AI regulation in insurance: the NAIC bulletin and state rules

There is no federal statute that governs how U.S. insurers use artificial intelligence. Regulation comes from the states, mostly through the NAIC's December 2023 Model Bulletin (adopted in most states), a few insurance-specific rules such as Colorado's SB21-169 regulation, and, for multinational buyers, the EU AI Act. The rules are aimed at insurers' decisions about people, so they bear most heavily on personal lines, life and health, but the NAIC bulletin is written broadly enough to reach commercial underwriting and claims too.

How regulators approach AI: existing law, new expectations

State insurance departments did not wait for AI-specific statutes. Their starting position is that a decision is judged by the law that governs it, whatever tool produced it. A rate that is unfairly discriminatory is unlawful whether an actuary or a gradient-boosted model set it. A claim denied without a reasonable investigation is an unfair claims practice whether an adjuster or an algorithm denied it. The new instruments tell insurers how regulators expect them to prove that their AI is under control. For background on the system, see How business insurance is regulated in the U.S. and The NAIC: what it does and why it matters.

The NAIC Model Bulletin on AI (December 2023)

The NAIC's Executive Committee and Plenary adopted the Model Bulletin: Use of Artificial Intelligence Systems by Insurers on December 4, 2023. A model bulletin is a template. It has no force until a state insurance department issues its own version, usually with minor changes.

What it says, in the text the NAIC published:

• It applies to the whole insurance life cycle. The bulletin lists product development, marketing, underwriting, rating and pricing, claim administration and payment, and fraud detection.
• It rests on existing laws. It cites the Unfair Trade Practices Act (Model #880), the Unfair Claims Settlement Practices Act (Model #900), the Property and Casualty Model Rating Law (Model #1780, rates must not be excessive, inadequate or unfairly discriminatory), the corporate governance disclosure laws, and the Market Conduct Surveillance Model Law (#693).
• It expects a written "AIS Program." Insurers are expected to maintain a written program for the responsible use of AI systems that make or support decisions on regulated insurance practices. The program should cover governance, risk management and internal audit, with accountability to senior management and the board, scaled to the degree of potential harm to consumers.
• It expects model-level controls. Inventories of predictive models, documentation of development, validation and testing, monitoring for model drift, data quality and bias analysis, and protection of non-public information.
• It covers vendors. The program must address AI systems and data bought from third parties, including due diligence and, where available, contract terms for audit rights and cooperation with regulators.
• It previews what examiners will ask. Section 4 lists the documents a department may request in an investigation or market conduct exam, including the written program, model inventories, validation records and third-party contracts.

The bulletin does not create a private right of action and does not ban any technique. It also says insurers may show compliance through other practices.

How many states have adopted it

According to the NAIC's implementation map, status as of October 8, 2026, 29 jurisdictions had adopted the bulletin: 27 states plus the District of Columbia and Puerto Rico. Four more states have their own insurance-specific AI rules or guidance instead: California (Bulletin 2022-5), Colorado (3 CCR 702-10), New York (Circular Letter No. 7, 2024) and Texas (Bulletin B-0036-20). The map changes often, so check the NAIC's adoption map or your state's insurance department. Use the workers' comp and benefits requirements by state and the state guides, such as New York, California and Texas, for state context.

The NAIC is also building a supervisory tool. Its Big Data and Artificial Intelligence Working Group developed an AI Systems Evaluation Tool, piloted by 12 states as of March 2026, with adoption expected at the NAIC's 2026 Fall National Meeting. A separate Third-Party Data and Models Working Group is developing a framework for how regulators evaluate vendor models. Both are on the NAIC's artificial intelligence page.

Colorado: SB21-169 and Regulation 10-1-1

Colorado's SB21-169 is the first U.S. statute aimed squarely at insurers' use of external consumer data and information sources (ECDIS), algorithms and predictive models. The statute (now at C.R.S. 10-3-1104.9) prohibits their use where the result is unfair discrimination against a protected class and directs the Division of Insurance to write rules line by line.

