NAIC AI Model Bulletin and Lapse Prediction Models: Scope and Evidence

How the bulletin's scope reaches retention and lapse models

The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. It is principles-based guidance. Its central reminder is that decisions or actions impacting consumers that are made or supported by advanced analytical and computational technologies, including AI, must comply with all applicable insurance laws and regulations.

The bulletin's definition of a predictive model is functional. It describes mining historic data with algorithms or machine learning to identify patterns and predict outcomes that can be used to make or support decisions. A lapse score, a retention propensity score or a persistency forecast can meet that description. The definition alone does not settle the question, though. The bulletin's reach depends on whether the decision the model makes or supports impacts consumers.

That is why the useful question is not whether retention models are covered. It is which retention and lapse models, in which uses, make or support consumer-impacting decisions. Carriers and brokerages should expect different answers for different models.

Factors that determine whether a given model is in scope

Scope follows the model's use, not its name. The same lapse score can be an input to a dashboard in one workflow and a trigger for differentiated treatment in another. Document the determination for each use.

• Downstream action: Whether the output triggers outreach, an offer, a servicing path or a change in how a policyholder is treated, or only feeds aggregate reporting.
• Human role: Whether staff review the score before acting, or the action follows automatically. The bulletin covers decisions made or supported by AI.
• Consumer impact: Whether the resulting treatment affects what a consumer is offered, pays or receives, which is where pricing-adjacent offers need careful reading.
• Input data: Whether the model uses consumer information, which raises information protection and unfair discrimination questions.
• Origin of the model: Whether the model is built internally or supplied by a third party, which determines the vendor oversight needed.
• State of operation: Which states the business is written in and what each state adopted.

Governance expectations for an in-scope model

Insurers are expected to develop and maintain a written program for the responsible use of AI. For predictive models, the bulletin text expects documented processes and procedures for designing, developing, verifying, deploying, using, updating and monitoring them. These include methods to detect and address errors, performance issues, outliers or unfair discrimination in the insurance practices that result from the model's use.

Management and oversight provisions call for inventories and descriptions of predictive models and detailed documentation of their development and use. They also reference reproducibility, traceability, model drift and auditability of these measurements where appropriate. That qualifier allows risk-proportionate treatment, so a model with limited consumer impact can carry lighter controls, provided the proportionality decision is recorded.

The inventory is the practical starting point. A retention or lapse model that is not listed cannot be shown to be in or out of scope. Validation is the second pillar. The text refers to validating, testing and retesting to assess how outputs generalize after implementation, including comparing post-implementation performance with performance at development. That implies retaining performance data over time.

Third-party tools need separate attention. NYDFS Circular Letter 7 carries a clause drawn from the NAIC bulletin on contract terms with third-party vendors, where appropriate. Vendor-supplied lapse or retention scoring should be reviewed against that expectation.

State adoption and related regimes as of October 2026

The model bulletin takes effect only through state action. The NAIC's implementation map, current as of August 2026, lists state bulletins with adoption dates running from Feb. 1, 2024 (Alaska) to Feb. 11, 2025 (New Jersey) among the listed jurisdictions. The map does not determine whether a state's action contains every element of the model, so each operating state's adopted text should be read directly.

NYDFS Insurance Circular Letter No. 7, issued July 11, 2024, is titled Use of AI Systems in Insurance Underwriting. Its stated expectations address underwriting and pricing. For New York-regulated business, offers or servicing uses that sit close to pricing should be assessed against that framing case by case.

Colorado's position has changed. SB 24-205 created protections from algorithmic discrimination in consequential decisions made by high-risk AI systems. According to the Colorado Attorney General, SB 26-189, signed in May 2026, repeals and reenacts those provisions with new requirements for automated decision-making technology in consequential decisions. Treat the earlier SB 24-205 requirements as superseded and track the new ones rather than planning to them.

Where runtime policy enforcement produces evidence

Most items above are design-time and periodic records. The gap many carriers report is the record of use: what a model or tool was permitted to do on a given interaction, and what it did. A control that sits in the execution path can address that gap for the interactions it sees, which is an inference from the bulletin's emphasis on documenting use and monitoring, not a requirement the bulletin states.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers. Each interaction or tool call is allowed, redacted, blocked, rate limited or escalated for human approval, enforced at runtime, not reviewed after the fact. That enforcement generates audit-ready evidence mapped to NAIC, NYDFS and other frameworks. For a retention workflow, this could mean a policy that blocks a tool call exposing consumer data or escalates an unusual action for human approval, with the decision recorded. Its scope is individual interactions and tool calls. It does not replace the inventory, validation or vendor documentation above, and it does not establish model provenance or lineage.

When evaluating any such control, ask four questions. Does it sit in the path of the interactions your retention models and tools actually use? Which policy decisions does it record? Can retention and data residency be configured to match your exam obligations? Can it be deployed in your own cloud? Trussed supports self-managed deployment in the customer cloud, with configurable retention and data residency, and operates in insurance among its regulated verticals.