ISO/IEC 42005 vs NAIC AI Model Bulletin: Do Insurers Need an AI Impact Assessment?

What each document is

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers was adopted by NAIC membership at the 2023 Fall National Meeting. NAIC states that it is not a model law or regulation. It is a guiding document meant to foster uniformity among state insurance regulators, and each state issues it through its own department. It reminds insurers that decisions or actions affecting consumers that are made or supported by AI Systems must comply with all applicable insurance laws and regulations.

The bulletin expects an authorized insurer to develop, implement and maintain a written AIS Program for the responsible use of AI Systems that make or support decisions related to regulated insurance practices. The program is designed to mitigate the risk of Adverse Consumer Outcomes. The bulletin also tells insurers what information and documentation a department may request in an investigation or examination.

ISO/IEC 42005:2025, AI system impact assessment, is an ISO/IEC standard. ISO describes it as a framework for identifying, evaluating and documenting the impacts of individual AI systems. ISO also says ISO/IEC 42001 makes impact assessments a consistent and required part of AI governance, while 42005 aims to make those assessments thorough, systematic and actionable. No insurance regulator issues it. It applies to an insurer to the extent the insurer chooses to adopt it.

As of November 2026, state adoption of the bulletin varies by jurisdiction, so the version issued by each state where you operate is the one that matters.

Side-by-side comparison

The table compares the two documents on the dimensions compliance teams most often need to reconcile.

• Purpose: NAIC bulletin: sets regulator expectations for how insurers govern AI Systems. ISO/IEC 42005: gives a method for assessing the impacts of an AI system.
• Binding force: NAIC bulletin: guidance issued through state departments and used in examinations; not a model law or regulation. ISO/IEC 42005: an international standard that applies when an insurer adopts it.
• Unit of scope: NAIC bulletin: the insurer's AIS Program across AI Systems that make or support regulated decisions. ISO/IEC 42005: the individual AI system, linked to organization-level governance under ISO/IEC 42001.
• Documentation: NAIC bulletin: inventories, development and use documentation, risk assessment process, controls, data information. ISO/IEC 42005: a documented evaluation of an individual system's impacts.
• Third parties: NAIC bulletin: the AIS Program covers reliance on third-party data, models and AI Systems, with due diligence and vendor contract terms. ISO/IEC 42005: coverage depends on how the insurer scopes each assessment.
• Live behavior: NAIC bulletin: examiners may request controls, thresholds, measurements and assessments such as drift and auditability. ISO/IEC 42005: the assessment describes anticipated impacts, not runtime activity.

Does an insurer need a formal impact assessment?

The accurate answer is that the bulletin expects a documented risk assessment process within the AIS Program. NAIC's examination-oriented supplement lists a 'Risk Assessment' item, defined as documentation explaining the company's risk assessment process for its use of AI Systems. That item is the closest NAIC analogue to an impact assessment, but the label differs from ISO's. Compliance leaders should avoid stating that the bulletin requires an 'impact assessment' unless they can point to specific text in the version their state issued.

Whether to run formal ISO/IEC 42005 assessments is therefore a design decision. Several factors push toward adopting it. The insurer may have many AI Systems influencing consumer-facing decisions, may rely heavily on vendor models, or may already align governance to ISO/IEC 42001. A repeatable per-system method also makes the risk assessment documentation consistent across business lines.

There are tradeoffs. Structured assessments add effort for every system in the inventory, and a completed assessment can be mistaken for the end of the compliance task. It records intended use and anticipated impacts at a point in time. The bulletin's expectations on testing, validation and ongoing oversight continue after the document is filed.

Mapping assessment elements to AIS Program documentation

A system-level impact assessment typically records intended use, affected parties, foreseeable impacts and mitigations. Each of these can feed an AIS Program artifact an examiner may request. The inventory is the common starting point, because the bulletin lists inventories of predictive models and an assessment is scoped to one AI system at a time.

• Inventory: Use the AI inventory to decide which systems need a system-level assessment, including third-party and vendor systems.
• Intended use and affected parties: Feed governance documentation and the identification of Adverse Consumer Outcome risk.
• Foreseeable impacts: Support risk management records and the verification and testing methods used to find errors, bias and potential unfair discrimination.
• Mitigations: Link to internal controls, including the techniques, measurements and thresholds the insurer applies.
• Data considerations: Align with data information the bulletin mentions: source, provenance, quality, integrity and bias analysis.
• Third-party systems: Connect to vendor due diligence and contract terms covering data security, data sourcing, confidentiality and cooperation with regulators.

Evidence examiners may expect from live systems

The bulletin's examination list reaches beyond design-time description. It includes assessments such as traceability, model drift and auditability where appropriate, and information on the controls, measurements and thresholds the insurer uses. NAIC material on its AI Systems Evaluation Tool also says insurers must demonstrate that risk-based oversight mechanisms are in place and functioning effectively. That tool is a regulator guide, not a law. As of March 2026 it was being piloted by 12 states, and it gathers information on the extent and use of AI, governance and risk mitigation practices, potentially high-risk models and input data types.

A policy statement or an assessment can say a control exists. It does not show that the control applied to a given interaction. Records from live systems close that gap by showing which policy was in effect and what happened when a request met it.

This is where Trussed fits, as a secondary layer. Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Actions are allow, redact, block, rate limit or escalate for human approval, applied to individual interactions and tool calls. Enforcement generates continuous, audit-ready evidence mapped to NAIC requirements, and deployment is self-managed in the customer cloud with configurable retention and data residency. This addresses runtime behavior, not the design-time analysis in an assessment, so it supports a documented assessment rather than replacing it. Trussed has customers in four regulated verticals, including insurance, and has run continuously in production at a regulated enterprise for more than 18 months.