Does the NAIC AI Bulletin Apply in States That Have Not Adopted It?

What the model bulletin is, legally

The NAIC membership adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers at its 2023 Fall National Meeting, with an adoption date of December 4, 2023. NAIC describes it as not a model law or regulation. It is a guiding document meant to foster uniformity among state regulators on what they expect from carriers deploying AI.

The model text is a template. It is addressed to all insurers licensed to do business in a jurisdiction, with a placeholder for the state's name, and it is meant to be issued by a state department. When issued, it reminds insurers holding certificates of authority that AI-supported decisions affecting consumers must comply with all applicable insurance laws and regulations. It sets out the department's expectations for governing the development, acquisition and use of AI systems, including a written AIS Program commensurate with an assessment of risk. It also tells insurers what information and documentation a department may request during an investigation or examination.

The mechanism matters. The NAIC publishes the model, and a state department decides whether and how to issue its own version. State dates vary. Alaska's bulletin is dated February 1, 2024 and Delaware's February 5, 2025. NAIC's adoption map tracks state action, but it states that it does not determine whether a state's version contains all elements of the model. State versions can also use different definitions.

Binding, persuasive and operational: separating the layers

Compliance programs get inconsistent when these layers are blended. The table below keeps them apart for a state that has not issued a bulletin and for one that has.

• Binding: Existing state insurance statutes and regulations, which NAIC says apply whether a decision is made by a human, an algorithm or a third-party vendor. In an adopting state, the department's own bulletin or guidance adds its stated expectations.
• Persuasive: The NAIC model text and regulator signals. In a non-adopting state, the model shows what many departments expect, but it does not create an obligation by itself.
• Operational practice: A carrier's decision to hold every state to one governance and evidence standard. It simplifies the program and is not mandated by the model.

Authority regulators can use where the bulletin is not adopted

A department without its own AI bulletin still holds the statutes it already enforces. The bulletin's expectations rest on existing law, including the Unfair Trade Practices Model Act (#880) and the Unfair Claims Settlement Practices Model Act (#900), as implemented by each state's corresponding statute or regulation. They also draw on the Corporate Governance Annual Disclosure Model Act (#305). Those laws exist whether or not a state issues the bulletin. NAIC's own materials state that its framework relies on existing legal authority, data-driven oversight and governance expectations.

In practice, an AI inquiry in a non-adopting state would be framed through those existing laws and the department's examination and investigation powers. The question would be whether an underwriting, claims or pricing decision supported by AI complies with unfair trade practice and claims settlement requirements, not whether the carrier followed the model bulletin. Because the laws apply to decisions made by or on behalf of the insurer, vendor-supplied systems are not outside the question.

Regulators are also asking AI questions before any bulletin question arises. At a July 2025 NAIC working group meeting, the chair noted that Pennsylvania was asking AI questions at the front end of financial exams, and that the group wanted to discuss a more uniform approach with other states. The same group raised the possibility of an additional bulletin or new model legislation on transparency and accountability, so expectations may continue to move. The specific statutes and examination procedures differ by state, so counsel should confirm them for each jurisdiction.

Overlapping regimes and why many carriers use one baseline

NYDFS Circular Letter 7 and Colorado SB 24-205 sit alongside the NAIC model and add their own obligations. They should be assessed on their own text and scope, not folded into an assumption that the NAIC bulletin covers them. Where a carrier writes in those jurisdictions, the program needs a record of what each regime adds beyond the baseline.

Many multi-state carriers and brokerages still choose to apply the bulletin's expectations everywhere. The reasoning is operational. A written AIS Program, defined governance, vendor oversight and documentation that can be produced on request are expectations that map to laws every state already enforces. Maintaining one standard avoids separate programs per state and reduces the chance of holding different evidence for the same underwriting, claims or pricing system depending on where a policyholder lives.

The tradeoff is that a single baseline can exceed what a given state requires, and it must still be reconciled against state-specific wording. The decision should be documented as a design choice, with the reasoning recorded and any state that issues different or additional requirements noted. As of October 2026, adoption status continues to change, so the jurisdiction view needs periodic review.

Demonstrating the baseline on request: where Trussed fits

A baseline is only useful if a carrier can show it operating. The hard question from a regulator is usually specific: what was this AI system allowed to do, and what did it do? Written policy answers the first half. Evidence from the running system answers the second.

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Enforcement is at runtime, not reviewed after the fact, and each action is allow, redact, block, rate limit or escalate for human approval. The scope is individual interactions and tool calls. That enforcement generates continuous, audit-ready evidence mapped to NAIC, NYDFS, HIPAA, the EU AI Act and NIST, which lets a carrier hold one evidence set against a single baseline instead of assembling a different record per state.

Trussed is self-managed in the customer's cloud, with configurable retention and data residency. It runs in production for customers in four regulated verticals, including insurance, with 100+ models under one policy plane and 99.95% uptime on live production traffic. Trussed does not replace the legal analysis, the jurisdiction matrix or the AIS Program. It supplies the enforcement and evidence that make those documents demonstrable.