The NAIC AI Model Bulletin: what insurers are expected to document and test

An adjuster used to own a claim decision. When an AI system drafts that decision, triages the prior authorization behind it and answers the policyholder who calls about it, the question changes. In an adopting state, during an investigation or market conduct action, the insurer "can expect to be asked" how that system was developed and used, and a slide deck will not answer it.

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers is where 29 jurisdictions now start that conversation. It does not invent new rules. It tells insurers how existing rules apply to AI, and what documents a regulator may ask to see.

What the bulletin is and who it applies to

The National Association of Insurance Commissioners adopted the model bulletin on December 4, 2023. A model bulletin is a template. It applies in a state only when that state's insurance department issues its own version.

As of October 8, 2026, the NAIC adoption map lists 29 adopting jurisdictions: 27 states plus the District of Columbia and Puerto Rico. The most recent entries include South Carolina (September 24, 2026) and North Dakota (October 5, 2026). The map lists California, Colorado, New York and Texas separately, under insurance-specific regulation or guidance of their own. The NAIC notes the map "does not reflect a determination as to whether the pending or enacted legislation contains all elements of the model," so read your own state's text.

In an adopting state, the bulletin reaches "all Insurers authorized to do business in this state" (Section 3). Whether a given health plan entity falls within a state's version depends on that state's text. That is our reading, not the NAIC's, and a question for your counsel.

The bulletin rests on laws insurers already follow, including the Unfair Trade Practices Act and the Unfair Claims Settlement Practices Act. Its core sentence is plain: "Actions taken by Insurers in the state must not violate the UTPA or the UCSPA, regardless of the methods the Insurer used to determine or support its actions" (Section 1). The "must" comes from those laws. The bulletin itself sets expectations.

What it asks for

Section 3, "Regulatory Guidance and Expectations," starts from the legal standard. Decisions must not be "inaccurate, arbitrary, capricious, or unfairly discriminatory," and "Compliance with these standards is required regardless of the tools and methods Insurers use to make such decisions" (Section 3).

From there, insurers "are expected to develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices." The AIS Program Guidelines that follow have four parts.

1.0 General Guidelines

The AIS Program "should address governance, risk management controls, and internal audit functions" (1.2). It should vest responsibility with "senior management accountable to the board or an appropriate committee of the board" (1.3). It should be "tailored to and proportionate with" the insurer's use of AI, scaled to the "Degree of Potential Harm to Consumers" (1.4). It should cover the full life cycle, from design and validation to "on-going monitoring, updating and retirement" (1.7), and AI Systems "whether developed by the Insurer or a third-party vendor" (1.8).

2.0 Governance

Governance "should prioritize transparency, fairness, and accountability." The insurer should consider documentation requirements "developed with Section 4 in mind" (2.2), a cross-functional committee drawing on underwriting, claims, compliance and legal (2.3a), and "the independence of decision-makers and lines of defense" (2.3c).

3.0 Risk Management and Internal Controls

This part names specific controls: an "oversight and approval process" for developing or acquiring AI Systems (3.1); data "lineage, quality, integrity, bias analysis and minimization, and suitability" (3.2); "Inventories and descriptions" of Predictive Models (3.3a); and "Validating, testing, and retesting as necessary" (3.4). Validation can include "measuring performance against expert review" (3.4).

On testing for unfair discrimination and inaccuracy, the bulletin uses softer language. The Department "encourages the development and use of verification and testing methods to identify errors and bias in Predictive Models and AI Systems, as well as the potential for unfair discrimination" (Section 3). Encouraged, not required. The underlying standard against inaccurate and unfairly discriminatory decisions is the part that is required.

4.0 Third-Party AI Systems and Data

Insurers should address due diligence on vendors (4.1), contract terms that "Provide audit rights" and require the vendor to "cooperate with the Insurer with regard to regulatory inquiries" where appropriate and available (4.2), and audits to confirm vendor compliance (4.3).

