Blog
November 4, 2026
by
Andrej Evtimov
Twenty-six jurisdictions adopted it, four went their own way, and claims owns part of the program.
The NAIC model bulletin on insurer use of AI has been adopted by 26 jurisdictions as of 31 August 2026, and it covers any AI system that makes or supports a claim decision. This is what claims, compliance and legal need on file before a regulator asks.
What the NAIC model bulletin actually is
The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on 4 December 2023. It is not a statute. It is a template that a state insurance department can issue to carriers licensed in that state.
Read the opening line and the scope becomes clear. The bulletin covers decisions affecting consumers that are "made or supported by advanced analytical and computational technologies, including Artificial Intelligence (AI) Systems." Those decisions must comply with existing insurance law (NAIC Model Bulletin).
Two words carry the weight. "Or supported." A tool that never decides anything, and only surfaces information an adjuster then acts on, is still in scope.
That is the point claims leaders most often miss. Your carrier does not need an automated claim decision engine to fall under this bulletin. A summarization tool that a bodily injury adjuster relies on is covered.
The laws it hangs on
The bulletin creates no new legal standard. It points at laws that already exist and says they apply regardless of the method used.
- Unfair Claims Settlement Practices Act (#900). Why it matters to claims: Standards for investigating and disposing of claims. Applies however the decision was reached.
- Unfair Trade Practices Act (#880). Why it matters to claims: Unfair or deceptive acts and practices.
- Corporate Governance Annual Disclosure Act (#305). Why it matters to claims: Governance reporting now covers the AI governance framework.
- Market Conduct Surveillance Model Law (#693). Why it matters to claims: The framework for market conduct actions, including targeted examinations.
The bulletin states it plainly. Actions taken by insurers "must not violate the UTPA or the UCSPA, regardless of the methods the Insurer used to determine or support its actions" (NAIC Model Bulletin, Section 1).
So an AI-assisted claim decision is judged by the same standard as any other claim decision. The difference is the documentation you will be asked to produce about how it was reached.
Which states have adopted it
Check the map before you plan compliance work. The NAIC publishes a jurisdiction-by-jurisdiction implementation list and updates it as states act.
As of the status date of 31 August 2026, 26 jurisdictions had adopted the model bulletin: 25 states plus the District of Columbia (NAIC implementation map).
The 26 adopting jurisdictions
Alaska, Arkansas, Connecticut, Delaware, District of Columbia, Hawaii, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Mississippi, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, Oklahoma, Pennsylvania, Rhode Island, Vermont, Virginia, Washington, West Virginia and Wisconsin.
Adoption dates span more than two years. Alaska moved first, in February 2024. Mississippi is the most recent on the list, in July 2026. Each state issues its own bulletin number, so your compliance file needs the state citation, not the NAIC template.
Four states went their own way
Four states regulate insurer AI through their own instrument rather than the NAIC template (NAIC implementation map):
- California: Bulletin 2022-5, issued 30 June 2022.
- Colorado: 3 CCR 702-10, effective 13 November 2023, amended effective 15 October 2025.
- New York: Insurance Circular Letter No. 7, issued 11 July 2024.
- Texas: Bulletin # B-0036-20, issued 30 September 2020.
Colorado's is a regulation, not a bulletin. Treat these four as separate compliance workstreams. Do not assume the AIS Program you build for a bulletin state satisfies them.
The practical read
Roughly 30 jurisdictions now have something specific on insurer AI. The rest do not, yet.
That does not make the remaining states safe ground. The underlying unfair claims settlement practices standards apply in every state. The bulletin tells you what a regulator will ask for. It does not create the obligation that sits behind the question.
If you write in multiple states, build one program to the bulletin's expectations and apply it everywhere. Maintaining two standards by state costs more than meeting the higher one.
The AIS Program, and what claims owns
The bulletin expects every insurer to maintain a written program for the responsible use of AI systems. It calls this an "AIS Program." The program covers AI systems that "make, or support decisions related to regulated insurance practices" (NAIC Model Bulletin, Section 3).
The program is enterprise-wide. But three parts of it land directly on claims.
Governance and accountability
Responsibility for the program must sit with senior management accountable to the board or a board committee. The bulletin also asks insurers to consider forming committees drawn from the relevant disciplines. It names "business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance, and legal" (NAIC Model Bulletin, Section 2.3).
Claims is named. If your carrier's AI governance committee has no claims representative, that is a gap a regulator can see from the committee charter alone.
