Does the NAIC AI Bulletin Apply to Brokers Using AI for Placement?

What the bulletin says about its own scope

The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. It is guidance, not a model law or regulation, and it is described as a guiding document for state insurance regulators. It sets out how departments of insurance that adopt it will use their existing statutory authority to govern the development, acquisition and use of AI technologies. It also outlines the types of information and documentation a department may request during an investigation or examination of an insurer in relation to AI systems.

The guidance is principles-based. It reminds insurers that decisions or actions affecting consumers, when made or supported by advanced analytical and computational technologies including AI, must comply with all applicable insurance laws and regulations. Insurers are expected to develop and maintain a written program for the responsible use of AI, often referred to as an AIS program. The bulletin also encourages verification and testing to identify errors and bias, and the potential for unfair discrimination, in predictive models and other AI systems.

Every one of these expectations is directed at insurers. That is the fixed point for a broker's analysis. Whether AI-assisted submission triage or carrier matching counts as a decision or action affecting consumers is an interpretive question, and it should be answered with counsel rather than assumed in either direction.

How state adoption and variation change the answer

Because the bulletin is guidance, it has force in a state only when that state's department of insurance adopts it or issues equivalent guidance. Reported figures as of January 2026 put adoption of substantially similar bulletins at about 25 states, with other passages in the same reporting citing more than 20. Treat any count as approximate. It does not tell an agency which of its licensed states have adopted a version, or what that version says.

This matters for brokers because applicability is decided state by state. A state's adopted text may keep the bulletin's insurer focus or may be worded differently. Producer licensing rules and other state requirements sit on a separate track and may or may not address AI. An agency licensed in several states should expect a mixed picture, and should not assume that a position taken for one state holds for the rest.

Direct, indirect and state-level reach compared

Keeping the three channels separate prevents a common error: treating an indirect contractual expectation as if it were a direct regulatory obligation, or the reverse.

• Direct regulatory reach: Basis: the bulletin as adopted by a state. The bulletin is addressed to insurers, so reach to brokers depends on the full text and the state's version. Status: open question for counsel.
• Indirect reach through carriers and vendors: Basis: carrier contracts, documentation requests, audit rights and vendor requirements. This is an inference, not a stated requirement. Status: review agreements and carrier correspondence.
• State-level adoption and producer rules: Basis: each state's own guidance and licensing rules. Adoption varies and treatment of licensees other than insurers may differ. Status: assess per licensed state.

When AI-assisted placement could fall within expectations

Placement workflows differ in how much they influence outcomes. An AI tool that summarizes a submission for an internal reviewer is different from one that ranks carriers, filters out markets or shapes which terms a client sees. The closer AI output sits to a decision or action affecting a consumer, the stronger the case for treating the workflow as in scope for any expectation that follows from the bulletin or from a carrier.

Third-party components add a second layer. The bulletin addresses an insurer's acquisition of AI, not only its development and use, so an insurer's program can be expected to cover AI systems and data sourced from vendors. A carrier may reasonably want similar visibility into a broker's AI-assisted placement tools, particularly where the broker's output feeds the carrier's underwriting. This is an inference about how expectations could flow through contracts, audit rights or documentation requests, and it should be checked against the actual agreements.

If an examiner or carrier partner does ask, the likely subjects mirror what the bulletin describes for insurers. These include a written description of how AI use is governed, an inventory of the AI systems involved, results of verification and testing, and records of what a system did in specific cases. The mapping of these items to placement workflows is illustrative. The bulletin describes information requests in the context of insurer examinations.

Framing an internal applicability assessment

An assessment works best as a short, owned exercise that ends with a counsel-reviewed position for each licensed state and each workflow.

• Inventory AI use in placement: submission triage, carrier matching and placement support, including which models and data come from third parties.
• List the states in which the agency or brokerage is licensed and record whether each department of insurance has adopted the bulletin or equivalent guidance.
• Ask counsel whether each adopted text reaches producers, brokers or agencies, and whether any producer rule addresses AI.
• Review carrier agreements for AI-related provisions such as documentation requests, audit rights and vendor requirements.
• Assign an owner to each AI-assisted workflow and decide which AI-use and control records could be produced on request, in retrievable form.

Runtime control and evidence for AI-assisted placement

Whatever the applicability answer, the practical question an examiner or carrier asks is the same: what was this AI allowed to do, and what did it do? Written policies answer the first part on paper. Answering both parts with evidence requires records generated at the point where AI interactions and tool calls actually run.

Trussed enforces policy in the execution path of AI interactions and tool calls across models, agents, tools, MCP servers, AI sites and coding assistants. Policy is enforced at runtime, not reviewed after the fact, with outcomes that include allow, redact, block, rate limit and escalate for human approval. For a placement assistant, an illustrative case is a tool call that would send client submission data to an external model. Policy can redact sensitive fields, block the call or route it for human approval. Each decision produces audit-ready evidence, which Trussed maps to NAIC expectations alongside HIPAA, NYDFS, the EU AI Act and NIST. Scope is individual interactions and tool calls. It does not decide whether the bulletin applies to a given broker, and it does not replace a written program.

Insurance is the regulated financial sector where Trussed is deepest. Approved proof points include 18+ months of continuous production in a regulated enterprise, 99.95% uptime on live production traffic, 100+ models under one policy plane and 30+ GB of audit evidence generated per day. Self-managed deployment in the customer cloud, with configurable retention and data residency, lets a regulated enterprise decide where evidence lives and how long it is kept.