How the NAIC AI Model Bulletin Applies to Policy Servicing and Renewal AI

What the Bulletin reaches in servicing and renewal

The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023. It is a template that a state department of insurance can issue to remind insurers holding certificates of authority that decisions or actions impacting consumers, made or supported by advanced analytical and computational technologies including AI Systems, must comply with all applicable insurance laws and regulations.

Two features of that language matter for servicing and renewal. First, the Bulletin states that AI techniques are deployed across the insurance life cycle and names policy servicing explicitly, alongside underwriting and pricing, claim management and fraud detection. Servicing is not an afterthought in the text. Second, the phrase "made or supported" suggests that AI which informs a human decision can fall within scope, not only fully automated decisions. That is our reading of the text, and a human reviewing an output does not by itself remove a use case from consideration.

The Bulletin also lists risk considerations that apply directly here: the extent to which humans are involved in the final decision, the transparency and explainability of outcomes to the impacted consumer, and the extent of reliance on data, Predictive Models and AI Systems from third parties. Each of these can be answered per use case, and each depends on evidence of how the system behaves.

Scoping common servicing and renewal use cases

The Bulletin does not classify individual use cases, so the insurer decides and documents the outcome. The question to ask of each use is whether it makes or supports decisions that can result in Adverse Consumer Outcomes. Draft examination guidance refers to inventories scoped to that criterion, so the answer should be recorded, including for uses judged out of scope.

• Renewal pricing or eligibility inputs: Most likely to make or support consumer-impacting decisions. Expect Predictive Model oversight, validation and testing documentation.
• Coverage change handling: Scope depends on whether the AI determines or recommends an outcome that affects the consumer's coverage or terms.
• Conversational servicing assistant: Scope depends on what it can do. Answering general questions differs from changing a policy or calling a transaction tool.
• Renewal notice generation: Consider whether generated content shapes consumer decisions and how explainable the outcome is to the consumer.
• Document intake and processing: Scope depends on whether extracted data feeds a decision. Record the downstream use, not only the extraction step.

Translating Bulletin expectations into runtime controls

The Bulletin expects an AIS Program with governance, risk management and internal controls, and documentation proportionate to risk. Written policy satisfies part of this. The gap appears when an examiner asks about a specific interaction and the insurer can describe the policy but cannot show its application.

For Predictive Models, the Bulletin refers to processes for designing, developing, verifying, deploying, using, updating and monitoring, including methods to detect and address errors, performance issues, outliers or unfair discrimination. Its model oversight provisions call for inventories, detailed documentation of development and use, and assessments of reproducibility, traceability, model drift and auditability where appropriate. Draft examination guidance adds that validation, testing and auditing should reflect the underlying components, whether Predictive Model or generative. A renewal pricing model and a servicing assistant therefore need different testing evidence.

At runtime, this translates into a small set of records. For each interaction, an examiner would want to see which AI system acted, what inputs and tools it used, which policy version applied, and what outcome followed: allowed, redacted, blocked or escalated. Where a human approved, modified or overrode an output, the record should show who and what the result was, because the Bulletin treats human involvement as a risk factor. The Bulletin does not prescribe this format. It is a practical way to make traceability and auditability demonstrable.

Third-party vendors, state adoption and related regimes

Many servicing and renewal tools run on vendor-hosted models or use vendor data. The Bulletin's third-party reliance factor applies to them, and the insurer remains responsible for how they are used. Enforcement and evidence should therefore cover calls to external models and tools, not only in-house systems. Oversight evidence for a vendor use case should be as retrievable as evidence for an internal one.

The Bulletin is a model, and states issue it individually, so obligations depend on where the insurer holds authority. As of October 2026, one public tracker reports 27 states plus the District of Columbia and Puerto Rico as having adopted guidance, with issuance dates across 2024 to 2026. That figure is cumulative and not a 12-month increment, so confirm status directly for each state in which you write business.

NYDFS Circular Letter 7 and Colorado SB 24-205 are separate regimes with their own scope and obligations. They should be assessed independently of the Bulletin and mapped to the same use-case inventory, so that one set of runtime evidence can be shown against each regime where it applies.

Where policy enforcement in the execution path fits

Evidence reconstructed after the fact from application logs usually shows what happened but not what was permitted. Enforcing policy in the execution path closes that gap, because the control decision is made before a model response is delivered or a tool call executes, and the decision itself becomes the record.

Trussed enforces policy in the execution path across models, agents, tools and MCP servers, with allow, redact, block, rate limit and escalate-for-human-approval actions applied to individual interactions and tool calls. That enforcement generates continuous, audit-ready evidence mapped to NAIC and other frameworks, and it can be deployed self-managed in the customer cloud with configurable retention and data residency. Retention periods, escalation criteria and thresholds remain insurer decisions.

This addresses the runtime layer only. Scoping decisions, validation and testing of Predictive Models, vendor due diligence and AIS Program governance still need to be documented by the insurer. Runtime evidence is what lets those documents be tested against actual conduct.