NAIC AI Model Bulletin vs NAIC AI Principles (FACTS): What Changed

What changed in legal force and scope

The NAIC Principles on Artificial Intelligence were adopted by the Executive Committee and Plenary on August 14, 2020. They set out consistent, high-level guiding principles for AI actors and state that they do not carry the weight of law or impose any legal liability. They are useful for framing a program, but they give a compliance team nothing to be examined against.

The Model Bulletin, adopted December 4, 2023, is different in kind. NAIC describes it as a model bulletin, not a model law or regulation: a guiding document intended to foster uniformity among state regulators. It has effect only where an individual state issues it. As of April 1, 2026, NAIC's implementation map lists state bulletins in jurisdictions including Alaska, Connecticut, Illinois, Maryland, Massachusetts, New Jersey and Vermont, and each state sets its own date. Because each state issues its own text, a carrier or brokerage operating in several states should read each state's version rather than assume it matches the model.

The Bulletin also changes scope. It reminds insurers that decisions or actions affecting consumers that are made or supported by advanced analytical and computational technologies, including AI Systems, must comply with all applicable insurance laws and regulations. It covers the development or acquisition of AI as well as its use, and it reaches third-party data, models and AI Systems. The Bulletin itself recognizes the Principles as guidance that should inform insurers' use of AI and that underlies its expectations.

Mapping the five FACTS principles to Bulletin expectations

The Bulletin summarizes the Principles as fairness and ethical use, accountability, compliance with state laws and regulations, transparency, and a safe, secure, fair and robust system. The crosswalk below is a practitioner mapping of each principle to the Bulletin's expectations, not an official NAIC table.

• Fair and Ethical: Principle: use AI fairly and ethically. Bulletin: concern about unfair bias leading to discrimination, and questions about outcomes including Adverse Consumer Outcomes.
• Accountable: Principle: accountability for AI. Bulletin: governance and risk management controls for how AI is developed, acquired and used.
• Compliant: Principle: comply with state laws and regulations. Bulletin: AI-supported decisions must meet all applicable insurance laws and regulations.
• Transparent: Principle: transparency. Bulletin: advises insurers of the information and documentation a Department may request in an investigation or examination.
• Secure, Safe, Robust: Principle: a safe, secure, fair and robust system. Bulletin: concern about inaccuracies and data vulnerabilities, with Model Drift evaluation among the examination topics.
• No direct Principles counterpart: Third-party due diligence and vendor contracts appear in the Bulletin as specific examination topics. The Principles do not set them out in operational terms.

Governance program and third-party oversight

The Bulletin expects insurers to govern AI through a written AI Systems program with governance, risk management and internal controls. This is where the Principles' accountability value becomes something concrete: a named structure, defined responsibilities, and controls that can be inspected. A statement that the organization values accountable AI no longer answers the question a Department is likely to ask.

Third-party oversight is the clearest expansion. Examination topics quoted in NAIC task force materials include due diligence conducted on third parties and their data, models or AI Systems, and contracts with third-party AI System, model or data vendors. For brokerages and carriers that rely heavily on vendor models and data, this moves vendor selection and contracting from a procurement matter into regulatory evidence.

Examination questions can also reach below the program level. The Bulletin's topics cover data, predictive models and AI Systems, and individual models or applications. A compliance team should expect to be asked about a specific system and its outcomes, not only about the existence of a program. That has a practical consequence: evidence should be retrievable per system or application.

Policy on paper versus control in execution

A written policy states what should happen. A control enforced in AI execution determines what actually happens when a model is called or a tool is invoked. The Bulletin's wording does not say which type of control satisfies each request, so compliance leaders need to decide which expectations are met by documentation and which need evidence from the AI system's behavior.

In general terms, expectations such as program ownership, risk assessment, inventory, vendor due diligence, contract review and model validation are organizational processes. They are evidenced by records, approvals and reviews. Expectations about what an AI system was permitted to do, and what it did in a particular interaction, are different. A policy document can describe the rule, but only execution-level evidence shows the rule was applied to a specific interaction.

The tradeoff is effort against assurance. Policy-only evidence is cheaper to produce and easier to review, but it depends on people following the policy. Execution-level evidence takes engineering work, but it can show regulators how a control operated in practice. Most insurers will need both, with a clear map of which expectation depends on which.

Where runtime enforcement fits

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Each interaction or tool call can be allowed, redacted, blocked, rate limited, or escalated for human approval, and enforced at runtime, not reviewed after the fact. That enforcement generates continuous audit-ready evidence mapped to NAIC expectations, alongside other regimes such as NYDFS and the EU AI Act.

The scope is specific. This covers individual interactions and tool calls, which supports the Bulletin's emphasis on being able to show what an AI system did and what it was permitted to do. It does not replace the organizational work the Bulletin expects: the written program, inventory, risk assessment, vendor due diligence, contract terms and model validation remain separate processes. Trussed can be self-managed in the customer's cloud, with configurable retention and data residency, which matters when a carrier must control where evidence lives and how long it is kept.