Build vs Buy NAIC AI Bulletin Evidence: Cost and Staffing Tradeoffs

What the bulletin expects you to be able to show

NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. It is a guiding document, not a model law or regulation, intended to foster uniformity among state insurance regulators. As of October 2026, each state's implementation governs what applies to a given carrier or brokerage.

The bulletin reminds insurers that decisions or actions affecting consumers, when made or supported by AI, must comply with all applicable insurance laws. Insurers are expected to maintain a written program for the responsible use of AI. In NAIC's drafts, that AIS program addresses governance, risk management controls and internal audit, along with model inventories, documentation of development and use, and auditability of measurements such as drift. The drafts also cover how an insurer relies on third-party data and third-party AI systems, including due diligence on the vendor.

The examination side matters most for a build or buy decision. In an investigation or market conduct action, an insurer can expect questions about how it develops, deploys and uses AI systems and what outcomes they produced, including adverse consumer outcomes. It can also be asked for documentation showing compliance with its own AI program policies and procedures. That exposure applies whether or not a written program exists, so documentation alone does not close an evidence gap.

Runtime evidence and after-the-fact documentation are different things

Most insurers already produce documentation: policies, inventories, validation reports, vendor files. Most also produce application logs. Both are useful, but they answer different questions. Documentation states what the organization intended. Logs record what a system emitted, often without the policy that applied at that moment or a decision about whether the action was allowed.

Evidence generated by enforcement in the execution path is different. When a policy decision is made on each interaction or tool call, such as allow, redact, block, rate limit or escalate for human approval, the decision itself becomes the record. It shows the rule in force, the action taken and the outcome. An examiner asking what an AI system was permitted to do and what it did can be shown records created at the moment of the action, not a reconstruction.

This distinction should shape the whole decision. If your internal design only collects logs and writes narratives around them, you are building after-the-fact documentation. That can support parts of the AIS program, but it is not the same evidence.

Breaking an internal build into cost and staffing components

An internal build is not one project. It is five workstreams, each with a different staffing profile. Costing them separately keeps the comparison with an external option honest. The bulletin calls for defined roles and responsibilities across the AI system life cycle, so each workstream also needs a named owner on the compliance side.

• Instrumentation: Platform and security engineers must capture interactions and tool calls across models, agents and tools, including vendor-supplied systems. Coverage gaps appear each time a new model, agent or tool is added.
• Policy enforcement: Enforcement in the execution path needs engineers who can build and run a low-latency decision point, plus compliance staff to translate policy into rules and review the exceptions routed for human approval.
• Evidence storage and retention: Evidence stores hold non-public consumer information, so they need their own access controls. Security, legal and records staff must set retention periods and data residency, and keep records examination-ready.
• Regulatory mapping: Compliance staff must tie evidence to bulletin expectations and to the examination requests an insurer can anticipate, using the adopted text rather than earlier drafts.
• Ongoing maintenance: States adopt or modify the bulletin, and related regimes such as NYDFS Circular Letter 7 and Colorado SB 24-205 add their own expectations. Each change requires re-checking mappings, rules and retention settings.

What to build and what to buy

Some work cannot be bought because it describes your organization. The written AIS program, the allocation of roles, the model inventory, your risk tolerance and your internal audit practice should be owned in-house. So should the decision about which AI uses are consequential. An external tool can support these but cannot author them.

The case for buying is strongest where the work is mechanical, continuous and expensive to keep correct: enforcing policy in the path of each interaction and tool call, producing evidence from those decisions, running durable storage, and keeping mappings current across jurisdictions. These need a specialized engineering team over a long period, and a shortfall in either engineering or compliance capacity shows up as thin evidence at the moment of examination.

Buying also has a cost of its own. A purchased evidence capability is a third-party relationship. It falls under the same due diligence the bulletin expects for other third-party AI systems, and possibly contract terms requiring the vendor to maintain a program commensurate with your standards. Time to examination readiness, and the compliance effort of vetting the vendor, belong in the comparison alongside engineering effort.

Where Trussed fits

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Actions are allow, redact, block, rate limit or escalate for human approval, applied to individual interactions and tool calls. Enforcement generates continuous, audit-ready evidence mapped to NAIC, NYDFS, HIPAA, the EU AI Act and NIST.

Deployment is self-managed in the customer cloud, with configurable retention and data residency. Trussed runs in production for customers in four regulated verticals, including insurance, and generates more than 30 GB of audit evidence per day. It does not replace the AIS program, the inventory or vendor due diligence that your team owns, and it is not a substitute for them.

Whatever you choose, begin by costing the five workstreams above against your current staffing, then decide which ones your team can sustain as regimes change.