NAIC AI Insurer Guidelines

Overview

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted by the National Association of Insurance Commissioners (NAIC) in December 2023, serves as a crucial guiding document for state insurance regulators and the insurance industry across the United States. This bulletin was developed by the NAIC’s Innovation, Cybersecurity, and Technology (H) Committee to establish clear expectations for insurers regarding the responsible deployment and use of artificial intelligence (AI) systems. It acknowledges the transformative potential of AI in various stages of the insurance lifecycle, including product development, marketing, sales, underwriting, pricing, policy servicing, claims management, and fraud detection, recognizing its capacity to enhance efficiency, accuracy, and customer experience. However, the bulletin simultaneously highlights the unique risks associated with AI, such as potential for inaccuracy, unfair discrimination, data vulnerability, and lack of transparency and explainability, emphasizing the imperative for insurers to actively mitigate these risks.

While not a binding law or regulation itself, the Model Bulletin is a principles-based document designed to foster uniformity among state insurance regulators in their oversight of AI use by insurance carriers. It reminds insurers that all decisions and actions made or supported by AI systems must adhere to existing applicable insurance laws and regulations, particularly those addressing unfair trade practices and unfair discrimination. The bulletin sets forth expectations for how insurers should govern the development, acquisition, and use of AI technologies, and outlines the type of information and documentation that state insurance departments may request during investigations or examinations. As of early 2025, over two dozen states have adopted this Model Bulletin, signifying its growing influence and establishing its standards as best practices for insurers nationwide.

Definitions

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers introduces and implicitly relies on several key definitions to establish its scope and requirements for the insurance industry. Central to the bulletin is the concept of “Artificial Intelligence (AI) Systems.” While the bulletin itself refers to AI Systems as advanced analytical and computational technologies that make or support decisions impacting consumers, broader interpretations and related NAIC documents clarify that an AI System is a machine-based system capable of generating outputs such as predictions, recommendations, content, or other outputs that influence decisions in real or virtual environments. This definition encompasses a wide array of AI and machine learning techniques deployed across the insurance value chain.

Another fundamental term is the “AIS Program,” which stands for an Artificial Intelligence Systems Program. The bulletin mandates that all insurers authorized to conduct business in a state are expected to develop, implement, and maintain a written AIS Program for the responsible use of AI Systems. This program is specifically designed to mitigate the risk of “Adverse Consumer Outcomes,” which refers to any negative impacts on consumers resulting from the use of AI, particularly those that violate statutory provisions concerning unfair trade practices and unfair discrimination. The bulletin also implicitly refers to concepts like “Model Drift,” which is the degradation of a model's performance over time due often to changes in the underlying data or relationships, highlighting the need for continuous monitoring and validation of AI systems. These definitions collectively form the conceptual bedrock upon which the bulletin's guidelines and expectations for ethical and compliant AI deployment in insurance are built.

Governance and Institutional Framework

The NAIC Model Bulletin places significant emphasis on robust governance and institutional frameworks for insurers utilizing AI Systems. It explicitly states that all authorized insurers are expected to develop, implement, and maintain a written Artificial Intelligence Systems Program (AIS Program). This program is intended to ensure the responsible use of AI Systems that make or support decisions related to regulated insurance practices. A core element of this framework is the establishment of clear accountability structures, involving appropriate disciplines from various departments such as business units, actuarial, data science, underwriting, claims, legal, and compliance. Senior management or the board of directors is expected to have ultimate accountability and oversight for the AIS Program, ensuring that AI-related activities align with the insurer's overall risk management strategy and ethical guidelines.

The governance framework outlined by the bulletin is principles-based, encouraging insurers to adopt practices that are specifically designed to prevent AI systems from leading to unfair trade practices, unfair claims settlement practices, or other adverse consumer outcomes. This includes establishing policies, procedures, processes, risk management protocols, and internal controls. Insurers are expected to document their AI risk management plan, including an inventory and description of AI systems, policies and procedures for development and use, employee training on permissible AI use, processes for identifying risks, and internal controls to mitigate those risks. Furthermore, the bulletin advises insurers to be prepared to provide comprehensive documentation regarding their governance framework, risk management, and internal controls during regulatory investigations or examinations, underscoring the importance of transparent and auditable AI governance.