Section 4: Regulatory Oversight and Examination Considerations

Section 4 lists what a regulator may request: the written AIS Program, its scope "including any AI Systems and technologies not included in or addressed by the AIS Program," inventories of AI Systems "that can result in Adverse Consumer Outcomes," data lineage, thresholds, and "Documentation related to validation, testing, and auditing, including evaluation of Model Drift" (Section 4).

The bulletin also limits itself: "The goal of the bulletin is not to prescribe specific practices or to prescribe specific documentation requirements." Insurers may show compliance "through alternative means." But "Regardless of the existence or scope of a written AIS Program," in an investigation or market conduct action an insurer "can expect to be asked about its development, deployment, and use of AI Systems."

Where generative AI makes this harder

The bulletin anticipates generative AI. Its definition of an AI System includes output such as "content (such as text, images, videos, or sounds)," and it defines Generative AI separately (Section 2). Section 4 adds that "the nature of validation, testing, and auditing should be reflective of the underlying components of the AI System, whether based on Predictive Models or Generative AI."

That last sentence is the hard part. Guidelines 2.4 and 3.7 apply "Specifically with respect to Predictive Models," and 3.3 covers the "Management and oversight of Predictive Models." A scoring model has a holdout set and a performance metric. A system that writes language has neither by default. Our inference: insurers have to build the GenAI equivalent themselves. The use cases on our insurance and payer page show where.

Claims. An assistant that auto-adjudicates clean claims or drafts a denial explanation falls under the Unfair Claims Settlement Practices Act, which "sets forth standards for the investigation and disposition of claims." The test is not only whether the decision is right. It is whether the explanation to the claimant matches the policy language, and whether the assistant invented coverage terms that do not exist.

Prior authorization. The bulletin does not mention prior authorization by name. We map it to "case management" and "claim administration and payment," two of the life-cycle areas the AIS Program should address (1.6). A triage assistant that checks requests against medical policy needs evidence that it escalates unclear cases instead of approving or denying them on a fluent guess, and evidence of who reviewed the result for the member.

Policyholder and member service. A service chatbot answers coverage and billing questions in its own words, every time slightly differently. Its behavior can change when the vendor updates the foundation model, with no change on the insurer's side. The bulletin defines Model Drift as "the decay of a model's performance over time," tied to changes in the data, and lists documentation evaluating it among the items a regulator may request. A vendor update is a different cause with the same symptom, so in our view it belongs in the same monitoring.

When any of these systems runs on a third-party foundation model, 4.0 Third-Party AI Systems and Data asks the AIS Program to cover that vendor too.

Evidence an examiner can read

Guideline 2.2 asks insurers to build documentation "with Section 4 in mind." The table maps the Section 4 requests to evidence a GenAI program can produce, and to the GenGuardX capability that records it. The mapping supports an AIS Program. It does not certify compliance with any state's bulletin.

The goal is a record a market conduct examiner can follow without a guided tour: what the system is, who approved it, how it was tested, and how the insurer knows it still works.

FAQ

Is the NAIC AI Model Bulletin legally binding?

Not by itself. It takes effect in a state when that state's insurance department issues its own version. Even then, the bulletin says its goal "is not to prescribe specific practices or to prescribe specific documentation requirements" (Section 4). The unfair trade practice and unfair claims settlement laws it relies on are binding.

Does the bulletin cover generative AI?

Yes. It defines Generative AI, counts generated content within its definition of an AI System, and says validation, testing and auditing should reflect whether a system is "based on Predictive Models or Generative AI" (Sections 2 and 4).

Which states have adopted the NAIC AI Model Bulletin?

As of October 8, 2026, the NAIC adoption map lists 27 states plus the District of Columbia and Puerto Rico. California, Colorado, New York and Texas appear separately with their own insurance-specific regulation or guidance. Check the map for the current list.

Last reviewed: October 16, 2026. This article summarizes public guidance and is not legal advice.

See how GenGuardX builds AIS Program evidence for insurance and payer AI.