NAIC AI Model Bulletin Claims Handling Requirements: Controls and Evidence

What the bulletin is, and what it is not

The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023. The NAIC describes it as a guiding document rather than a model law or regulation, intended to foster uniformity in regulator expectations. It has effect in a state only when that state's insurance department issues its own bulletin or an equivalent. As of August 2025, 24 states had adopted it. Alaska was first, on February 1, 2024, and 15 of the 24 adopted in the first half of 2024.

Because each state issues its own bulletin with its own number and date, compliance teams should read the version for every state where they write business. Some states also have separate statutes, and the bulletin does not replace state law. Its core reminder is that decisions affecting consumers that are made or supported by advanced analytical and computational technologies, including AI, must comply with all applicable insurance laws, including unfair trade practices laws. In claims, that means AI-supported decisions sit under the same claim investigation and disposition standards as any other decision.

Scope and AIS Program elements for claims AI

The bulletin applies across the insurance life cycle. NAIC material quoting it lists case management, claim administration and payment, and fraud detection among the covered areas. It also applies to AI used by or on behalf of the insurer, so a vendor-operated claims system is in scope on the same footing as one built in-house.

The AIS Program is the central requirement. It must be written, aligned to the NAIC's 2020 Principles of Artificial Intelligence, and commensurate with an assessment of risk. The goal is that AI-supported decisions are accurate and do not violate unfair trade practice laws or other legal standards. NAIC drafting materials describe risk factors that include the nature of the decision, the potential consumer harm from errors or unfair bias, the extent to which humans are in the loop, and the extent of reliance on third-party data, models and AI systems.

The bulletin states that it does not prescribe specific practices or documentation. The mapping from principle to claims control is therefore your own interpretation, and you need to document the rationale. A denial-support model with limited human review warrants a different level of control than a document classifier at intake, and the program should show that reasoning for each use case.

Third-party AI and data obligations

Each AIS Program should address how the insurer acquires, uses or relies on third-party data to develop AI systems and on AI systems developed by a third party. The bulletin lists due diligence on third parties and their data, models or AI systems, and contracts with third-party vendors, among the items a regulator may request.

NAIC drafting materials list contract terms covering representations, warranties, data security and privacy, data sourcing, intellectual property rights, confidentiality and disclosures, and cooperation with regulators. The last item matters most in claims. If a vendor hosts the model that supports triage or fraud scoring, your ability to answer an examiner depends on whether the contract obliges the vendor to supply information, and whether your own records show how the system was used.

Assign accountability for diligence and contract review to a specific function, and keep the files current. Vendor attestations describe what the vendor says its system does. They do not show what the system did on your claims, which requires evidence captured on your side.

Examination expectations and what can be enforced at runtime

The bulletin advises insurers of the documentation a state department of insurance may request in an investigation or examination. NAIC materials describe compliance documentation for AIS Program policies and procedures, data information (source, provenance, lineage, quality, integrity, bias analysis, suitability and updating), techniques, measurements and thresholds, and validation, testing and auditing documentation, including evaluation of model drift. The NAIC is also developing an AI Systems Evaluation Tool for regulators. As of March 2026, 12 states are piloting it. It gathers information on the extent and use of AI, governance and risk mitigation practices, potentially high-risk models, and input data types.

It helps to separate requirements by how they can be met. Policies, risk assessments, vendor diligence and contract terms are organizational and depend on policy decisions, not technology. Bias analysis, validation and drift evaluation are periodic exercises. A smaller set of controls can be enforced at the level of an individual interaction or tool call: restricting which data a claims AI system can reach, redacting sensitive fields, blocking out-of-scope actions, and requiring human approval before a consequential step. Which of these to apply is an insurer design decision, since the bulletin sets no technical standard.

The bulletin gives no claims-specific guidance on bias controls beyond encouraging verification and testing to identify errors, bias and the potential for unfair discrimination. Interaction-level controls do not replace that testing. They can limit what a system is permitted to do and produce records of what it did, which supports the monitoring that testing relies on.

Where runtime enforcement and evidence fit

Trussed is one way to implement the interaction-level controls described above. It enforces policy in the execution path across models, agents, tools and MCP servers, with actions to allow, redact, block, rate limit, or escalate for human approval. Enforcement is applied to individual interactions and tool calls, at runtime, not reviewed after the fact. That enforcement produces audit-ready evidence mapped to NAIC and other frameworks, so a compliance team can show what a claims AI system was permitted to do and what it did. Trussed can be self-managed in the customer cloud, with configurable retention and data residency.

This addresses the runtime and evidence portion of the mapping only. It does not write the AIS Program, assess risk, perform vendor diligence or run bias testing, and those remain with the insurer.