Key Focus Areas

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers delineates several key focus areas to guide insurers in their responsible deployment of AI. A paramount concern is the prevention of unfair discrimination and bias. The bulletin explicitly reminds insurers that AI-driven decisions must comply with all applicable insurance laws and regulations, particularly those addressing unfair trade practices and unfair discrimination. It encourages the development and use of verification and testing methods to identify errors, bias in predictive models, and the potential for unfair discrimination in outcomes. This focus extends to ensuring fairness and ethical use of AI, aligning with the NAIC Principles of Artificial Intelligence adopted in 2020.

Another critical area is transparency and explainability. Insurers are encouraged to provide consumers with appropriate information regarding how AI systems may affect decisions impacting them, with the level of detail varying depending on the phase of the insurance lifecycle. This commitment to transparency is integral to building consumer trust and enabling informed consent. Robust risk management and internal controls are also central, with insurers expected to develop a written AIS Program designed to mitigate risks such as inaccuracy, data vulnerability, and adverse consumer outcomes. This includes rigorous validation, testing, and auditing processes, as well as managing third-party vendors who provide AI systems or data. The bulletin emphasizes that insurers remain responsible for vendor compliance, and this obligation does not transfer. Finally, data quality and security are implicit but vital components, as the effectiveness and fairness of AI systems heavily rely on the integrity and security of the data used for their development and operation.

Implementation Framework

The implementation framework articulated by the NAIC Model Bulletin is designed to be principles-based, offering insurers flexibility while ensuring adherence to core regulatory expectations. Rather than prescribing specific practices or granular documentation requirements, the bulletin sets forth overarching principles and expectations for the responsible use of AI systems. The cornerstone of this framework is the mandatory development, implementation, and maintenance of a written Artificial Intelligence Systems Program (AIS Program) by all authorized insurers. This program serves as the insurer's comprehensive strategy for governing the development, acquisition, and use of AI technologies, particularly those that make or support decisions related to regulated insurance practices.

The AIS Program is expected to be tailored to the specific nature and degree of risk posed by the AI systems to consumers, ensuring it is adequate to prevent violations of relevant insurance laws, including those pertaining to unfair trade practices and unfair discrimination. Key components of this implementation framework include establishing robust governance structures with clear oversight and accountability, implementing strong risk management practices and internal controls, and ensuring effective third-party vendor management. Insurers are encouraged to document all aspects of their AIS Program, including policies, procedures, risk assessments, testing methodologies, and audit processes. This documentation is crucial not only for internal compliance but also for demonstrating adherence to regulatory expectations during examinations or investigations by state insurance departments. The bulletin acknowledges that insurers may demonstrate compliance through various means, including practices that differ from those explicitly described, as long as they achieve the intended regulatory outcomes.

Monitoring and Evaluation

Monitoring and evaluation are critical components of the NAIC Model Bulletin's framework, designed to ensure the ongoing responsible use of AI systems by insurers and to enable effective regulatory oversight. The bulletin advises insurers that state insurance departments may request specific information and documentation during an investigation or examination regarding their use of AI technologies and AI Systems. This includes inquiries into the insurer's governance framework, risk management protocols, internal controls, and the outcomes of AI system use, particularly any Adverse Consumer Outcomes. Regulators are empowered to scrutinize the development, deployment, and ongoing operation of AI systems or specific predictive models and applications.

Insurers are expected to implement and maintain robust monitoring and audit activities as part of their AIS Program. This includes verification and testing methods to identify errors, bias in predictive models and AI systems, and the potential for unfair discrimination in decisions and outcomes. The NAIC has also been actively developing an AI Systems Evaluation Tool, which is currently being piloted by several states, to provide regulators with a structured framework for reviewing insurer AI systems during market conduct examinations. This tool aims to gather information on the extent and use of AI, governance and risk mitigation practices, high-risk AI models, and data inputs. The continuous monitoring of AI systems for issues like “Model Drift,” where a model's performance degrades over time, is also implicitly encouraged to maintain accuracy and fairness. This proactive and reactive monitoring ensures that AI remains compliant and beneficial for consumers.

