Does the NAIC AI Bulletin Apply to Health Insurers and Payors?

What the bulletin is, and what it is not

The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023. As of October 2026, it is described as principles-based guidance. It is not a prescriptive technical standard.

The bulletin's central message is that decisions or actions affecting consumers, when made or supported by advanced analytical and computational technologies including AI, must comply with all applicable insurance laws and regulations. It does not create a separate set of consumer protections for AI. It says existing law applies regardless of the technology used.

Two expectations stand out. Insurers are expected to develop and maintain a written program for the responsible use of AI. The bulletin also encourages verification and testing methods to identify errors and bias, and the potential for unfair discrimination, in predictive models and other AI systems.

Because it is a model bulletin, it does not bind anyone by itself. It operates through what each state does with it, which is where the health insurer question gets practical.

Does it reach health insurers and payors?

Three questions decide whether the bulletin reaches a given organization, and they should be answered in this order.

First, which states where you write health business have adopted the bulletin or an equivalent requirement, and with what variations? A multistate carrier may face the model in one state, a modified version in another and different requirements in a third. State regulators can also go further than a model, so the adopted text in each state is what matters, not the model alone.

Second, does your entity type fall inside the definition of insurer as that state adopted it? Health insurers, HMOs and other payors should test each legal entity and line of business against the adopted language rather than assume coverage or exclusion.

Third, which of your AI systems support consumer-impacting decisions? The bulletin's emphasis is on decisions and actions that affect consumers, so scoping works best by function rather than by technology.

• Utilization management and prior authorization: AI that recommends, prioritizes or supports coverage determinations is a strong candidate for scope review.
• Claims adjudication: Automated or AI-assisted payment, denial or pend decisions affect members and providers directly.
• Fraud detection: Models that flag claims or members can lead to consumer-affecting actions and warrant review.
• Underwriting and pricing: Predictive models used in eligibility or rating raise the unfair discrimination questions the bulletin highlights.
• Member service: Assistants that answer coverage questions or handle PHI may support decisions, depending on what they can do.
• Internal and coding assistants: Lower consumer impact, but still part of the AI inventory your written program should account for.

Required versus demonstrable

A principles-based bulletin tells you what a regulator expects to see in outline. It does not specify the artifacts. In an examination, the practical test is whether you can show that each control operates, not only that it is written down.

The written AI program is the anchor. It needs a defined scope, clear ownership, and a way to tie the document to the systems it governs. A program that describes controls no system enforces is the gap examiners are most likely to find.

Testing for errors, bias and unfair discrimination needs records, not assurances. That means test results tied to specific systems and versions, with follow-up when issues surface. Pre-deployment testing is only part of this. What an AI system does in production is a separate question.

Third-party AI deserves equal attention. Financial regulators' model risk guidance encourages validating vendor and third-party models, and the NIST AI Risk Management Framework lists management of third-party AI risk as an outcome under Manage. Health insurers that rely on vendor models for utilization management or claims should expect examiners to ask how those systems are inventoried, constrained and evidenced, and should confirm the specific third-party provisions in each state's adopted text.

Reconciling NAIC, HIPAA and state rules

Keep the three analyses separate, because they ask different questions.

The NAIC bulletin is about insurance law compliance and responsible AI governance for consumer-impacting decisions. HIPAA is about protecting PHI. Section 164.312(b) of the Security Rule is the audit controls standard, which concerns mechanisms that record and examine activity in systems that handle electronic PHI. State health AI and prior authorization rules add their own requirements for specific functions and may differ from state to state.

The overlap is in evidence. A record showing which AI system touched PHI, under what policy and with what outcome can support a HIPAA audit-control position and an insurance examination at the same time. The divergence is in purpose and scope. A HIPAA audit record does not demonstrate that a prior authorization model was tested for bias, and an AI program document does not demonstrate that PHI access was recorded.

A workable approach is to build one evidence stream and map it to each regime separately. Treat state-specific obligations as additional mappings to be confirmed against the primary state text, not as assumptions carried over from the model bulletin.

Where Trussed fits

Trussed is control, provenance and evidence infrastructure for consequential AI. It enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants, with allow, redact, block, rate limit and escalate-for-human-approval outcomes. Enforcement is scoped to individual interactions and tool calls. It is enforced at runtime, not reviewed after the fact.

That enforcement generates continuous audit-ready evidence, mapped to HIPAA, NAIC, NYDFS, the EU AI Act and NIST. Trussed can be self-managed in the customer's cloud, with configurable retention and data residency, which matters when evidence includes PHI-adjacent records. It runs in production with healthcare organizations, including 18+ months of continuous production in a regulated enterprise.

Trussed is not a substitute for a written AI program, bias testing, state-by-state legal analysis or vendor due diligence. It addresses one part of the examination question: showing what your AI systems were allowed to do and what they did.