NAIC AI Bulletin: Requirements, States, and Compliance

Key takeaways

• The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted December 4, 2023, requires a written AI governance program with named owners, risk tiers, and review dates.
• The bulletin binds insurers only after a state adopts it; Colorado (December 2023), Illinois (November 2024), and California (February 2025) have done so.
• Third-party and shadow AI tools must be inventoried and tiered at the same risk level as in-house systems.
• The bulletin maps closely to the NIST AI RMF and ISO 42001, but is stricter because examiners can demand the program by name in adopting states.
• Build one audit-ready inventory against the strictest adopting state, then document each state's deviations rather than maintaining separate registers.

The NAIC AI bulletin is the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers: it requires insurers to write an AI governance program with a written risk management framework, a named accountable owner, and documented oversight of every AI system, including third-party vendor tools. Below is a state-by-state adoption tracker, a side-by-side comparison of each state's modifications to the model text, and a checklist of what must change in your AI governance evidence to comply.

What is the NAIC AI bulletin?

The NAIC AI bulletin is the Model Bulletin: Use of Artificial Intelligence Systems by Insurers, a template state insurance regulators use to set expectations for how insurers govern AI. It addresses AI used in underwriting, pricing, claims, and other insurance activities, and ties those expectations to existing market conduct and unfair trade practices law. NAIC adopted it in December 2023.

When did NAIC adopt the model bulletin?

The NAIC Executive/Plenary Task Force adopted the model bulletin on December 4, 2023, during the NAIC Fall National Meeting. You can read the adoption date and the full model text on the NAIC's model bulletin page.

Does the bulletin apply to insurers only?

The model text targets insurers regulated by state insurance departments. However, it has become a reference point for other regulated organizations because it expects documented AI governance: an inventory of AI systems, risk management controls, and third-party oversight. If you sit outside insurance, your regulator may borrow its structure even without citing it.

What does the NAIC model AI bulletin actually require?

The model bulletin rests on four substantive pillars: a written AI governance program, risk-based impact assessments, human oversight and controls, and third-party AI vendor management. Everything else in the text is elaboration on those four. If your AI inventory lacks named owners, risk tiers, and review dates, you have none of them in audit-ready form.

Written AI governance program requirement

The bulletin expects a documented, board-visible AI governance program, not a policy PDF nobody has opened since approval. That means your risk register must show every AI use case with a named owner, a risk tier, and a scheduled review date. Auditors will ask who signed off on each tier and when it was last revisited. If those answers live in a spreadsheet only one person maintains, you will fail the question "show me the program."

AI impact assessments and risk tiers

Before deploying an AI system, you run an impact assessment proportionate to its risk tier. High-impact uses, such as underwriting or claims decisions affecting consumers, demand deeper documentation: intended use, data sources, limitations, and the controls that mitigate identified harms. Lower-risk uses get a lighter assessment. The point is defensible proportionality, because an examiner will want to see your tiering criteria applied consistently, not improvised per tool.

Third-party vendor and supplier requirements

Your vendors' AI becomes your AI in the eyes of the bulletin. You must inventory supplier-provided AI features, assess them at the same risk tier you would apply to in-house systems, and hold contractual rights to information about how they work. Shadow AI, meaning employee-adopted tools nobody inventoried, is the failure mode here. Discovery of unsanctioned AI use, then assigning each finding an owner and review date, closes the gap.

Which states have adopted the NAIC model bulletin on AI?

Adoption is not automatic. The bulletin is model text, so it binds your organization only once a state insurance department adopts or issues its own version. Three states moved first and matter most for planning purposes:

• Colorado Division of Insurance Adopted NAIC Memo in December 2023
• Illinois Department of Insurance Adopted NAIC Memo in November 2024
• California Department of Insurance Adopted NAIC Memo in February 2025

Colorado was the first mover, adopting the bulletin in December 2023, and Illinois and California followed with their own versions in late 2024 and early 2025. Track the full list of adopting states and drafts through NAIC's Innovation and Technology Task Force materials, which publish adoption status as it changes.

Two practical implications. First, if you write in any of these states, the bulletin's requirements apply to you now, not when your home state acts. Second, because each state modifies the model text differently, your inventory and control mapping should be built against the strictest version you touch.

How do state versions of the bulletin differ from the model text?

Adopting states rarely pass the model bulletin verbatim. The modifications cluster in four areas, and each one changes what your evidence pack must contain.

Common modifications to watch

Scope changes are the most consequential. Some states limit the bulletin to insurers' use of AI in decisions affecting consumers, which narrows your inventory; others extend it to vendor-supplied models, pulling third-party AI into scope. Added definitions matter too: a state that defines "adverse outcome" or "third party" differently can reclassify a use case you had tiered as low risk. Altered deadlines shift when your named owners and review dates must be current, and vendor obligations vary from a general duty to oversee suppliers to explicit requirements for contractual assurances and impact assessments.

Before filing in a new state, run a compliance crosswalk of that state's text against your existing risk register. The deltas are usually small but audit-relevant.

What unchanged adoption means for multi-state insurers

If a state adopted the model text without modification, treat it as your baseline. Build one audit-ready inventory that satisfies the strictest adopting state, then document where each state's deviations add obligations. That single system of record beats maintaining state-by-state registers in spreadsheets.

