NAIC AI Model Bulletin vs CCPA ADMT Regulations for Insurers

Two different kinds of instrument

The NAIC describes its bulletin as "not a model law or regulation." It is a guiding document meant to foster uniformity among state insurance regulators, and it takes effect only where a state department of insurance issues its own bulletin or equivalent. As of October 2026, the NAIC adoption map (status date August 6, 2026) lists at least 16 jurisdictions, including Alaska, Connecticut, Delaware, Illinois, Maryland, New Jersey and North Carolina. The map does not determine whether a state's action contains every model element, so each operating state needs its own check.

The bulletin reminds insurers that decisions or actions affecting consumers, when made or supported by advanced analytical and computational technologies including AI Systems, must comply with all applicable insurance laws, including unfair trade practices. It expects a written AIS Program commensurate with assessed risk and designed to mitigate Adverse Consumer Outcomes.

The CCPA ADMT rules come from the California Privacy Protection Agency. They sit within regulations covering ADMT, risk assessments, cybersecurity audits and insurance, which took effect on January 1, 2026. A business already using ADMT for a significant decision must comply by January 1, 2027. A business that starts using it on or after that date must comply from the first use. The CPPA has said its 2025 rulemaking clarified when insurance companies must comply with the CCPA.

Side-by-side comparison

The table separates what each regime asks for. The NAIC bulletin is organized around a program and the documents behind it. The CCPA rules are organized around consumer-facing duties and the records of how those duties were met.

• Legal source and regulator: NAIC: model guidance, issued through state insurance department bulletins. CCPA: Title 11 CCR regulations adopted by the CPPA Board and in effect since January 1, 2026.
• Scope trigger: NAIC: decisions or actions impacting consumers that are made or supported by AI Systems. CCPA: ADMT used for a significant decision, narrowed in the final rules to higher-risk use without human involvement.
• Core obligations: NAIC: written AIS Program, risk management controls, governance and third-party oversight. CCPA: Pre-use Notice, opt-out and access rights, with risk assessments addressed in the same regulations.
• Consumer rights: NAIC: no new consumer rights, but compliance with existing insurance law including unfair trade practices. CCPA: right to opt out of ADMT for a significant decision, subject to exceptions, and a right to access ADMT.
• Documentation and evidence: NAIC: documentation a department may request in an examination, including due diligence on third-party data, models and AI Systems. CCPA: records of consumer requests and responses kept at least 24 months.
• Exemptions and overlap: NAIC: applies through insurance law. CCPA: the CPPA states that CCPA exemptions apply to the regulations, and exempted data carries no obligations. Non-exempt personal information does.

Which insurance AI use cases trigger which regime

Classify each AI-enabled function against two separate questions. First, is it a decision or action affecting consumers that is made or supported by AI? If so, it is within the NAIC bulletin's reach in any state that has issued a bulletin. Second, is it ADMT used for a significant decision without meaningful human involvement, and does a CCPA exemption cover the data involved? Only if both answers point to coverage do the CCPA notice, opt-out and access duties follow.

The two questions produce different answers for the same use case. An underwriting model that supports a human underwriter can fall under NAIC expectations while sitting outside CCPA ADMT. The same model operating without meaningful human involvement raises the CCPA question. Claims triage, fraud detection, marketing and customer service can be sorted the same way. Customer service and marketing tools often touch consumers without making significant decisions. Underwriting, claims and fraud use cases are more likely to approach significant decisions, but the outcome depends on the regulatory definition, the degree of human involvement and how exemptions apply to the data. Counsel should confirm each classification.

Human involvement has a specific meaning in the final regulations. The reviewer must know how to use and interpret the output, review it alongside other relevant information, and have authority to make or change the decision. A approval click that does not meet that standard should not be treated as removing a use case from ADMT scope.

What can be enforced at runtime and what cannot

Runtime enforcement acts on individual interactions and tool calls in the AI execution path. Typical actions are allow, redact, block, and escalate for human approval. These actions suit controls that must hold on every interaction: restricting which data a model or tool can receive, redacting personal information before it leaves a boundary, blocking calls outside an approved use case, and routing defined decision types to a reviewer. They also produce a per-interaction record of the policy applied, which serves the NAIC expectation for examinable documentation.

Much of the CCPA ADMT regime is not an execution-path problem. Pre-use Notice must be prominent and conspicuous at or before collection, and must explain the specific purpose in plain language. Opt-out methods, access request channels and the 24-month request records are consumer-request processes. Keep notice delivery, opt-out status and request fulfilment as systems of record outside the AI path. Runtime controls can consume opt-out status to decide how an interaction is handled, but they do not replace those records.

The NAIC side is split in the same way. The written AIS Program, governance ownership, risk assessment and third-party due diligence are organizational. Runtime enforcement supplies evidence that the program's rules were applied to actual interactions. It does not replace the program, and it does not show that a model is unbiased.

How runtime enforcement produces evidence for NAIC expectations

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants, with actions that include allow, redact, block, rate limit and escalate for human approval. Because enforcement happens at runtime, not reviewed after the fact, each decision generates audit-ready evidence as a by-product. That evidence is mapped to NAIC expectations, alongside HIPAA, NYDFS, the EU AI Act and NIST, which helps a compliance team answer an examiner's request for what the AI was allowed to do and what it did.

This addresses the documentation side of the NAIC bulletin. It does not write the AIS Program, run notices or opt-out handling, or perform the CCPA risk assessment. Those remain organizational work. Trussed deploys self-managed in the customer cloud, with configurable retention and data residency, so evidence can stay under the insurer's control and be held for the periods its own obligations require. Trussed is used in insurance and three other regulated verticals, and this page is not legal advice.