NAIC AI Model Bulletin vs Texas TRAIGA for Insurers

Legal form and who is covered

The first difference is what each instrument is. The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers at its 2023 Fall National Meeting in December 2023. The NAIC describes it as a guiding document, not a model law or regulation, intended to foster uniformity among state insurance regulators on what they expect from carriers deploying AI. It takes effect in a state only when that state's insurance regulator issues it.

TRAIGA is House Bill 149 from the 89th Texas Legislature. According to the Texas Attorney General, it took effect January 1, 2026 and governs entities deploying AI in Texas. It sets requirements for those deploying AI systems and prohibits certain AI uses. We have no record of any amendment, delay or repeal as of October 2026.

For an insurer, this means the Bulletin speaks to the insurance business through the insurance regulator, while TRAIGA speaks to any deployer of AI in Texas through general state enforcement. The Bulletin reminds insurers that decisions affecting consumers that are made or supported by advanced analytical and computational technologies, including AI, must comply with all applicable insurance laws, including unfair trade practices rules. Which specific insurer uses fall under which TRAIGA provisions is a determination for counsel. The prohibitions the Attorney General highlights, such as social scoring and biometric data capture, are framed around governmental entities, so do not assume they map directly onto a private carrier.

Side-by-side comparison

The table summarizes how the two instruments differ on the dimensions compliance teams usually need first.

• Legal status: NAIC: adopted guidance, not a model law or regulation; effective in a state through that state's regulator. TRAIGA: Texas statute, effective January 1, 2026.
• Who it reaches: NAIC: insurers. TRAIGA: entities deploying AI in Texas.
• Covered AI use: NAIC: decisions made or supported by AI that affect consumers. TRAIGA: applicability to specific insurer uses is set by statutory text and counsel's review.
• Core expectation: NAIC: a written program for responsible AI use covering governance, risk controls and internal audit, with testing for errors and bias. TRAIGA: requirements on deployers and prohibitions on certain uses.
• Third-party AI: NAIC: due diligence on third parties and their data, models and AI systems, plus contract terms. TRAIGA: deployer responsibility should be assessed by counsel when a vendor supplies the AI.
• Enforcement: NAIC: examination and investigation under insurance law. TRAIGA: exclusive Attorney General authority unless another agency is recommended; civil investigative demands; civil penalties.

Where the two overlap and where they diverge

Both regimes reach AI that supports or makes decisions affecting consumers, and both put the burden on the organization deploying the system. In practice, a regulator or the Attorney General will ask similar questions: what AI do you use, what is it allowed to do, who oversees it, and what records show how it behaved.

The divergence is in structure. The Bulletin is program-oriented. It expects governance, risk management controls and internal audit functions designed to mitigate adverse consumer outcomes, and it encourages verification and testing to identify errors, bias and potential unfair discrimination in predictive models and other AI systems. TRAIGA is a statute with requirements and prohibitions, enforced by investigation rather than by routine supervision of an insurer's program.

Third-party AI shows the difference most clearly. NAIC materials describe documentation a department may request, including development and use of predictive models, data source, provenance and lineage, due diligence on third parties and their data, models or AI systems, and third-party contracts. Contract terms in scope include representations, warranties, data security and privacy, data sourcing, intellectual property rights, confidentiality and disclosures, and cooperation with regulators. Because TRAIGA targets deployers, an insurer should not assume that a vendor-supplied model shifts accountability away from it. Confirm that reading with counsel, and check the adopted Bulletin text against any pre-adoption drafts you have used.

Enforcing policy at runtime with Trussed

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. Each interaction or tool call can be allowed, redacted, blocked, rate limited or escalated for human approval, and that enforcement is applied at runtime, not reviewed after the fact. The same enforcement produces audit-ready evidence mapped to NAIC and other frameworks, scoped to individual interactions and tool calls.

This covers one layer of the picture above. It does not replace a written program, vendor due diligence, legal analysis of TRAIGA scope, or model and dataset lineage documentation, and it does not by itself establish compliance with either regime. Trussed can be deployed self-managed in the customer's cloud, with configurable retention and data residency, which matters for insurers that must control where evidence is held.