First Actions for an Insurance Compliance Lead Under the NAIC AI Model Bulletin

What the bulletin expects of an AIS Program

The bulletin reminds insurers holding certificates of authority that decisions or actions affecting consumers, made or supported by advanced analytical and computational technologies including AI Systems, must comply with all applicable insurance laws and regulations. The AIS Program is meant to mitigate the risk of Adverse Consumer Outcomes. It spans governance, risk management and internal controls, and oversight of third-party AI Systems and data.

For Predictive Models, the text covers how the insurer designs, develops, verifies, deploys, uses, updates and monitors them. That includes methods to detect and address errors, performance issues, outliers or unfair discrimination. Model oversight includes inventories, descriptions, detailed documentation of development and use, and, where appropriate, reproducibility, traceability, model drift and the auditability of those measurements.

The NAIC adopted the model on December 4, 2023. States issue their own bulletins, and operative dates and form are set by each state. Alaska issued the first on February 1, 2024, and 24 states had adopted by August 2025. The bulletin states expectations but does not prescribe an order of work, so the sequence below is a practitioner's starting plan.

Where documentation ends and runtime enforcement begins

Some expectations are met by documents: the inventory, role assignments, the written AIS Program, and procedures for acquiring and relying on third-party systems. A reviewer can read these and confirm they exist.

Other expectations are about behavior. Detecting errors, performance issues and outliers, monitoring drift, and showing traceability cannot be demonstrated by a policy document alone. They need records generated while the system operates. The bulletin does not say which technical records satisfy these expectations, and it does not require runtime enforcement. That is a practitioner inference: if examiners can ask for compliance records against AIS Program procedures, a procedure that no control enforces leaves a gap between what the policy says and what the evidence shows.

One design response is to enforce policy at the level of individual interactions and tool calls, with outcomes such as allow, redact, block or escalate for human approval. Each decision then produces a record. This is an organizational design choice, not a bulletin requirement. It matters most where AI touches consumer data or supports decisions in underwriting, pricing or claims.

Map expectations to control types

A simple mapping table keeps the program honest. For every expectation, state whether documentation is enough or whether technical evidence is needed, and name the artifact an examiner would receive.

• Inventory and descriptions of models: Documentation. Artifact: maintained inventory with owners, descriptions and vendor status.
• Governance and accountability: Documentation. Artifact: AIS Program document, role assignments, review records.
• Validation and testing of model outputs: Technical evidence. Artifact: test and validation results retained by AI use case.
• Detecting errors, outliers, drift and unfair discrimination: Technical evidence. Artifact: monitoring records over time, with the actions taken.
• Compliance with AIS Program procedures in use: Technical evidence where procedures can be enforced. Artifact: records of what was permitted, changed or stopped.
• Third-party AI systems and data: Both. Artifact: vendor documentation, acquisition process records, and records of how vendor systems are used.

Third-party oversight and the examination evidence set

Insurers should expect questions about their AIS Program during investigations and market conduct actions, so documentation should be retained. That includes documentation on AI systems, data and predictive models developed by third parties. The NAIC's evaluation materials ask about third-party AI Systems and data, and about the process for acquiring, using or relying on them. An examiner may therefore ask about vendor models and vendor data separately.

For carriers and brokerages, a workable first phase is modest. List every third-party AI system and dataset in use. For each, record what it does, what data it receives, what documentation you hold, and who approved reliance on it. Then check whether you can show how the system is used in operation, not only how it was purchased.

The examination evidence set can then be defined by use case: AIS Program documents, the model inventory, development and use documentation, testing and validation results, monitoring records, and compliance records against AIS Program procedures. Retrieval by AI use case is the practical test. If assembling the set for one underwriting model takes weeks, the retention design needs work before an examiner asks.

Where Trussed fits

Trussed addresses the enforcement and evidence steps, not the inventory or the written program. It enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants, with allow, redact, block, rate limit and escalate for human approval applied to individual interactions and tool calls. Enforced at runtime, not reviewed after the fact, each decision generates audit-ready evidence mapped to NAIC expectations, alongside other regimes such as NYDFS and NIST.

It deploys self-managed in the customer cloud, with configurable retention and data residency, which bears on where evidence lives and how long it is kept. Trussed has run in continuous production in a regulated enterprise for more than 18 months, and serves customers in insurance, pharma, healthcare and education. Teams that choose a different enforcement design can use the same sequence above to evaluate it.