Your examiner will ask for your AI program. Have it written.
The NAIC's AI bulletin tells state insurance departments what to look for when they examine how an insurer uses AI: a written program that senior management owns, controls that match how much each decision affects a customer, tested models, vetted vendors, and records that prove all of it. GOVERNBOX includes the bulletin as a set of cited controls, writes the program against them, and shows you what is still missing.
Three moments the bulletin meets an insurer
“The market-conduct exam letter asks for our AI program.”
The bulletin's first ask is a written AI program that a named senior executive owns. If yours exists only as the way people work, the exam is where that shows. GOVERNBOX writes it down, grounded in the bulletin's controls, for you to review and approve.
“Underwriting bought a vendor model nobody validated.”
The bulletin holds a vendor's AI to the same standard as your own: check it before you buy, put audit and cooperation terms in the contract, and test it before you use it. GOVERNBOX gives you a Vendor AI Risk Assessment and an AI inventory to record each of those, so the answer is on file instead of in someone's inbox.
“A policyholder wants to know why they were declined.”
The bulletin expects an explanation the customer can understand, a way to dispute the decision, and a person who can overrule the model. GOVERNBOX records each adverse decision, the explanation that was sent, and the human review, so you can show all three happened.
Watch an insurer’s AI program, start to finish
A short guided tour of an example insurance company with the NAIC bulletin switched on: its AI tools and their owners, impact assessments tied to the risks they found, the written AI Systems Program with its citations, vendor AI, staff training, and the maturity score on its board report. No email needed.
Eighteen controls across seven domains
The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023, and state insurance departments have been adopting it one at a time since. GOVERNBOX carries it as its own framework: every obligation below is a control your documents cite and your crosswalk measures.
Included from Agency / Enterprise, as part of the U.S. National group of frameworks.
NAIC-GOV-001Written AI Systems Program and Senior Executive OversightStart here. This is the written program examiners ask for first, and GOVERNBOX helps you generate it.NAIC-GOV-002Cross-Functional Operational Roles and Decisional IndependenceNAIC-GOV-003AI Internal Audit, Escalation and Reporting ProtocolsNAIC-GOV-004AI Training and Supervision of Personnel
NAIC-RSK-001Comprehensive Enterprise AI System and Model InventoryNAIC-RSK-002Consumer Harm Risk Tiering and Impact ClassificationNAIC-RSK-003Approval Gate and Automation Limits Before AI Is Built or Bought
NAIC-DAT-001Data Suitability, Quality, Lineage, and Currency VerificationNAIC-DAT-002Proxy Discrimination and Unfair Bias TestingNAIC-SEC-001Protection of Nonpublic Information and the AI Models Themselves
NAIC-VAL-001Pre-Deployment Model Validation and Objective VerificationNAIC-VAL-002Ongoing Performance Drift and Retesting Protocols
NAIC-VND-001Third-Party AI System and External Data Due DiligenceNAIC-VND-002Vendor Contractual Audit Rights and Regulatory Cooperation
NAIC-TRN-001Consumer AI Use Disclosure and Adverse Action ExplanationNAIC-TRN-002Consumer Inquiry, Dispute Resolution, and Human Override
NAIC-DOC-001AIS Program Recordkeeping and Regulatory Examination ReadinessNAIC-DOC-002State AI Certifications and Annual AI Filings Where Required
Four things you can hand an examiner, not a PDF of the bulletin
A written AI Systems Program
GOVERNBOX writes the program the bulletin expects an insurer to be able to show: who is responsible, how risk is managed, how data is checked, how models are tested, how vendors are vetted, and what records are kept. Every section cites the control it answers, and it is organized the way an examiner reads it. You review and approve it before it is final.
A crosswalk of every obligation
On the U.S. National crosswalk, each bulletin control sits beside the part of your approved program that answers it. Anything not yet answered is listed as a gap, with AI help on each one, instead of being quietly left out.
Guidance written for insurers
The plain-language guidance under each control is written for property and casualty, life and health, underwriting, claims administration, and third-party vendors, not for a generic company. Set your industry to Financial Services & Insurance in your Organization Profile and the insurance version is the one you see.
Vendor AI, held to the same standard
Each vendor is a record, with its approval status, the data terms you hold, and every AI system and use case that depends on it. On Pro you can send a vendor an AI due-diligence questionnaire they answer through a private link, and the answers are filed on the vendor. Add the Vendor AI Risk Assessment, and that is the evidence the bulletin's third-party section asks for.
The NAIC bulletin is model guidance. The NAIC adopted it, and each state’s insurance department decides whether to adopt it for its own market, so check your state’s position before treating it as binding. The bulletin is included from Agency / Enterprise as part of the U.S. National group of frameworks; turn it on in your Organization Profile so your documents and crosswalk use it. What GOVERNBOX produces is a defensible starting point that you review and approve. It is not legal advice.
Two decades directing large-scale technology portfolios, enterprise risk management and applied machine learning — which is why the control library is authored and versioned the way it is, rather than assembled from templates.
See where your AI program stands today
The free scorecard asks how you govern the AI you already use and shows the gaps an examiner would find first. Then choose a plan and see the bulletin's controls inside your own workspace.
Take the free scorecard →