ISO/IEC 38507 vs NAIC Bulletin Board Oversight: What Insurer Directors Must Evidence

Different in nature, different in force

ISO/IEC 38507:2022, titled Governance implications of the use of artificial intelligence by organizations, was published on 8 April 2022. It gives guidance to members of an organization's governing body so they can enable and govern the use of AI, with the aim of effective, efficient and acceptable use. ISO's JTC 1/SC 40 describes governing bodies as comprising owners, directors, partners, executive managers or similar. The standard speaks to the board directly, and adopting it is a choice.

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers was adopted by NAIC membership at the 2023 Fall National Meeting, in December 2023. NAIC states that it is not a model law or regulation. It is a guiding document intended to foster uniformity among state insurance regulators. Its practical force depends on how each state adopts it and how that state's examiners apply it.

The bulletin has four key sections. It reminds insurers that decisions affecting consumers that are made or supported by AI must comply with all applicable insurance laws, including unfair trade practices laws. It also sets out regulator expectations for governing AI use, including creating and implementing a written AIS Program commensurate with an assessment of risk, consistent with the NAIC's 2020 Principles of Artificial Intelligence.

The two documents therefore answer different questions. ISO/IEC 38507 asks how a governing body should enable and govern AI. The bulletin asks what a regulator expects an insurer to have in place. A director who treats the standard as a compliance substitute, or the bulletin as a board handbook, will misjudge both.

Side-by-side comparison

The table separates what each document is, who it addresses and what it can lead to. The board-versus-management split in the last row is an editorial mapping for planning purposes, not wording taken from either document.

• Nature: ISO/IEC 38507: international standard providing guidance. NAIC bulletin: regulator guidance document, not a model law or regulation.
• Legal force: ISO/IEC 38507: voluntary. NAIC bulletin: depends on state adoption, with examination consequences where a state applies it.
• Primary addressee: ISO/IEC 38507: members of the governing body. NAIC bulletin: insurers, expressed as insurer-level expectations.
• Central expectation: ISO/IEC 38507: enable and govern AI for effective, efficient and acceptable use. NAIC bulletin: a written AIS Program commensurate with an assessment of risk.
• Consumer outcome focus: ISO/IEC 38507: acceptable use within the organization. NAIC bulletin: consumer-impacting decisions that are accurate and do not violate unfair trade practice laws.
• Board versus management (editorial mapping): Board: approve, challenge and receive evidence. Management: operate the program, controls and records the board examines.

Separating board responsibility from management operation

The bulletin's expectation of a written AIS Program is stated at the insurer level. It does not, in the material summarized here, assign discrete duties to the board. For that reason, directors should treat the following as a practical mapping rather than a quotation of regulatory text.

The board's role is to ensure the program exists, is proportionate to risk, and is being run. That means approving the program, setting the risk appetite for consumer-impacting AI uses, and asking for reporting that lets it test management's claims. Management's role is to operate the program: maintain the inventory, assess risk, manage vendors, deploy controls and keep the records.

The weakness in many board packs is that attestation rests on management assertion. A statement that controls are operating is a claim. A record showing that a control evaluated a specific interaction and produced a specific outcome is evidence. Under ISO/IEC 38507 the board is expected to govern, and under the bulletin the insurer must be able to show its program is real. In both cases, the useful question for a director is what the board can examine that it did not write itself.

State expectations that sharpen the evidence question

State instruments are separately authored and should not be read as the bulletin itself. NYDFS Insurance Circular Letter No. 7, dated 11 July 2024, sets the Department's expectations for insurers authorized in New York that use ECDIS, AIS and other predictive models in underwriting and pricing. It maintains the expectation of appropriate oversight of third-party vendors and adds a clause drawn from the NAIC Model Bulletin on incorporating certain terms into vendor contracts where appropriate. It also expects insurers to be able to establish that a data source or model does not use, and is not based in any way on, a class protected under Insurance Law Article 26. That is a substantive expectation that evidence has to support.

Colorado published a notice of adoption for amended Regulation 10-1-1 on 20 August 2025, the main development in the past twelve months. It establishes governance and risk management requirements for insurers offering individual life, private passenger auto and health benefit plans that use ECDIS, and algorithms and predictive models that use ECDIS. Its scope is limited to those lines and uses, so directors should confirm whether it applies to their own book before reporting against it.

Status can change, and this summary is accurate as of November 2026. The consistent thread is that vendor oversight and demonstrable governance appear in both the bulletin-derived expectations and state-level instruments.

How runtime enforcement produces evidence, and where it stops

Evidence generated at the moment a control acts differs in kind from evidence assembled later. An after-the-fact review reconstructs what probably happened from whatever was retained. A record produced by enforcement in the execution path captures the policy applied, the decision made and the outcome for the interaction itself. This is editorial reasoning, but it explains why directors should ask how a record came to exist, not only whether one can be produced.

Trussed is one way to generate that category of evidence. It enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants, and can allow, redact, block, rate limit or escalate for human approval. Its scope is individual interactions and tool calls. Enforced at runtime, not reviewed after the fact, those decisions produce continuous audit-ready evidence mapped to NAIC and NYDFS expectations, among other regimes. Deployment is self-managed in the customer cloud, with configurable retention and data residency. Trussed works with customers in four regulated verticals, including insurance, and has run 18+ months in continuous production in a regulated enterprise.

The limits matter. Runtime enforcement does not replace the written AIS Program, board approval, risk appetite or vendor oversight. It supplies one class of evidence, namely what AI systems were permitted to do and did, which a board can examine alongside its governance artifacts. It does not provide model lineage, dataset provenance or end-to-end tracing of agentic workflows, and boards should source those separately if their program requires them.