The framework should also document decisional hierarchies, the independence of decision-makers, and escalation and reporting protocols. For a claims organization, write down who may override an AI-surfaced finding. Then write down who reviews those overrides.
Risk management and internal controls
Section 3.3 asks for management and oversight of predictive models. That includes model inventories, descriptions, and detailed documentation of development and use. It also asks for assessments covering "interpretability, repeatability, robustness, regular tuning, reproducibility, traceability, model drift, and the auditability of these measurements" (NAIC Model Bulletin, Section 3.3).
Traceability and auditability are listed as assessment criteria. So is model drift. The bulletin defines that as the decay of a model's performance over time, as the deployed data diverges from the training data.
Section 3.6 adds two words that matter for claims: "Data and record retention" (NAIC Model Bulletin, Section 3.6). Whatever your AI produced on a file has a retention question attached. So does whatever the adjuster did with it.
Third-party AI systems
Most claims teams buy rather than build. Section 4.0 covers that case directly.
The bulletin expects due diligence on the vendor and its systems. It also expects contract terms that provide audit rights where appropriate and available. Those terms should "require the third party to cooperate with the Insurer with regard to regulatory inquiries and investigations" (NAIC Model Bulletin, Section 4.2).
Check your existing contracts for the regulatory cooperation clause. It is often missing from agreements signed before 2024.
Classify your claims AI correctly
The NAIC's evaluation tool draws a three-way distinction that claims leaders should adopt internally. The definitions are precise (AI Systems Evaluation Tool 4.0):
- Automation. Definition in the tool: "an AI System that does not involve human intervention". Typical claims example: Straight-through payment of a low-value claim with no adjuster touch.
- Augmentation. Definition in the tool: "an AI System that suggests an answer and/or advises a human who is making a decision". Typical claims example: A model that recommends a reserve range or flags a file for fast-tracking.
- Support. Definition in the tool: "an AI System that provides information but does not suggest a decision or action to a human". Typical claims example: A tool that extracts a treatment timeline from medical records for the adjuster to read.
The distinction is not cosmetic. The bulletin ties the depth of your controls to several risk factors. One is "the extent to which humans are involved in the final decision-making process." Another is "the transparency and explainability of outcomes to the impacted consumer" (NAIC Model Bulletin, Section 3).
A support tool with a human deciding every outcome sits at a different risk level than an automation tool. You still document it. You document proportionately.
Get the classification right in writing, early. The tool asks insurers to identify which of their AI systems are high risk. Regulators may then ask how the company assessed risk and materiality.
The tool also lists claims use cases explicitly. They are "Claim assignment, triage/fast-tracking, individual/bulk claim reserving including loss estimation, imaging/video analysis, fraud detection, litigation, estimation of closure rates, salvage/subrogation, examination/report ordering" (AI Systems Evaluation Tool 4.0). Inventory against that list. It is the list a regulator is working from.
What a regulator can ask for
Section 4 is the part to read with your general counsel. It sets out what a department may request during an investigation or market conduct action.
Program-level documents
- The written AIS Program itself, plus documentation evidencing its adoption.
- The program's scope, including "any AI Systems and technologies not included in or addressed by the AIS Program" (NAIC Model Bulletin, Section 4.1).
- How the program is tailored and proportionate to the insurer's use of AI and the degree of potential harm to consumers.
- Policies, procedures, guidance and training materials.
Note the second item. You will be asked what you deliberately left out of scope, and why. An undocumented exclusion is worse than a documented one.
Documents for one specific system
When a particular model or system is under examination, the requests get concrete (NAIC Model Bulletin, Section 4.1.3):
- Documentation of compliance with your own AI program policies in the development, use and oversight of that system.
- Information about the data used, including "the data source, provenance, data lineage, quality, integrity, bias analysis and minimization, suitability, and Data Currency."
- The techniques, measurements and thresholds used as controls.
- Documentation of validation, testing and auditing, including evaluation of model drift.
Provenance and lineage are the load-bearing words for a claims tool. A regulator asking about one file wants to know which documents produced which output. That is a record-keeping question before it is a technology question, and it is the same evidence trail that supports any bodily injury claim file review.
Third-party documents
If the system came from a vendor, add due diligence records, the contract itself, audit or confirmation processes, and vendor-side validation and testing documentation.
One important limit
The bulletin says its goal "is not to prescribe specific practices or to prescribe specific documentation requirements." Insurers may instead demonstrate compliance "through alternative means, including through practices that differ from those described in this bulletin" (NAIC Model Bulletin, Section 4).
