How the NAIC AI Bulletin Applies to Commercial Lines AI Use Cases

What the bulletin is and what triggers scope

The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023. It is a department-issued bulletin, and each state issues its own version. The NAIC describes it as establishing guidelines and expectations for responsible use of AI by insurers, aligned with the NAIC Principles of Artificial Intelligence. As of October 2026, the NAIC has reported no amendment or replacement of the model.

The bulletin reminds all insurers holding certificates of authority that decisions or actions impacting consumers, made or supported by advanced analytical and computational technologies including AI Systems, must comply with all applicable insurance laws and regulations. It also sets out how the department expects insurers to govern the development or acquisition and use of those technologies.

The operative phrase is "impacting consumers." That framing is the scope trigger, and commercial lines teams should not assume it excludes them or includes them by default. The determination is a legal question to resolve for each state in which the carrier or brokerage operates, using that state's version of the bulletin and any related state law.

Mapping commercial lines use cases to the scope question

Start with an inventory of AI uses across commercial underwriting, submission intake, pricing support, claims handling and broker-facing assistants. For each, record whether the decision or action it makes or supports impacts consumers. The NAIC has described AI techniques as being used across the insurance life cycle, including underwriting and pricing, policy servicing and claim management, so these workflows are plausible candidates for review.

The questions below are practical prompts for the legal determination. They are not conclusions about how any state treats commercial lines.

• Submission intake: Does the system only extract and structure data, or does it influence whether and how a submission proceeds? Does the data include information about individuals?
• Underwriting triage: Does the output rank, decline or route risks in a way that supports an underwriting decision about an insured that is or includes an individual?
• Pricing support: Does the system inform a rate or price outcome, and can the factors it relies on be identified and tested?
• Claims handling: Does the system affect how claims by individuals are evaluated, prioritized or paid?
• Broker-facing assistants: Do responses shape coverage or eligibility guidance that reaches an end consumer, or do they stay within business-to-business support?

What the AIS Program and documentation expectations require

The bulletin asks insurers to develop, implement and maintain a written program for the responsible use of AI systems, referred to as the AIS Program. It is described as principle-based rather than prescriptive. The insurer must therefore define and justify its own controls, thresholds and evidence rather than follow a fixed checklist.

Governance expectations include a documented accountability structure across business units, actuarial, data science, underwriting, claims, legal and compliance, with senior management or board accountability. Verification and testing methods to identify errors, bias and unfair discrimination are recommended. Because the bulletin addresses acquisition as well as development, AI supplied by third parties, including vendor models and data sources, should be inventoried in the program and tied to the same controls and documentation. Contractual and audit rights with vendors are part of making that oversight real.

Section 4 of the bulletin lists information a department may request in an investigation or market conduct action. The adopted text includes measurements, standards or thresholds the insurer adopted or used in developing, validating and overseeing models and AI Systems, along with information on techniques, measurements, thresholds and similar controls. The NAIC's AI Systems Evaluation Tool adds that insurers must demonstrate to regulators that adequate oversight mechanisms are in place and functioning effectively.

Policy and process versus runtime enforcement

Some expectations are met through policy and process: the written AIS Program, role definitions, committee oversight, validation methodology, vendor due diligence and contract terms. These are documented, reviewed and approved on a defined cadence.

Other expectations depend on what the system actually does during use. If a regulator asks for the controls applied to a model and evidence that oversight is functioning, a policy document shows intent, not operation. A rule that says sensitive applicant data must not reach an external model, or that a claims recommendation requires adjuster approval, is only evidence of control if something enforces it and records the outcome.

This is an inference from the bulletin's emphasis on measurements, thresholds and functioning oversight, not text the bulletin states. It suggests splitting the program in two. Process controls remain with governance owners. Controls that apply to individual AI interactions and tool calls are enforced in the execution path, with an allow, redact, block or escalate-for-human-approval decision recorded each time. The second category is where most commercial lines assistants and agents operate, because they read submissions, query internal systems and draft outputs without a person reviewing each step.

The tradeoff is specificity. Runtime enforcement needs policies precise enough to execute, and each policy should trace back to a stated AIS Program control and threshold.

Where Trussed fits

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. It can allow, redact, block, rate limit or escalate for human approval at the level of individual interactions and tool calls. That enforcement generates continuous, audit-ready evidence, mapped to frameworks including the NAIC bulletin. Deployment is self-managed in the customer cloud, with configurable retention and data residency.

Trussed addresses the runtime portion of the program described above. It does not replace the written AIS Program, the legal scope determination or model validation work. It has been in continuous production in a regulated enterprise for more than 18 months, and its customers span four regulated verticals, including insurance.