NAIC AI Model Bulletin vs Illinois DOI AI Bulletin: Key Differences

How the two documents relate

The NAIC Model Bulletin was adopted at NAIC's 2023 Fall National Meeting. NAIC describes it as a guiding document that fosters uniformity among state regulators on expectations for carriers deploying AI. It carries no force by itself. Each state issues its own bulletin, and NAIC's implementation map lists Illinois as Company Bulletin 2024-08, adopted March 13, 2024.

For a compliance team, this means the comparison is not between two independent regimes. The Illinois bulletin is the state's implementation of the model, so the model's architecture is the right baseline. The practical question is where state text restates the model and where it adapts it. The model's own drafting history anticipates the latter: a drafting note in the tracked-changes version observes that individual states may have adopted their own definitions of terms used in the bulletin. Definitions are therefore the first place to look for state variation.

Both documents rest on the same premise. Decisions or actions that affect consumers, whether made or supported by advanced analytical and computational technologies including AI Systems, must comply with all applicable insurance laws and regulations. The bulletin does not create a separate AI rulebook. It states how regulators expect carriers to demonstrate compliance when AI is involved.

Side-by-side by requirement area

The table is organized by requirement area rather than by document. The model column reflects the NAIC text and its drafting history. The Illinois column reflects Illinois's status as a listed implementer of that model.

• Legal status: NAIC model: guidance adopted Dec. 4, 2023; not a model law or regulation. Illinois: Company Bulletin 2024-08, adopted Mar. 13, 2024, listed as implementing the model.
• Scope: NAIC model: decisions or actions made or supported by advanced analytical and computational technologies, so decision-support AI is in scope. Illinois: apply the same scope baseline to Illinois business, using the state text as the controlling wording.
• Definitions: NAIC model: defined terms, with a drafting note that states may adopt their own. Illinois: maintain a state-specific definitions check rather than assuming identical terms.
• Written program: NAIC model: a written AIS Program designed to mitigate the risk of Adverse Consumer Outcomes, tied at minimum to the statutory provisions in Section 1. Illinois: one program mapped to the model structure can serve as the common base.
• Third parties: NAIC model: defines Third-Party and extends governance to AI acquired from others. Illinois: apply the same oversight posture to vendor-supplied systems used in Illinois.
• Examination and documentation: NAIC model: Section 4 describes information and documents a Department may request in an AI-focused investigation, including a market conduct action. Illinois: prepare the same evidence set for Illinois examinations.

Governance program and examination expectations

The model sets out how the Department expects insurers to govern the development, acquisition and use of certain AI technologies. The written AIS Program is the centerpiece. It is designed to mitigate Adverse Consumer Outcomes, and it is anchored to statutory provisions such as unfair trade practices. NAIC materials also encourage verification and testing methods to identify errors and bias, and to assess the potential for unfair discrimination in predictive models and AI systems.

Section 4 is where governance becomes evidence. It advises insurers what information and documentation a Department may request. Earlier drafts of the model give a useful picture of the categories. They describe requests for inventories and descriptions of algorithms, predictive models and AI Systems that make or support consumer-impacting decisions, and for documentation of compliance with AI Program policies, protocols and procedures. Draft language also refers to data source, provenance and data lineage for a specific model under examination, and to protection of non-public information, including unauthorized access to the algorithms or models themselves. These draft points should be treated as indicators of regulator focus, not as final text.

The drafts also indicate that an insurer can expect questions on governance framework, risk management and internal controls whether or not a written program exists. NAIC has since published an AI Systems Evaluation Tool, version 4.0, whose terms follow the Model Bulletin where available. Examiners are working from tooling aligned to the model's vocabulary.

Third-party oversight and multistate variation

The model defines Third-Party as an organization other than the insurer, and earlier draft language extends governance to systems used by or on behalf of the insurer. The practical consequence is that a vendor-hosted underwriting model, a claims triage service or a customer-facing assistant belongs in the same inventory and under the same program as an internally built system. Whatever the contract terms, the carrier is the party examined, so it needs its own record of what each third-party system was permitted to do and what it did.

State variation is the other planning factor. As of October 2026, NAIC's implementation map, with a status date of August 6, 2026, lists at least 19 states as implementing the model, including Illinois, with adoption dates running from February 1, 2024 to March 18, 2025. California appears separately, with a bulletin issued June 30, 2022, before the model existed. Non-listed states should not be assumed to have no AI expectations, and the map may be updated.

For a carrier or brokerage operating across states, the efficient approach is a single baseline program mapped to the model, with a state layer for definitions and any adapted language. That avoids building separate programs while keeping the state bulletin as the controlling text for each jurisdiction.