Does the NAIC AI Bulletin Apply to Reinsurers?

What the bulletin says about who it covers

The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023. It is a model. It takes effect only when an individual state insurance department issues its own bulletin.

The model text is issued by a state department to remind all insurers that hold certificates of authority to do business in the state that decisions or actions impacting consumers, made or supported by advanced analytical and computational technologies including AI Systems, must comply with all applicable insurance laws and regulations. It also sets out the department's expectations for how insurers govern the development, acquisition and use of those technologies. Finally, it describes the information and documentation a department may request during an investigation or examination of an insurer.

Two phrases drive the scoping work. The first is the addressee, insurers with certificates of authority. The second is the subject matter, decisions or actions impacting consumers that are made or supported by AI Systems. A reinsurance use case is inside the bulletin's concern only if the entity is covered and the use makes or supports that kind of decision.

State adoption and licensing status decide direct applicability

The NAIC's implementation tracker, with a status date of April 1, 2026, lists 20 jurisdictions with adopted bulletins: Alaska, Arkansas, Connecticut, Delaware, the District of Columbia, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Nevada, New Hampshire, New Jersey, North Carolina, Oklahoma, Rhode Island, Vermont, Wisconsin and West Virginia. Adoption dates run from February 2024 to March 18, 2025. California is listed separately, with Bulletin 2022-5 issued June 30, 2022, before the model existed. Because this status can change, confirm it as of October 2026 before relying on it.

State bulletins do not share one title or addressee. Delaware's is titled Domestic and Foreign Bulletin No. 148, for example. A compliance team should read each relevant state's adopted text for its covered-entity language rather than assume it mirrors the model. The practical questions are whether the text is limited to insurers holding certificates of authority, and whether the entity is licensed, accredited, certified or a reciprocal-jurisdiction reinsurer in that state. Qualified counsel should answer those questions against the primary texts.

Direct, indirect and no applicability

Use this as a starting frame for each state and each entity.

• Direct: The adopted text covers the reinsurer by its licensing status or its regulated activity. The department's governance and documentation expectations apply to the entity itself.
• Indirect: The text covers the ceding insurer, not the reinsurer. The cedent may seek information about AI used in reinsurance workflows that touch its consumer-impacting decisions, or about shared vendors.
• Not at all: Neither the entity nor the use case falls within the adopted text, and no cedent has asked. Document the reasoning so the conclusion can be revisited.

Which reinsurance AI use cases create exposure

The test is whether the use makes or supports decisions that impact consumers, directly or through cedent data. Treaty underwriting and pricing may not do so directly, since the counterparty is a ceding insurer. That is a reading to confirm, not a safe harbor.

Claims audit sits closer to consumers, because AI-assisted review of cedent claims can influence how an underlying claim is handled. Cedent data ingestion matters because personal and policyholder data may pass through AI tools, including third-party ones. Catastrophe modeling inputs matter where vendor models or AI-derived features feed pricing or accumulation decisions that a cedent relies on.

Build a scoping inventory with one row per use case. Record the entity and its licensing status, the states involved, whether the use makes or supports consumer-impacting decisions, and any third-party AI or data vendor involved. Over-building happens when every use case is treated as in scope. Under-building happens when none is examined.

Program elements and contractual flow-down

Where the bulletin applies, it addresses both the development or acquisition of AI systems and their use. A program designed around those expectations needs accountable ownership for both, and it should assume that documentation may be requested during an examination.

For reinsurers, much of the practical pressure comes through contracts. A ceding insurer subject to the bulletin may want information rights over AI used on its data, along with terms covering vendor oversight and data sharing. Review treaties, audit-rights clauses and data-sharing terms for AI-related obligations a cedent might require. Do the same for your own third-party AI and data vendors, since you cannot evidence control of a system you cannot inspect.

• Named owner for AI governance, covering acquisition, development and use
• Inventory of AI systems and use cases, with state and licensing scope noted
• Written policy on what each system may do and which data it may touch
• Vendor oversight terms covering information rights and data handling
• Human approval points for consequential outputs
• Retention of records an examiner or cedent could request

The evidence a regulator or cedent could ask for

The bulletin's attention to documentation at examination points to a simple standard: show what each AI system was permitted to do and what it did. Narrative policies alone rarely meet it. Reviewers tend to ask for artifacts, such as the inventory entry, the policy in force at the time, the record of actions taken, the record of who approved exceptions, and the vendor terms behind the system.

Timing matters. Evidence assembled after a request is a reconstruction. Evidence produced as the system operates is a record. Where AI tools touch cedent data, the useful records show which requests were allowed, which data was redacted, which actions were blocked and which were escalated to a person.

Trussed enforces policy in the execution path of AI interactions and tool calls: allow, redact, block, or escalate for human approval. Enforcement is at runtime, not reviewed after the fact, and it generates audit-ready evidence mapped to NAIC requirements. That is one way to produce the records above. The scoping work and the legal reading of each state's text remain yours either way.