So Section 4 is not a mandatory filing checklist. It is the best available preview of the questions. Build your records so you can answer them, in whatever form suits your organization.
The 2026 evaluation tool pilot
The bulletin is not the end of the story. The NAIC's Big Data and Artificial Intelligence (H) Working Group is charged with developing tools and guidance for regulators reviewing AI systems used by licensees (NAIC Big Data and AI (H) Working Group).
That work produced the AI Systems Evaluation Tool. It is a set of optional supplemental exhibits for state regulators, designed "to supplement existing market conduct, financial analysis, and financial examination review procedures for reviewing AI Systems" (AI Systems Evaluation Tool 4.0).
It has four exhibits. Exhibit A quantifies how much AI the company uses. Exhibit B captures the governance and risk assessment framework, as a narrative or a checklist. Exhibit C covers high-risk AI systems. Exhibit D covers model data details.
A 12-state pilot began on 2 March 2026 and runs through September 2026 (Fenwick, 9 March 2026). The participating states are California, Colorado, Connecticut, Florida, Iowa, Louisiana, Maryland, Pennsylvania, Rhode Island, Vermont, Virginia and Wisconsin. The tool is expected to be updated on pilot feedback and re-exposed, with adoption expected at the NAIC fall meeting in November 2026.
One line in the tool is worth acting on now. If information has already gone to that department or another state department, the company may say so. Regulators may then accept the prior submission where it is still current (AI Systems Evaluation Tool 4.0). That rewards keeping one clean, current answer set rather than assembling a new one per state.
A claims documentation checklist
Translate the above into records your team can actually produce. For each AI system touching claims, hold:
- An inventory entry. What it is, which claims use case it serves, and its classification as automation, augmentation or support.
- A risk rating. Your assessment, the factors behind it, and whether you called it high risk.
- A scope note. Whether it falls inside the AIS Program, and the reasoning if it does not.
- The human review rule. Who reviews the output, at what point, and what authority they have to depart from it.
- An override record. Departures from AI-surfaced findings, with reason codes, reviewed on a set cadence.
- Per-file traceability. For any given claim, which source documents produced which output.
- Validation and drift evidence. Testing performed, by whom, how often, and what it showed.
- Vendor file. Due diligence, contract terms on audit rights and regulatory cooperation, and vendor validation reports.
- Training records. Who was trained on the tool and its limits, and when.
- Retention rules. How long each of the above is kept, consistent with Section 3.6.
Items 4, 5 and 6 are the ones claims organizations most often lack. They are also the ones that answer a market conduct question about a single file. The same three gaps show up in workers' compensation claims handling, where compensability decisions turn on records an examiner may later ask you to reconstruct.
Where source-linked outputs fit
Items 6 and 7 are where tooling choices matter most. A regulator asking about one claim wants a record of how an output was reached. If that record has to be reconstructed after the fact, it is expensive and it is weak.
If the record is a byproduct of how the system works, it already exists when the question arrives. That argues for tools that link every output back to the page it came from, rather than tools that return an answer with no visible basis.
The agenticAI platform for claims processing professionals from amaise is built this way. Its published description states that it uses click-to-evidence sourcing. It also states that all information is directly traceable to the source documents, so users can verify each output against the page it came from.
That matters for the review rule in item 4. A tool that surfaces information and leaves the call to the adjuster sits in the support or augmentation category. The human stays in the final decision. That is a defensible position under the bulletin's risk factors, and it is the honest description of how such a tool is used on a bodily injury file.
None of this replaces a written AIS Program. It does not replace a governance committee with claims at the table. It does not replace a vendor contract with the right clauses. Those remain your obligations.
But the hardest documentation requirement to retrofit is the one that has to be captured while the work happens. Choose for that, and the rest is paperwork you control.
Key takeaways
- As of 31 August 2026, 26 jurisdictions have adopted the NAIC model bulletin: 25 states plus the District of Columbia. California, Colorado, New York and Texas regulate insurer AI through their own instruments instead.
- Scope turns on two words. The bulletin covers decisions "made or supported by" AI, so a tool that only surfaces information to an adjuster is still in scope.
- The bulletin creates no new legal standard. It applies the existing unfair claims settlement practices and unfair trade practices standards, whatever method produced the decision.
- Classify each claims AI system as automation, augmentation or support. The depth of controls you owe is proportionate to human involvement and explainability.
- The three records claims teams most often lack are the human review rule, the override log, and per-file traceability from source document to output.