The rules are in Regulation 10-1-1 (3 CCR 702-10):

• Life insurance: governance and risk-management requirements took effect November 14, 2023.
• Private passenger auto and health benefit plans: an amendment effective October 15, 2025 extended the framework to these insurers, with an interim progress report due December 1, 2025 and compliance and a first annual report required by July 1, 2026, according to law-firm summaries of the amendment (Faegre Drinker, September 2025).
• What it requires: board and senior-management oversight, a cross-functional governance group, a written risk-management framework, an inventory of ECDIS and models, testing and monitoring for unfair discrimination (the final rule is limited to race) and model drift, a consumer complaint process, and vendor oversight, with annual reporting to the Division.

Colorado has not applied this framework to commercial lines. A Colorado business buyer is therefore not directly affected, but the structure of the rule, inventory, testing, documentation and annual attestation, is the template other regulators are drawing on. The Colorado Division of Insurance publishes its SB21-169 materials on its website.

Other state activity

New York's Department of Financial Services issued Circular Letter No. 7 (2024) on the use of AI systems and external consumer data in underwriting and pricing. California's Insurance Commissioner issued Bulletin 2022-5 on discrimination and bias in insurance. Texas has Bulletin B-0036-20. Separately, legislatures in several states have considered laws requiring human review of AI-driven claim denials, mostly in health and property. For example, Florida's HB 527 and SB 202 on human review of AI claim denials died in March 2026, according to Repairer Driven News (April 16, 2026). Treat any single-state proposal as unsettled until enacted.

The EU AI Act for multinational buyers

If your company has European operations, two points matter. First, the EU AI Act classifies AI systems used for risk assessment and pricing of natural persons in life and health insurance as high-risk (Annex III). Property and casualty underwriting of businesses is not on that list. Second, the timing has moved. Council and Parliament reached a provisional Digital Omnibus agreement on May 7, 2026 that postpones the high-risk obligations for stand-alone Annex III systems to December 2, 2027, and for AI embedded in regulated products to August 2, 2028 (Sidley, June 22, 2026). Formal adoption was still pending at the time of that report, so confirm the final dates in the Official Journal.

For a multinational company, the practical effect is on employee benefits (group life and health programs in the EU), and on any AI the company itself deploys in Europe, which carries its own obligations as a deployer. Your broker and your benefits consultant should map those. For liability from the use of AI by your own business, see AI liability insurance: how insurers are treating artificial intelligence risk.

What this means if you buy commercial insurance

1. Ask carriers what you can. In commercial lines you will rarely see an AI disclosure, but you can ask how an adverse decision was reached and who reviews it.
2. Expect questions about your own AI use. Underwriters increasingly ask whether you use AI in products or decisions, and some carriers add AI-related exclusions. Read endorsements, including recent generative AI exclusions; see Generative AI in the insurance industry.
3. Keep human review in claims. If a carrier or third-party administrator denies or delays a claim in a way that looks automated, ask for the written basis and escalate. Your state insurance department takes complaints; see state insurance departments and what they can do for businesses.
4. Do not treat the bulletin as protection you can sue under. It guides regulators, not private claims.

Key takeaways

• No federal law governs insurer AI; states regulate through existing unfair-practices, rating and claims laws.
• The NAIC Model Bulletin (December 4, 2023) asks insurers for a written AI program, model inventories, testing and vendor oversight; 29 jurisdictions had adopted it as of October 8, 2026, and four states use their own rules.
• Colorado's SB21-169 rules (Regulation 10-1-1) cover life, private passenger auto and health benefit plans, not commercial lines.
• The EU AI Act treats life and health insurance pricing of individuals as high-risk; the dates were provisionally pushed to December 2027 and August 2028.
• For a commercial buyer, the practical issues are explainability of decisions and AI-related exclusions in your own policies.