Reporting AI Risk to an Insurer Board Under the NAIC Model Bulletin

What the NAIC Bulletin expects boards to oversee

The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. It sets expectations for responsible AI use that align with the NAIC Principles of Artificial Intelligence, and it centers on a written AIS Program. That program is meant to mitigate the risk of Adverse Consumer Outcomes through governance, risk management controls and internal audit, including monitoring, auditing, escalation and reporting protocols. The Bulletin also describes the information and documentation a Department may request during an investigation or examination.

Board accountability is where instruments differ, so wording matters. NYDFS Insurance Circular Letter 7, issued July 11, 2024 and scoped to underwriting, says the board, another governing body, a committee, or senior management through delegated authority should review and approve AIS-related policies and procedures at least annually. It also expects clearly defined roles and responsibilities, monitoring and reporting requirements to senior management, and certain terms in third-party vendor contracts where appropriate. Because the Bulletin is a model, operative dates and exact accountability language depend on each state's adoption as of October 2026. Confirm the version that applies in each state where you write business, and record whether review sits with the full board, a committee or delegated management.

Map each Bulletin area to a report component and its evidence

A board report is easier to defend when each section answers a specific expectation and names the record behind it. The mapping below is a working structure rather than a prescribed format.

• Governance: Report which body approves AIS policies and how often, who holds defined roles, and how management reports upward. Evidence: approval minutes, policy versions, role assignments and any documented delegation.
• Risk management and internal controls: Report the insurer-defined risk criteria, the tiering of in-production models and control exceptions with their resolution. Evidence: risk assessment documentation, materiality explanations and exception records.
• Third-party AI oversight: Report which vendor-supplied models are in use, where, and whether contracts carry the expected terms. Evidence: inventory entries for vendor models and contract review records.
• Regulatory documentation: Report readiness to produce inventory, risk assessment and materiality documentation without assembling it on request. Evidence: a retrievable document set organized the way regulators ask for it.

Which AI risk metrics belong in the report

Start with the inventory. The NAIC's AI risk evaluation supplement lists regulator requests for a model inventory by program area, with fields such as model name, how it is used, the broader use case, program area, consumer impact and financial impact. A board report can summarize the same record: counts of AI systems by program area (underwriting, claims, pricing, fraud detection), split between internally built and third-party models.

Next, state the risk criteria. The supplement focuses on in-production high-risk models and leaves risk criteria to the insurer, with materiality a factor in setting risk level. The report should therefore say how risk tiers are defined and how many systems fall in each, otherwise the numbers cannot be interpreted or defended.

Then report on outcomes and control performance: consumer-impacting automated decisions in the high-risk tier, control exceptions opened and closed, incidents and their status, and changes in AI use since the last report. For third-party AI, add the share of vendor models with reviewed contract terms. Keep the set small and stable from one period to the next, so the board can see trends rather than relearn the format each time.

Structure the cadence and content

Treat annual review and approval of AIS policies as the baseline, since that is the explicit NYDFS expectation and a sensible default elsewhere. Between annual approvals, many insurers report on a shorter cycle to a risk committee, for example quarterly. That frequency is a design choice, not a stated requirement, and should reflect how fast the AI footprint changes.

A workable report has four parts. Open with a one-page summary: material changes, exceptions and incidents requiring a decision. Follow with the inventory and risk tier view. Then cover control performance and third-party status. Close with examination readiness: what documentation exists, where it sits and who can produce it.

The main tradeoff is depth against readability. Boards need decisions and trends, not model-level detail, but every summary figure should trace to a record that management can produce. Appendices that hold the supporting documentation keep the main report short without weakening it. Where reports rely on management attestation, make sure the documentation behind the attestation exists and can be produced, because examinations ask for the documentation, not the attestation.

Where runtime evidence supports the report

Periodic reviews describe what was intended. They rarely show what AI systems did between reviews. Runtime evidence closes that gap by recording, at the point of execution, what a system was permitted to do and what happened. For board reporting, useful records include policy decisions, interactions that were blocked or redacted, items escalated for human approval and the outcome of each escalation, and retention records showing how long evidence is kept.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers: allow, redact, block, rate limit, or escalate for human approval. Enforcement is at runtime, not reviewed after the fact, and it generates continuous audit-ready evidence mapped to NAIC and NYDFS requirements. It runs self-managed in the customer cloud, with configurable retention and data residency, and has been in continuous production in a regulated enterprise for 18+ months. Customers span four regulated verticals, including insurance.

Scope matters. This evidence covers individual interactions and tool calls. It supports the control-performance and exception sections of a board report, but it does not replace the inventory, risk assessment documentation, materiality explanations or vendor contract review described above.