NAIC AI Bulletin Requirements for Cancellation and Nonrenewal Decisions
The NAIC AI Model Bulletin, adopted December 4, 2023, states that decisions or actions impacting consumers that are made or supported by AI systems must comply with all applicable insurance laws. For cancellation and nonrenewal, AI that scores, recommends or drafts is likely in scope alongside AI that decides. Runtime enforcement can control and evidence what AI does in individual interactions and tool calls. The written AIS program, testing, and vendor oversight need separate governance work.
Evidence a carrier should be ready to produce
- The written AIS program and the named owners for each AI use touching cancellation and nonrenewal
- An inventory of AI systems that make or support these decisions, including vendor-supplied systems
- The policies that applied to each system and the dates they were in force
- Per-interaction records showing what each system was allowed, redacted, blocked or escalated
- Records of human approvals on escalated actions, with reviewer and outcome
- Vendor documentation and the contractual basis for oversight of third-party AI
Mapping expectations to controls and to what runtime can address
Written AIS program
Control: a maintained program document with scope, roles and review cycle. Runtime role: none. This is governance work.
Accountability
Control: a named owner and approval authority for each AI use in cancellation and nonrenewal. Runtime role: escalation for human approval can enforce that the approval step occurs before an action proceeds.
Risk management
Control: documented risk assessment and testing for unfair discrimination per use. Runtime role: policy limits on what an AI may access or do. Testing itself is outside runtime enforcement.
Third-party oversight
Control: vendor inventory, contractual terms, and obtained documentation. Runtime role: the same policy applies to vendor AI calls that pass through the execution path. Due diligence remains separate.
Examination documentation
Control: retained records that can be produced on request. Runtime role: evidence generated by enforcement at the level of each interaction and tool call.
Compliance with existing law
Control: state-specific notice, timing and grounds checklists. Runtime role: rules such as routing a drafted notice to a reviewer before release. The legal content comes from compliance.
What the bulletin establishes
The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers is a model template. Individual state insurance departments issue their own versions, addressed to insurers holding certificates of authority in that state. The NAIC describes it as setting guidelines and expectations for responsible use of AI, aligned with the NAIC Principles of Artificial Intelligence.
Its central statement is a compliance reminder rather than a new rulebook: decisions or actions impacting consumers, made or supported by advanced analytical and computational technologies including AI systems, must comply with all applicable insurance laws and regulations. The expectations built around that statement include a written AIS program, clear accountability, risk management, oversight of third parties, and the ability to produce documentation during investigations and market conduct examinations.
The link to cancellation and nonrenewal runs through the general language on decisions impacting consumers. A nonrenewal is plainly such a decision. Existing state requirements for cancellation and nonrenewal, including those on notice and permitted grounds, continue to apply whether or not AI is involved. The bulletin does not replace them.
Why "made or supported by" widens the scope
The phrase "made or supported by" matters most for scoping. A system that automatically issues a nonrenewal is in scope. So, plausibly, is a model that scores retention risk for an underwriter, an assistant that summarizes a claims history before review, or a tool that drafts the nonrenewal letter. This is an interpretation of the quoted text, not a regulator statement, but it is the safer planning assumption.
The practical consequence is that the inventory of AI uses must be broader than the list of automated decision engines. It should cover workflow steps where AI informs a human, and it should include vendor-supplied systems the carrier did not build. Define "AI System" using the adopted bulletin's own wording in your state, then test each workflow step against it.
A human reviewer does not remove a use from scope. It changes where the control sits: the reviewer's approval becomes a control that must itself be demonstrable.
Where enforcement in the execution path helps
Most documents a carrier writes for these expectations describe intent. Runtime enforcement addresses a different question: what an AI system was actually allowed to do, and what it did, on a specific interaction.
In a nonrenewal workflow, the relevant events are model calls and tool calls. An assistant may retrieve a policyholder record, call a scoring service, or write a recommendation to a case system. Policy enforced at that point can allow the call, redact fields the use does not need, block an action outside the approved purpose, or escalate for human approval before an outcome is recorded. Enforced at runtime, not reviewed after the fact, the control applies to every interaction rather than to a sample.
Trussed provides this kind of enforcement in the execution path across models, agents, tools and MCP servers, and generates audit-ready evidence mapped to NAIC and other regimes. It operates at the level of individual interactions and tool calls.
The boundaries should be stated plainly. Runtime enforcement does not establish model lineage or dataset provenance, and it does not provide transaction-level governance across a multi-step case. It does not test a model for unfair discrimination, write the AIS program, or perform vendor due diligence. It supplies one layer of evidence, and the other layers must exist alongside it.
State variation and adjacent regimes
Adoption is state by state, and each state issues its own document. The NAIC implementation map, with status as of April 1, 2026, lists 20 jurisdictions with adopted bulletins. Examples include Connecticut (Bulletin No. MC-25, February 26, 2024), Illinois (Company Bulletin 2024-08, March 13, 2024), Michigan (Bulletin 2024-20-INS, August 7, 2024), Kentucky (Bulletin No. 2024-02, April 16, 2024) and New Jersey (Insurance Bulletin No. 25-03, February 11, 2025). The latest listed adoption is Wisconsin on March 18, 2025. As of October 2026, a multi-state carrier should recheck each operating state against the current map and read that state's text rather than assume it matches the model.
NYDFS Circular Letter 7 and Colorado SB 24-205 are separate regimes, each with its own scope, expectations for testing, and consumer-facing requirements. Meeting the NAIC bulletin should not be treated as satisfying either. The sensible design is a common control set with jurisdiction-specific overlays, so that enforcement rules and evidence records can be tied to the regime that applies to a given policy.
From bulletin expectation to examination evidence
Label: Inventory
Description: Identify every AI use that makes or supports a cancellation or nonrenewal decision, including vendor tools.
Label: Controls
Description: Assign each expectation to a program control or a runtime control.
Label: Enforcement
Description: Allow, redact, block or escalate AI actions in the execution path.
Label: Evidence
Description: Retain per-interaction records that can be produced during a market conduct examination.
Review your cancellation and nonrenewal AI controls
Walk through how policy enforcement in the execution path and the resulting audit-ready evidence fit alongside your AIS program.
Request a Demo