Penalties, Liability, and Appeals

The NAIC Model Bulletin itself does not directly impose new penalties or establish a specific liability framework for insurers' use of AI systems. Instead, it serves as a guiding document that clarifies how existing insurance laws and regulations apply to AI-driven decisions and actions. The bulletin explicitly reminds insurers that decisions or actions impacting consumers that are made or supported by AI systems must comply with all applicable insurance laws and regulations, particularly those addressing unfair trade practices and unfair discrimination. Therefore, any non-compliance with the expectations set forth in the bulletin, which leads to violations of these underlying state insurance laws, could result in existing statutory penalties, enforcement actions, or liability under those established legal frameworks.

State insurance regulators, during investigations or market conduct examinations, are authorized to inquire about and request documentation regarding an insurer's development, deployment, and use of AI systems, as well as any specific predictive model, AI system, or application and its outcomes. This regulatory oversight means that insurers failing to demonstrate a robust AIS Program, adequate risk management, or compliance with fairness and non-discrimination principles could face regulatory scrutiny and potential enforcement actions based on existing statutes. While the bulletin does not detail specific appeal processes related to AI-driven decisions, any consumer adversely affected by an AI-supported decision would typically have recourse through existing consumer protection mechanisms and appeal processes established under state insurance laws for challenging insurer decisions. The emphasis is on preventing adverse consumer outcomes through proactive governance and compliance with established legal standards.

Relationship to Other Instruments

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers does not exist in a vacuum but is intricately related to a broader ecosystem of AI policy frameworks and existing insurance regulations. Fundamentally, the bulletin reinforces that insurers' use of AI systems must comply with all existing applicable federal and state insurance laws and regulations, particularly those concerning unfair trade practices and unfair discrimination. It serves to clarify how these established legal standards apply in the context of advanced analytical and computational technologies, rather than creating entirely new legal obligations.

Furthermore, the bulletin explicitly recognizes and aligns with the NAIC Principles of Artificial Intelligence, which were adopted in 2020. These principles emphasize fairness, ethical use, accountability, compliance, transparency, and a safe, secure, fair, and robust system, providing the foundational guidance for the expectations set forth in the bulletin. Beyond national frameworks, the Model Bulletin has also been significantly influenced by international AI policy frameworks and laws, including the OECD AI Principles, G20 AI Guidelines, the US Executive Order on AI, and the EU AI Act. These international instruments share common principles such as transparency, accountability, fairness, safety, risk management, privacy, data protection, and a human-centric approach, which are increasingly becoming standard in AI regulation globally. At the state level, the bulletin acts as a model for individual state insurance departments to adopt, and many states have either adopted it directly or enacted their own regulations addressing similar topics, such as Colorado's regulation on life insurers' use of external consumer data and predictive models. This demonstrates the bulletin's role in fostering a consistent, yet adaptable, regulatory landscape for AI in insurance.

International Alignment

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers demonstrates a strong degree of international alignment, drawing inspiration from and reflecting common principles found in global AI policy frameworks. While primarily focused on the U.S. insurance market, the bulletin's underlying tenets are heavily influenced by various international AI guidelines and laws. Specifically, it is noted to be influenced by instruments such as the OECD AI Principles, the G20 AI Guidelines, the US Executive Order on AI, and the emerging EU AI Act. This influence underscores a global consensus on key ethical and regulatory considerations for artificial intelligence.

These international frameworks, much like the NAIC Model Bulletin, consistently emphasize principles that are becoming foundational for responsible AI development and deployment worldwide. These shared principles include, but are not limited to, transparency, accountability, fairness and non-discrimination, safety and risk management, privacy and data protection, and a human-centric approach. By incorporating these widely recognized standards, the NAIC Model Bulletin contributes to a harmonized approach to AI regulation in the insurance sector, facilitating cross-border understanding and potentially easing future international cooperation. This alignment helps ensure that U.S. insurers operating with AI are not only meeting domestic expectations but are also operating within a broader global ethical and regulatory landscape for AI.

Implementation Timeline

Sources and References