers and their vendors need to have ready

The short answer

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted in December 2023, tells insurers that decisions made with AI must meet the same insurance laws as any other decision, and expects each insurer to keep a written “AIS Program” covering governance, risk management controls and internal audit.¹ It also lists what a state regulator may request during an investigation: the written program, inventories of models, data lineage, validation and drift testing, and contracts with AI vendors.¹ A bulletin is a model; each state decides whether to issue it, so check your state’s version.

What the bulletin is

The National Association of Insurance Commissioners writes model laws, regulations and bulletins that state insurance departments can adopt. This one sets out regulators’ expectations for AI used in regulated insurance practices. It rests on existing state laws: unfair trade practices, unfair claims settlement practices, corporate governance disclosure, rating laws and market conduct surveillance.¹ It does not create a new AI statute. The NAIC lists the bulletin’s adoption as December 2023.²

How widely it applies depends on your states. In May 2025 an NAIC release quoted a state commissioner saying nearly 30 states had enacted the bulletin.³ That is a point-in-time statement; your state department’s site is the place to confirm the current status and wording.

The same release gives a sense of how common AI already is in health insurance. In an NAIC survey of 93 health insurers, run under the market examination authority of 16 states between November 2024 and January 2025, 84% said they use AI or machine learning in some capacity, and nearly 92% said they have AI/ML governance principles. Use areas include utilization management, prior authorization and fraud detection.³

The definitions that matter

Two definitions do most of the work.

The AI System definition is broad. A rules engine plus a language model that drafts a claim decision letter fits. So does an agent that reads a prior authorization request and suggests an approval. The trigger isn’t the technology; it’s whether the output influences a regulated decision.

The written AIS Program

The bulletin expects every insurer authorised in the state to “develop, implement, and maintain” a written program for the responsible use of AI systems that make or support decisions related to regulated insurance practices.¹ Its main features:

• Governance, risk controls and internal audit. The program addresses all three.¹
• Senior management accountability. Responsibility for the program sits with senior management accountable to the board or a board committee.¹
• Proportionality. Controls scale with the insurer’s own risk assessment, considering the nature of the decision, the degree of potential harm, the extent to which humans are involved in the final decision, transparency to the consumer, and reliance on third-party data and models.¹
• The whole life cycle. The program covers product design, marketing, underwriting, rating, case management, claim administration and payment, and fraud detection.¹

The risk management section is the most concrete. It asks for an oversight and approval process that includes “constraints and controls on automation,” data practices covering lineage, quality and integrity, inventories and documentation of predictive models, validation and testing, protection of non-public information, and data and record retention.¹

Note the phrase about humans. The bulletin doesn’t require a human in every decision, but it makes human involvement one of the factors that sets how strict the controls must be.¹ An insurer that lets an AI system act without review should expect to show stronger controls elsewhere.

Third-party AI and vendors

Most insurers buy AI rather than build it. The bulletin covers that directly. The program should address third-party data and AI systems, including due diligence on the vendor, contract terms that give the insurer audit rights and require the vendor to cooperate with regulatory inquiries, and the insurer actually exercising those audit rights.¹

For a vendor selling claims or utilization tools to insurers, this means your customer’s examiners may end up asking about your system. Expect contract clauses on audit rights and regulator cooperation, and expect to supply documentation of how your models were built and tested.

What a regulator may ask for

Section 4 is the practical part. In an investigation or market conduct action, an insurer “can expect to be asked about its development, deployment, and use of AI Systems” and their outcomes.¹ The listed requests include:

The bulletin is explicit that it “is not to prescribe specific practices or to prescribe specific documentation requirements.”¹ It describes expectations and the kinds of documents a department may ask for. That leaves room for different approaches, and it also means you can’t point to a single checklist and call the job done.

Where AI agents fit

The bulletin was written with predictive models in mind, but its definitions cover AI agents that act inside claims and prior authorization systems. Three parts matter most.

Constraints on automation. An agent that can approve, deny or pend a claim is a decision path. The bulletin asks for documented constraints and controls on automation.¹ In practice that means a written list of what the agent may do on its own and what needs a person.

Records of what happened. An examiner asking about a specific adverse outcome will want to know what the system did for that consumer. Logs that only record “the agent ran” don’t answer that. You need the action, the data it used, the policy that allowed it, and who approved it if anyone did. Our post on audit record fields for AI actions lists what to capture.

Record retention. The bulletin lists data and record retention as part of risk management.¹ It doesn’t set a period; state law and your own retention schedule do.

For health insurers, these expectations sit alongside federal rules on prior authorization APIs and timelines. Our posts on the CMS prior authorization rule and AI records for pre-authorization cover those, and our insurers page shows how agent actions get recorded.

A checklist for insurers and vendors

1. Check whether each state you write business in has issued the bulletin, and in what form.
2. Keep a written AIS Program with named senior owners and board reporting.¹
3. Keep an inventory of AI systems and models that touch regulated decisions, including agents.¹
4. Write down the constraints on automation: what each system may decide alone.¹
5. Record data lineage and keep validation and drift test results.¹
6. Put audit rights and regulator cooperation in vendor contracts, and use them.¹
7. Make sure you can reconstruct what an AI system did in a single consumer’s case.
8. Set retention for AI records under your existing schedule.¹

Questions people ask

Is the NAIC bulletin a law?

No. It is a model bulletin that states can issue. It explains how existing state insurance laws apply to AI.¹

Does it ban automated claim decisions?

No. It asks insurers to weigh how much humans are involved when setting controls, and to make sure decisions meet existing standards whatever tools are used.¹

Does it apply to vendors?

Not directly. It applies to insurers, but asks them to do due diligence on vendors and secure audit and cooperation rights in contracts.¹

This post summarises the NAIC model text and is not legal advice. To see agent actions recorded with approvals in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).

Written with AI assistance and checked against our claims register.