NAIC AI model bulletin: what it means if you sell AI to insurers

What is the NAIC AI model bulletin?

The NAIC AI model bulletin, titled "Use of Artificial Intelligence Systems by Insurers", is a template the NAIC adopted on December 4, 2023. It is a bulletin, not a law, and it applies only where a state insurance department issues it: 25 states plus the District of Columbia as of August 31, 2026. It sets expectations for insurers, not vendors, but insurers carry them into how they vet and contract with vendors.

AI-supported decisions must comply with existing insurance law, including unfair discrimination rules. Each insurer in an adopting state is expected to "develop, implement, and maintain a written program" for AI systems that make or support decisions in regulated insurance practices. One definition matters to you: a "Third Party" is "an organization other than the Insurer that provides services, data, or other resources related to AI."

This page is context for AI vendors, not legal or compliance advice. Check each state's own bulletin text and your counsel. For the wider buying process, see how to sell software to insurance carriers and Clean for insurance.

Which states have adopted the NAIC AI bulletin?

NAIC's implementation map (status as of August 31, 2026, opened October 6, 2026) lists 26 adopting jurisdictions: 25 states and the District of Columbia. The most recent is Mississippi (July 22, 2026), after Hawaii (December 10, 2025).

Four more states are listed separately under "Insurance Specific Regulation/Guidance" and are not counted as adopters. Among them are California (a 2022 bulletin), New York (Circular Letter No. 7, 2024) and Texas (a 2020 bulletin). The map also says it does not determine whether a state's text "contains all elements of the model", so questions can differ by state. Re-check it after the NAIC Fall National Meeting, November 14 to 17, 2026.

Does the NAIC AI bulletin apply to AI vendors?

Not directly. The bulletin sets expectations for insurers and puts no duty on any vendor. It reaches you through your customer. Guideline 1.8 says the insurer's program should cover AI systems used in regulated insurance practices "whether developed by the Insurer or a third-party vendor", and guideline 3.1 covers "the oversight and approval process for the development, adoption, or acquisition of AI Systems". The acquisition part is your sales process.

Guideline 4.0 covers third-party AI systems and data. The insurer's program should address how it acquires and relies on them, and may include, as appropriate: due diligence on you and your data or AI systems (4.1); "Where appropriate and available," contract terms that give audit rights or audit reports and require you to cooperate with regulatory inquiries (4.2); and actually using those rights (4.3).

Selling to insurance agencies? The bulletin is addressed to insurers, not agencies. Selling to MGAs? Questions may reach you through the insurer behind the MGA.

What can a regulator ask an insurer about your product?

Section 4 of the bulletin lists what an insurance department may request in an investigation or market conduct action. Where third parties built the data, models or AI systems, the insurer "should also expect" requests for its due diligence on them; its contracts with AI, model or data vendors, including terms on representations, warranties, security, privacy, data sourcing, IP, confidentiality and cooperation with regulators; audits of the vendor's compliance; and validation, testing and model drift records.

For a specific model, the regulator can also ask for "the data source, provenance, data lineage, quality, integrity, bias analysis and minimization, suitability, and Data Currency." If that model is yours, the insurer can only answer with what you give it.

The bulletin says its goal "is not to prescribe specific practices or to prescribe specific documentation requirements", so carriers will differ. The list still shows what a careful one will want on file.

New York's Circular Letter No. 7: underwriting and pricing only

New York's Department of Financial Services issued Insurance Circular Letter No. 7 on July 11, 2024, for AI systems and external consumer data used in underwriting and pricing. It is "not intended to address phases of the insurance product lifecycle other than underwriting and pricing." A claims tool is outside it; a rating model or an underwriting data product is inside.

For those tools it goes further than the model bulletin. "Insurers retain responsibility for understanding any tools, EDCIS, or AIS used in underwriting and pricing" that vendors developed or deployed. An insurer "may not rely solely on a third-party's claim of non-discrimination or a proprietary third-party process" to show it meets anti-discrimination law, and cannot cite a vendor's proprietary algorithm to give an applicant less detail about an adverse decision.

Insurers are expected to test for unfair or unlawful discrimination before an AI system goes into production, on a regular cadence, and after material changes, and to check whether external data stands in for a protected class. For you: expect to explain which data drove a decision, to tell the carrier before material changes ship, and to have your outputs tested.

What carriers will likely ask an AI vendor

None of this is a legal duty on you; the table is typical, not required, and each carrier will ask more or less.

Where your product sits matters. In NAIC surveys of insurers by line (reports issued December 2022 to May 2025), "Roughly half of the models used for marketing were developed by third-party vendors, but for pricing & underwriting, auto and home Insurers mostly developed their models in-house." In a single AM Best survey of more than 150 rated insurers and MGAs (published April 27, 2026), respondents were "less concerned with change resistance and third-party model risk" than with data readiness and security. Your champion may not raise vendor model risk; compliance and legal reviewers working to the bulletin likely will.

Example (invented): a 25-person startup sells a claims photo triage model to a regional carrier in an adopting state. Expect most of the table below. New York's letter would not reach it, because it is a claims tool.

What is the NAIC still working on?

Vendor framework (draft). The NAIC's Third-Party Data and Models (H) Working Group exposed a draft framework for third-party data and model vendors on July 8, 2026, took comments until August 5 and discussed it on August 12. Its first phase covers P&C pricing and underwriting only. Alston & Bird's September 21, 2026 summary describes three parts: a shared multistate list of vendors hosted by the NAIC; requirements for submitting third-party data and models used in pricing and underwriting to regulators; and annual attestations with notice of material changes. Commenters questioned whether the vendor list is truly voluntary. A smaller drafting group is revising the framework "with the goal of potentially presenting the framework for consideration at the Fall National Meeting." It is not adopted.

AI evaluation tool (pilot). The NAIC's AI page (last updated April 3, 2026) says its AI Systems Evaluation Tool, a regulators' guide to an insurer's AI use, "is being piloted by 12 participating states" as of March 2026, and "it is anticipated the Tool will be adopted at the 2026 Fall National Meeting."

The meeting runs November 14 to 17, 2026, in Dallas; both working groups are on its September 22 tentative agenda.

The federal order. A December 11, 2025 executive order, "Ensuring a National Policy Framework for Artificial Intelligence", directs the Attorney General to set up an AI Litigation Task Force "whose sole responsibility shall be to challenge State AI laws inconsistent with the policy set forth" in it. No source we opened on October 6, 2026 settles what it means for state insurance AI bulletins. Ask counsel.

How Clean finds insurers with a real reason to buy

A state adopting the bulletin is a market-level change. It does not tell you which carrier is reviewing AI vendors, who owns that review, or whether you fit. That takes a company-level trigger event.

Clean finds agencies, brokerages, MGAs and carriers with a real reason to buy what you sell, from dated real-world moments, shows the evidence behind each one, names the people to reach, and shows who in your network can introduce you. What Clean cannot confirm stays marked unknown.

Clean is not a list vendor, a contact database, intent data or an AI SDR. It does not send messages for you; your team decides who to contact and what to say. See how Clean works, or book a demo to see carriers, MGAs or agencies in your market with a real reason to buy, the evidence, and who to reach.