What must change in your AI governance program to comply?

Inventory and ownership

Start with a complete inventory of every AI use case, including third-party tools staff adopted without approval. The bulletin expects insurers to identify AI systems and assign accountability, so each entry needs a named owner, a risk tier, and a review date rather than a vague department reference. Shadow AI discovery matters here: an unrecorded underwriting chatbot is still in scope if it influences consumer outcomes. Check your adopting state's specific expectations, such as the Connecticut Insurance Department's circular letter on AI governance or Colorado's regulation for life insurers, before finalizing tiers.

Evidence and audit readiness

A risk register that lives in spreadsheets fails the audit test the bulletin sets. Each use case should carry vendor documentation, impact assessments, and control mappings you can export for board-level visibility on demand. Set recurring review dates so evidence stays current instead of being reconstructed before an examination. GOVERNBOX is built for exactly this workflow, though you will still need your compliance team to supply the judgments the tool records.

How does the bulletin map to NIST AI RMF and ISO 42001?

The bulletin borrows its structure from the NIST AI RMF: inventory AI systems, assess risk, govern with named accountability, and monitor in operation. If your team already runs NIST CSF or ISO 27001, the evidence overlaps heavily. An AI use case inventory with a named owner and review date per system is the same artifact ISO 27001 Annex A expects for any asset, and board-level reporting on AI risk can reuse the risk register format your auditors have already seen.

Where the bulletin is stricter than NIST AI RMF

Two areas. First, the bulletin is a regulatory expectation addressed to a specific regulated entity, so "voluntary framework" framing from NIST does not apply; an examiner can ask for your AI risk program by name. Second, it requires documented third-party AI vendor oversight, which the AI RMF discusses but does not mandate with the same force. Practical move: build a compliance crosswalk with three columns (bulletin requirement, NIST AI RMF function, ISO 42001 clause) and mark each control as "evidence exists," "evidence needs extension," or "gap." Most mid-size teams find the inventory and governance columns are covered; the gap is usually ongoing monitoring evidence for AI specifically. Where GOVERNBOX.ai fits: it maintains that inventory with owners, risk tiers, and review dates as a system of record, though it does not automate technical testing of model outputs.

Can GRC tooling help, and where does it fall short?

Evaluation criteria

Judge any AI GRC tool against what the bulletin actually demands: a complete AI inventory including Shadow AI discovery, a named owner and review date per use case, risk tiering, control mapping to frameworks like the NIST AI Risk Management Framework 1.0, and board-ready exports. A tool that cannot produce evidence of all five is a spreadsheet with a login page.

Where tools fall short, including ours

OneTrust, Holistic AI, Credo AI, and IBM watsonx.governance are enterprise-priced and heavier than a mid-size insurer needs; Drata covers adjacent compliance well but not AI-specific inventories. GOVERNBOX is built for exactly this inventory-plus-ownership problem at flat org pricing. No tool, ours included, removes the manual work of interviewing business units to find Shadow AI; discovery still depends on humans answering honestly.

What happens if you ignore the bulletin?

Adopting states treat the bulletin's requirements through existing supervisory tools: market conduct examinations and unfair trade practice statutes. An examiner who finds AI-driven underwriting or claims decisions with no named owner, no risk tier, and no review date can treat that as a failure of governance generally, not a separate AI violation. The practical consequence is exam scope expanding into your AI inventory, and remediation orders with deadlines.

Reputational exposure compounds this. Regulators share findings, and a documented gap in your risk register invites questions from every other state you write in. An audit-ready inventory is cheaper than explaining its absence twice.

FAQ

Is the NAIC model bulletin binding law, or just guidance?

The model text itself is neither law nor binding guidance; it is a template. It binds you only after a state insurance department adopts or issues its own version, as Colorado, Illinois, and California have done. In an adopting state, examiners enforce its expectations through existing market conduct and unfair trade practices authority rather than a standalone AI statute.

Does the bulletin cover generative AI and AI agents, or only traditional models?

It covers any AI system used in insurance activities, including generative models and agentic tools, not just traditional actuarial scoring. What matters is whether the system influences insurance decisions such as underwriting, pricing, or claims. A generative tool drafting claim correspondence or an agent summarizing underwriting files belongs in your inventory with an owner and risk tier.

What is the deadline for insurers to comply in my state?

There is no single deadline. Each adopting state sets its own effective date, and some modify the model text before issuing it. If you write business in Colorado, Illinois, or California, the requirements already apply there. Check your state insurance department's adopted text for its effective date and any transition periods before relying on the model timeline.

How do I find out which AI tools my company is actually using before an exam?

Start with a structured discovery pass: survey business units about tools they adopted without approval, review procurement and expense records for AI vendors, and ask IT about browser extensions and API usage. Then log every finding in an inventory with a named owner, risk tier, and review date. Discovery depends on people answering honestly, so make reporting unsanctioned use safe.

Do nonprofit health plans and other non-insurers need to follow the NAIC bulletin?

The model text targets insurers regulated by state insurance departments, so a nonprofit health plan regulated separately may fall outside its direct scope. But regulators outside insurance increasingly borrow its structure: documented inventories, named accountability, and third-party oversight. Treat it as a likely reference point for your own regulator, and build governance evidence that satisfies its expectations anyway.