NAIC AI Model Bulletin Use Case Classification: A Consumer-Impact Method for Insurers

What the bulletin requires and what it leaves to you

The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. It takes effect only through state adoption. NAIC's adoption map, as of August 2026, lists bulletins adopted by 19 states and DC, with operative dates that vary by state. Confirm which bulletin governs each state where you write business, and whether that state added its own requirements.

The bulletin reminds insurers that decisions or actions affecting consumers, when made or supported by advanced analytical and computational technologies including AI Systems, must comply with all applicable insurance laws. It expects the AIS Program to cover AI across the insurance life cycle: product development and design, marketing, underwriting, rating and pricing, case management, claim administration and payment, and fraud detection. Its listed risk-assessment considerations include how far humans are involved in the final decision, the transparency and explainability of outcomes to the impacted consumer, and the extent of reliance on third-party data, predictive models and AI Systems.

What it does not provide is a tier structure. Any tier names in this guide are illustrative. Your method has to be one you can explain to an examiner and apply the same way each time.

One comparator has changed. Colorado reports that SB 26-189, signed in May 2026, repeals and reenacts the provisions of SB 24-205 with new requirements for automated decision-making technology in consequential decisions. As of October 2026, do not treat SB 24-205 duties or definitions as current. Use Colorado as a reference for consequential decisions only after the reenacted requirements are settled.

Step 1: Define the inventory unit

Pick a unit that can answer the questions a regulator is likely to ask without rework. The NAIC AI Risk Evaluation Supplement requests a listing of models with the model name, how the model is used, the broader use case, the operation or program area, consumer impact and financial impact. That suggests the unit is the model together with the use case it sits in, not the model alone.

A single vendor model deployed in claims and in marketing is two inventory records, because the consumer impact differs. Include vendor and third-party models, and include areas beyond underwriting and pricing, since the bulletin names marketing, case management, claims and fraud detection.

• Use case name and owner: A named business owner accountable for the use case and for requesting re-tiering when it changes.
• Model and description of use: The model or system, whether internal or third-party, and how it is used.
• Program area: Underwriting, pricing, claims, fraud detection, marketing, customer service or another life-cycle area.
• Decision role: Whether the output informs, augments or automates a decision about a consumer.
• Human involvement: Who reviews the output, at what point, and with what authority to override.
• Tier and rationale: The assigned tier, the criteria behind it, the approver and the date.

Step 2: Select criteria and assign tiers

Start with a screen the NAIC already applies. For its supplement responses, models that augment or automate decision-making related to consumers are considered to have direct consumer impact. That test is a response convention, not a bulletin-wide rule, but it is a sound first gate. A use case that passes it should not land in the lowest tier without a documented reason.

Then score against the bulletin's factors: the extent of human involvement in the final decision, transparency and explainability to the consumer, and reliance on third-party data and models. Many carriers will add criteria of their own, such as the nature of the decision, the potential for adverse consumer outcomes, and unfair discrimination risk. Document these as your own criteria, tied to the bulletin's language on adverse consumer outcomes and to your state's adopted text.

Keep the scoring rules simple enough to be repeatable. Two reviewers given the same record should reach the same tier. Where judgment is required, record the reasoning on the inventory record, because the rationale is what an examiner will test.

The supplement also seeks detail on in-production high-risk models, for example those making automated decisions that could cause adverse consumer outcomes. Your top tier should be defined so that every such model falls into it.

Illustrative tiers applied to common use cases

The tiers below are an example, not a regulatory scheme. The same use case can move between tiers depending on how its output is used, which is why the decision role and human involvement fields matter more than the use case label.

• Tier 1: Direct consumer impact: Augments or automates decisions on coverage, price or claim outcome, or has limited human review. Examples: underwriting decision support, pricing models, claim denial recommendations, fraud scores that trigger claim holds.
• Tier 2: Indirect consumer impact: Influences outcomes but a qualified person makes and can override the decision. Examples: claims triage routing, fraud alerts reviewed by an investigator, marketing audience selection.
• Tier 3: Limited consumer impact: Consumer-facing or internal assistance with no decision role. Examples: general customer service answers, document drafting, internal summarization.

Step 3: Map each tier to proportionate controls

Tiering matters only if it changes what happens next. Controls at the tier level include pre-deployment review depth, approval authority, vendor contract terms, monitoring, and escalation paths. NYDFS Circular Letter 7, issued July 11, 2024, adds a related expectation: comprehensive documentation of AI systems and the external data and information sources they rely on, whether internal or third-party, available to the Department on request. The final letter also adds a clause drawn from the NAIC bulletin on contract terms with third-party vendors, where appropriate.

Some of these controls can be enforced in the execution path. Trussed enforces policy at runtime on individual interactions and tool calls: allow, redact, block, rate limit, or escalate for human approval. As an illustrative mapping, a Tier 1 policy might escalate any output that would affect a coverage, price or claim outcome for human approval, block actions outside the approved scope, and redact personal data sent to external models. A Tier 2 policy might allow routine use within scope, redact sensitive fields, and escalate exceptions. A Tier 3 policy might allow general assistance, redact personal data, and block responses that read as coverage or claim determinations.

Each enforced decision produces audit-ready evidence mapped to NAIC and NYDFS expectations. If the evidence carries the inventory's use case and program area as keys, an examiner can trace from classification to the control applied to a specific interaction.

Two limits apply. Enforcement does not decide the tier. Inventory and classification are the carrier's responsibility and sit outside the execution path. Enforcement also operates at the level of individual interactions and tool calls, so it does not replace your model validation, vendor due diligence or governance review.

Operating the method over time

Classification decays as use cases change. Assign an owner for each record and define the triggers that force re-tiering: a new data source, a change from augmenting to automating a decision, a new vendor model, expansion into another state or program area, or reduced human review. Review the criteria themselves when a state bulletin or related guidance changes.

• Default upward under uncertainty: If decision role or human involvement is unclear, assign the higher tier until documented otherwise.
• Separate approval from ownership: The business owner proposes the tier and compliance approves it.
• Test the trace: Periodically pick one use case and walk from its inventory record to its controls and evidence, as an examiner would.