NAIC AI Bulletin Coverage of Pricing and Rating Models

Do pricing and rating models fall within scope?

Yes, in practice. The Bulletin says an insurer's AIS Program should address AI systems across the insurance life cycle, and the list it gives includes product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, and fraud detection. Pricing and rating are named directly rather than left to inference.

NAIC evaluation materials describe an AI system as a machine-based system that can, for a given set of objectives, generate outputs such as predictions, recommendations, content or other output influencing decisions. They add that systems operate at varying levels of autonomy: supportive, augmented or automated. The test is therefore not whether a model is fully automated. A model whose output only supports an underwriter or actuary can still be an AI system under this description.

The same materials give examples that map closely to carrier workflows. Ratemaking and pricing examples include base rates, loss and expense loadings, trend and loss development estimation, manual rating factors, tiering criteria, insurance credit scoring, territory definitions, individual risk rating, telematics and usage-based insurance, price optimization and schedule rating factors. Underwriting examples include policy and coverage acceptance, company placement and tiering, schedule rating, telematics decisions, retention modeling and anomaly detection. NAIC's AI topic page also notes that pricing uses machine learning for risk scoring and for determining rate factor relativities.

A practical reading: if a model, vendor score or generative tool produces an output that influences a rating, tiering or underwriting decision affecting a consumer, treat it as a candidate for the AIS Program inventory.

What the Bulletin expects for these uses

The Bulletin reminds insurers that decisions or actions affecting consumers, made or supported by advanced analytical and computational technologies including AI systems, must comply with all applicable insurance laws and regulations. It also sets out the Department's expectations for how insurers govern the development, acquisition and use of these technologies.

The central expectation is a written AIS Program. NAIC commentary describes the program as designed to mitigate the risk of an adverse consumer outcome, meaning a decision by an insurer that adversely affects a consumer in a way that violates regulatory standards enforced by the Department. That definition matters for pricing teams. The Bulletin does not create a new standard for AI-built rates. It ties the program to violations of existing standards, such as rating and unfair discrimination requirements.

The program is framed around governance, risk management controls and internal audit functions. For third-party models, data and AI systems, insurers should retain documentation on those programs, data and predictive models developed by third parties. This applies to vendor-supplied scores and rating inputs as much as to internally built models.

The Bulletin also advises insurers of the type of information and documentation the Department may request during an investigation or examination. Insurers should expect AI program questions in investigations and market conduct actions. The operational consequence is that a pricing use must be explainable in program terms: what is in use, who owns it, what controls apply, and what records exist.

What the Bulletin covers and what stays with other regimes

The Bulletin works alongside existing law. This division helps teams assign ownership.

• AIS Program governance: Covered by the Bulletin. Written program, risk controls, internal audit, documentation available for examination.
• Third-party AI systems, data and models: Covered by the Bulletin through documentation retention and oversight expectations. Contract mechanics remain an insurer decision.
• Whether rates are excessive, inadequate or unfairly discriminatory: Governed by state rating law. The Bulletin says rating requirements apply regardless of methodology.
• Rate filings and approvals: Governed by each state's rate-filing rules, not by the Bulletin.
• Colorado SB 24-205 and NYDFS Circular Letter 7: Separate regimes with their own requirements. Assess them independently for the same models.
• Model validation and actuarial review: Still required. Neither is displaced by AIS Program documentation or runtime controls.

Adoption status and state variation

The NAIC adopted the Model Bulletin on December 4, 2023. A model bulletin has no effect in a state until that state issues its own bulletin or takes equivalent action. As of October 2026, NAIC's implementation list names 20 jurisdictions with bulletins: Alaska, Arkansas, Connecticut, Delaware, the District of Columbia, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Nevada, New Hampshire, New Jersey, North Carolina, Oklahoma, Rhode Island, Vermont, West Virginia and Wisconsin. Listed adoption dates run from February 1, 2024 for Alaska to March 18, 2025 for Wisconsin, so none of them falls in the previous 12 months.

For a multistate carrier, the practical step is to read each state's own bulletin text rather than assume it mirrors the model. A state may adopt the model in modified form, so the treatment of pricing and rating can differ. The same applies to states that have not adopted a bulletin but still enforce existing rating, unfair discrimination and market conduct law.

Colorado and New York add further requirements. Colorado SB 24-205 and NYDFS Circular Letter 7 are distinct from the NAIC Bulletin. A carrier writing in those states should map their requirements to the same model inventory and not treat NAIC alignment as a substitute.

Where runtime enforcement and evidence can help

Some Bulletin expectations concern program design and model quality. Others concern whether the insurer can show what its AI systems were permitted to do and what they did. Runtime enforcement can support the second group, and only that group.

Trussed enforces policy in the execution path on individual AI interactions and tool calls. In a pricing or rating workflow, that can include an assistant that summarizes underwriting files, an agent that calls a rating tool, or a model that receives applicant data. Policy is enforced at runtime, not reviewed after the fact: an interaction can be allowed, redacted, blocked or escalated for human approval. Each enforcement decision produces audit-ready evidence, which Trussed maps to NAIC expectations.

This mapping is an interpretation, not NAIC guidance. The Bulletin describes program documentation and retained records, and per-interaction evidence can serve as an input to that documentation. It does not specify what examiners will accept.

The limits are important. Interaction-level enforcement does not address model drift, the reliability of model outputs, or model and algorithm inventories. It does not replace validation, actuarial review or rate-filing support. Trussed does not provide model lineage, dataset provenance, transaction-level governance or end-to-end tracing of agentic workflows. It covers the interaction and tool-call layer, and it applies to the regulated enterprise whose AI use sits in that path.