How Do Insurers Stay Compliant With the NAIC AI Model Bulletin in 2026?
The NAIC AI Model Bulletin stopped being abstract guidance in 2026. A multistate pilot is now testing how examiners evaluate an insurer’s AI governance program, and formal adoption of the evaluation tool is expected at the NAIC fall meeting in November 2026 [VERIFY dates]. That shift is why documented AI governance is no longer a someday project. This guide covers what the bulletin requires, which states have adopted it, how the 2026 pilot works, and a practical compliance checklist you can act on.
What does the NAIC AI model bulletin require?
| The NAIC AI Model Bulletin, adopted in December 2023, is regulatory guidance directing insurers to manage AI systems across underwriting, rating, claims, fraud, and marketing through a documented governance program built around transparency, fairness, accountability, and risk management. It is principles-based rather than a detailed rulebook, but states that adopt it can and do enforce it through market conduct examination authority. |
Those five business functions matter because an examiner will ask about each by name. So will the four principles: your governance program needs to be organized around transparency, fairness, accountability, and risk management, not merely reference them. Is the bulletin mandatory? Strictly, it is guidance, not statute. In practice, in a state that has adopted it, a carrier’s AI governance program becomes examinable through existing market conduct authority, which makes it an active obligation rather than a suggestion.
Which states have adopted the NAIC AI model bulletin?
As of early 2026, roughly two dozen states plus the District of Columbia had adopted the bulletin or substantially similar guidance, and the count keeps climbing as more insurance departments act [VERIFY count and list against a live NAIC source on publish date]. Adoption is not uniform: some states track the bulletin closely, while others have layered on more prescriptive rules of their own.
Colorado is the clearest example of a state that has gone beyond the bulletin’s principles-based baseline. The practical point for carriers: in an adopting state, your AI governance program is examinable, not aspirational, and adoption status maps directly to enforcement risk.
The NAIC AI systems evaluation tool: What the 2026 pilot tests
The NAIC AI Systems Evaluation Tool is a structured framework giving state examiners a standardized way to review an insurer’s AI governance program during a market conduct examination. A multistate pilot, expanded to 12 participating states, runs through September 2026 [VERIFY state count and dates], after which the tool is expected to be revised on pilot feedback and taken to formal adoption at the NAIC fall meeting in November 2026.
What the tool evaluates is worth being precise about. It reviews the insurer’s governance process around the AI system, documentation, oversight, testing, and vendor accountability, not the technical performance of the model itself. The timeline runs roughly as a sequence: pilot through September 2026, revision in the following weeks, public re-exposure, then expected formal adoption in November. The immediate implication is that a carrier operating in a pilot state right now may already be measured against this tool in practice, before formal adoption makes it universal.
How insurers actually comply: A practical checklist
| Compliance comes down to five documented components. An examiner using the evaluation tool will ask to see evidence of each, not a policy statement. |
Two of these trip carriers up most often. On vendor oversight, examiners look through the vendor relationship. You cannot delegate compliance responsibility by outsourcing the AI system; the carrier stays accountable. On bias testing, unfair discrimination is the specific outcome being checked, which means the testing has to cover protected classes and proxy variables, not simply confirm that testing happened. The pilot is built to evaluate documentation quality, not model performance.
- An AI governance program with a named executive owner. Accountability has to sit with a person, not a committee in the abstract.
- A current inventory of AI systems across underwriting, rating, claims, fraud, and marketing.
- Model documentation covering how each system was tested and validated.
- Third-party AI vendor oversight with audit rights written into contracts.
- Bias and fairness testing with retained records.
Where enforcement actually happens
| The NAIC’s Big Data and Artificial Intelligence Working Group built the evaluation tool for use inside a market conduct examination, the mechanism states already rely on to review insurer practices. Enforcement therefore needs no new legislation. It runs through an examination process that already exists, now pointed specifically at AI governance. |
In practice, an AI-related exam looks like a documentation request, the governance evidence from the checklist above, rather than a technical audit of model code. A carrier already under examination in a pilot state should expect AI-specific questions now, ahead of formal adoption.
State vs. Federal: how the landscape is shifting
Insurance AI regulation in the US runs almost entirely through the states, not federal agencies, because insurance itself is regulated at the state level under the McCarran-Ferguson Act. The NAIC bulletin is model guidance individual states choose to adopt, which is why adoption is uneven and why a carrier’s compliance posture can differ from one state to the next.
Colorado again illustrates that adopting the bulletin and meeting the strictest state standard are not the same thing. There is also an active federal preemption debate as of 2026, unresolved, and worth watching without reading an outcome into it yet.
The Takeaway
The bulletin is now being actively tested through the 2026 pilot, and in an adopting state, documented AI governance is a live compliance obligation. Check your own program against the five-point checklist above and close the gaps before an examiner finds them.
Frequently asked questions
It is regulatory guidance, adopted in December 2023, directing insurers to manage AI systems across underwriting, rating, claims, fraud, and marketing through a documented governance program covering transparency, fairness, accountability, and risk management.
Compliance means documenting five things: a governance program with named ownership, a current AI system inventory, model documentation on testing and validation, third-party vendor oversight with audit rights, and bias and fairness testing with retained records.
Roughly two dozen states plus the District of Columbia had adopted the bulletin or substantially similar guidance as of early 2026, with the number still growing. Adoption varies, and Colorado has layered on more prescriptive rules of its own.
It is a structured framework giving examiners a standardized way to review an insurer’s AI governance program during a market conduct exam. A 12-state pilot runs through September 2026 ahead of expected formal adoption in November 2026.
The pilot runs through September 2026. The tool will then be revised on pilot feedback, re-exposed for public review, and is expected to go to formal adoption at the NAIC fall meeting in November 2026.
