NAIC AI Bulletin Compliance for MGAs: Runtime Enforcement and Audit-Ready Evidence

What the Bulletin expects, and how it reaches MGAs

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers was adopted on December 4, 2023. As of October 2026, no amendment, delay or repeal has been reported. It directs insurers toward a written program, the AIS Program, for the responsible use of AI systems that make or support decisions related to regulated insurance practices. The program should address governance, risk management controls and internal audit functions.

The Bulletin also describes the information and documentation an insurer may be asked to produce. That material relates to or evidences implementation of and compliance with the AIS Program, including documents on monitoring and audit activity. Its third-party provisions cover the insurer's process for acquiring, using or relying on third-party data and on AI systems developed by a third party. They also refer to confirming the third party's compliance with contractual and, where applicable, regulatory requirements.

The Bulletin is addressed to insurers. Applying it to an MGA is an interpretation: an MGA that handles underwriting, claims intake or policy administration under delegated authority is acting on the carrier's behalf, so the carrier has reason to ask the MGA for material that supports its own oversight. The mapping in this guide follows that reading and is not Bulletin text. Confirm with each carrier which version of the Bulletin or state adaptation it applies.

Crosswalk: Bulletin evidence categories to MGA artifacts

Mapping each category to a distinct artifact keeps audit responses consistent across carriers and shows where a document is being asked to do the work of a record.

• Documentation of compliance with AIS Program policies, protocols and procedures: Written policies, an inventory of AI uses (underwriting, claims intake, policy administration), control ownership and attestations. Easiest to produce, and the weakest on its own.
• Techniques, measurements, thresholds and similar controls: The policy rules in force, with version and effective dates, plus interaction-level records of which policy applied and what outcome it produced.
• Monitoring and audit activity: Dated review records, human approval decisions, escalation outcomes and internal audit results.
• Audits or confirmation of third-party compliance: Delegated-authority contract provisions and an evidence package the carrier can use for its own confirmation, producible without manual reconstruction.

Documentation-based versus runtime-enforced assurance

Documentation-based assurance states what should happen. A policy says sensitive data must not reach a model, or that a person must approve a consequential action. An attestation says the MGA follows the policy. Both are necessary, and both are produced before or around the AI activity rather than by it.

Runtime-enforced assurance records what did happen. A control in the execution path evaluates each interaction or tool call against policy, applies an outcome, and keeps a record of the policy, the decision and the time. The evidence is a by-product of operation, not a reconstruction assembled when a carrier asks.

The Bulletin separates a written program from evidence of its implementation and of monitoring and audit activity. A carrier reviewing an MGA can therefore ask a question that a policy cannot answer: show me what the system was permitted to do on a given day, and what it did. If the answer depends on interviews, screenshots or scattered application logs, due diligence slows and delegated-authority renewals become harder to support.

The tradeoff is operational. Enforcement in the path adds a component to run, tune and own. Rules that are too loose produce weak evidence, and rules that are too strict interrupt work. Decide ownership for policy changes before deployment.

What runtime enforcement contributes to the evidence set

Enforcing policy at runtime means each interaction can end in a defined outcome: allow, redact, block, or escalate for human approval. Each outcome is a discrete, dated fact. A redaction record shows a control acted on data before it left the MGA's boundary. A block record shows a request was stopped. An escalation record, with the reviewer's decision, shows a human was in the loop where policy required one. Read against the Bulletin's list, these records are candidates for evidence of the controls used and of monitoring activity. Whether a given carrier accepts them is a conversation to have in advance.

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Its scope is individual interactions and tool calls. Enforcement generates continuous, audit-ready evidence mapped to NAIC, among other regimes. Trussed has run for 18+ months in continuous production in a regulated enterprise and serves customers in four regulated verticals, including insurance.

Evidence of this kind answers the question of what a control permitted or stopped at the interaction level. It does not replace the AIS Program documents, the AI use inventory or the contractual terms with the carrier. Keep the two sets separate so each Bulletin category has its own artifact.

Evaluating tooling for carrier-facing evidence

Start with position. Controls that sit in the execution path can record each decision as it is made. Controls that review activity afterward can only describe it, and their records depend on what the application chose to emit. Ask a vendor to show a decision record for a single blocked request and a single human escalation.

Then test the operating terms. Retention length determines whether you can answer a request that covers a prior renewal period. Data residency determines where interaction records sit. Self-managed deployment in your own cloud keeps those records under your control, which many MGAs will want before sharing evidence with several carriers. These are buyer diligence criteria, not Bulletin requirements. Trussed supports self-managed deployment in the customer cloud with configurable retention and data residency, and holds SOC 2 Type II and ISO 27001 among its certifications.

Finally, test scope claims. A vendor should say precisely what its evidence covers and show proof for each claim. Interaction-level enforcement records are not the same as model or dataset provenance, or tracing of a whole agentic workflow. Match each claim to the Bulletin category it is meant to support, and treat any claim without a matching artifact as unproven.