NAIC AI Model Bulletin vs ISO/IEC 42001: Which Do Insurers Need?

What each one is

The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers was adopted by NAIC members at the 2023 Fall National Meeting. The NAIC states plainly that it is not a model law or regulation. It is a guiding document meant to foster uniformity among state insurance regulators about what they expect from carriers using AI. It takes effect only where a state issues its own bulletin. As of October 2026, the NAIC implementation map lists 18 jurisdictions: AK, AR, CT, DE, DC, IL, IA, KY, MD, MA, MI, NV, NH, NJ, NC, OK, RI and VT. The map does not determine whether a state's bulletin contains every element of the model.

The bulletin reminds insurers that decisions or actions affecting consumers, when made or supported by AI and other advanced analytical technologies, must comply with all applicable insurance laws, including unfair trade practices law. It expects a written program for the responsible use of AI, designed to mitigate the risk of Adverse Consumer Outcomes.

ISO/IEC 42001:2023, published in December 2023, specifies requirements for establishing, implementing, maintaining and continually improving an AI management system. It is a standard, not a law, and it applies to organizations of all sizes and sectors. Certification is voluntary. Organizations choose it when they want independent confirmation that their management system meets the standard.

Side-by-side comparison

The differences are easiest to see across a few dimensions that matter to a compliance owner.

• Nature: Bulletin: supervisory expectation tied to insurance law compliance. ISO/IEC 42001: voluntary international standard.
• Who applies it: Bulletin: each state insurance department that issues its own bulletin. ISO/IEC 42001: the organization, with optional certification by an independent body.
• Scope: Bulletin: insurers' development, acquisition and use of AI Systems, focused on consumer outcomes. ISO/IEC 42001: an organizational management system covering policies, objectives and processes for AI.
• Core obligation: Bulletin: a maintained written program that mitigates Adverse Consumer Outcomes. ISO/IEC 42001: establish, implement, maintain and continually improve an AI management system.
• Examination: Bulletin: departments may request governance, risk, control and model documentation. ISO/IEC 42001: certification confirms the management system, not individual systems.
• Evidence type: Bulletin: inventories, development and use documentation, and measures such as traceability and drift. ISO/IEC 42001: management system records and audit results.

Where they overlap and where they diverge

The overlap is organizational. Both expect a documented, owned and maintained approach to AI instead of ad hoc use. A written AI program under the bulletin and a management system under ISO/IEC 42001 both depend on defined policies, assigned accountability and ongoing review. ISO also makes impact assessments a required part of AI governance, and it positions ISO/IEC 42005 as the companion standard for conducting them. An insurer that already operates a management system will often find that part of the bulletin's program expectations is easier to document.

The divergence is in authority and in the evidence each one points toward. The bulletin comes from insurance regulators and is tied to unfair trade practices and other insurance laws. A regulator can ask about it during an investigation or examination. ISO/IEC 42001 certification is a business decision. It can reassure customers, partners and boards, but no examiner is required to accept it in place of the documentation the bulletin lists.

The bulletin is also specific to consumer impact in insurance. ISO/IEC 42001 is deliberately sector-neutral. That makes it portable, but it means the insurance-specific questions, such as unfair discrimination in underwriting or claims, still need to be answered in your own program.

Third-party systems and evidence of operation

The bulletin refers to the development, acquisition and use of AI Systems, so systems an insurer buys fall inside the governance expectation alongside systems it builds. Practically, a vendor's scoring model, a claims triage tool or an embedded generative assistant belongs in the same inventory and evidence set as an internal model. Accountability for the written program stays with the insurer.

The bulletin also lists what a department may request: inventories and descriptions of predictive models, detailed documentation of their development and use, and measurements of reproducibility, traceability, model drift and auditability where appropriate. These are system-level records. A management-system certificate confirms that the organization has a conforming process. It does not contain a record of what a specific model did on a specific day, and ISO's certification materials do not describe it as evidence of an individual system's runtime behavior.

That gap is where examinations tend to become difficult. A policy states what should happen. Regulators may ask what did happen, for which system, and under which control. Governance records therefore need to trace to individual AI Systems, not only to the organization-wide program.

Deciding which you need

Start with exposure. Identify the states where you are domiciled and licensed, check whether each has issued a bulletin, and read each state's own text, since adoption of the model is not uniform by default. If you operate in one or more bulletin states, the bulletin's expectations apply regardless of any certification decision.

Then decide whether ISO/IEC 42001 adds value. It is reasonable where you want a structured management system, independent confirmation of it, or a common framework across business lines beyond insurance. Treat it as optional assurance on the management system. Before relying on it for examination readiness, check that the program it produces also yields the model-level evidence the bulletin lists. Many insurers will reasonably conclude they need the bulletin response and may choose ISO/IEC 42001 as a complement.

The operational question is the same either way: can you show what your AI systems were allowed to do and what they did? Trussed addresses that part by enforcing policy in the execution path, with allow, redact and block decisions applied at runtime, not reviewed after the fact. That enforcement generates audit-ready evidence mapped to NAIC requirements, at the level of individual interactions and tool calls. It supplements the written program and any management system. It does not replace them, and it is not an ISO/IEC 42001 certification.