NAIC AI Model Bulletin vs Unfair Trade Practices Act: Where AI Liability Sits

Two different legal functions

The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on Dec. 4, 2023. It is a template, not a law. The text is written to be issued by a state department to insurers holding certificates of authority in that state, and it contains bracketed placeholders for each state's own statute citations. It takes effect in a state only through that state's own bulletin or other action.

The bulletin does not create new substantive prohibitions. It reminds insurers that decisions or actions affecting consumers that are made or supported by AI and other advanced analytical and computational technologies must comply with all applicable insurance laws, including those addressing unfair trade practices and unfair discrimination. It then states what the regulator expects in response: governance frameworks and risk management protocols designed to ensure AI use does not result in unfair trade practices or unfair claims settlement practices, and a written program for the responsible use of AI.

The Unfair Trade Practices Act supplies the prohibitions. The bulletin describes the state UTPA, which corresponds to NAIC Model #880, as regulating insurance trade practices in two ways: it defines practices that constitute unfair methods of competition or unfair or deceptive acts, and it prohibits the practices so defined. Since 1990, unfair claims settlement has been handled in a separate model act, so claims conduct often sits in a different statute from general unfair trade practices.

As of October 2026, multiple states have issued their own versions of the bulletin. Adoption dates on the NAIC implementation map include Alaska on Feb. 1, 2024, Delaware on Feb. 5, 2025 and New Jersey on Feb. 11, 2025. The map does not determine whether a state's version contains every element of the model, so multistate carriers need to check each state's text.

Bulletin and statute side by side

The table compares the two instruments on the dimensions a compliance team most often needs to separate when building a control map.

• Legal nature: Bulletin: model guidance, effective in a state only through that state's action. Statute: enacted state law based on the NAIC model act.
• What it contributes: Bulletin: expectations for governance, risk management and documentation. Statute: the definitions of unfair practices and the prohibitions themselves.
• Treatment of AI: Bulletin: expressly covers decisions made or supported by AI. Statute: the model text does not reference AI and applies to the practices it defines.
• Scope of decisions: Bulletin: not limited to fully automated decisions, because it covers those supported by AI. Statute: framed around practices such as unfair discrimination between individuals of the same class and refusals to insure, renew, cancel or limit coverage on prohibited bases.
• Third-party AI: Bulletin: governance is framed around the development, acquisition and use of AI systems, so acquired systems are in scope. Statute: prohibitions are framed around the practice, not the tool that produced it.
• Documentation: Bulletin: a written AI program and verification and testing methods to identify errors, bias and potential unfair discrimination. Statute: no AI-specific documentation provision in the model text.

How liability flows for AI-driven decisions

The bulletin and the statute answer different questions. The statute asks whether a practice was unfair or discriminatory. The bulletin asks whether the insurer had governance in place designed to prevent that outcome. A governance failure under the bulletin and a statutory violation are separate analytical questions, and a team that treats them as one obligation will tend to document the wrong thing.

The model UTPA's unfair discrimination provisions are framed around class, risk and hazard comparisons. Examples include differences in life insurance rates between individuals of the same class and equal expectation of life, and refusals to insure, renew, cancel or limit property and casualty coverage solely because of geographic location or residential property age. Geographic location is excepted where the action results from sound underwriting and actuarial principles. An AI-supported underwriting or pricing decision is measured against these same provisions. The question for an insurer is whether it can show that the decision rested on permitted factors.

Third-party models raise the same question with an added step. The bulletin's governance scope covers acquired systems as well as those the insurer develops, so a vendor model does not sit outside the program. The statutory prohibitions are written around practices, and the model text does not carve out outcomes produced by a vendor's system. A reasonable working assumption is that the insurer must be able to evidence the behavior of vendor-supplied AI in its own decisions. Counsel should confirm how each state treats this, and the NAIC's ongoing work on a third-party data and models framework means expectations may change.

The practical consequence is that policy documents alone answer only the bulletin side, and only partly. The statutory side turns on what happened in individual decisions.

Enforced at runtime or reviewed after the fact

Most written programs rely on periodic review: model validation, sampling of claims files, quarterly reporting. Those methods find problems after a decision has been made. They also produce records at the program level, which is where the bulletin's written-program expectation is met. They are weaker evidence on the statutory side, where an examiner may want to know what happened in a specific interaction.

To evaluate your position, take one AI use, such as a claims triage assistant or a customer-facing quoting tool, and ask three questions. Which policies apply while the interaction is happening? What stops a non-compliant action, as opposed to flagging it later? Can you produce a record of the decision for a single interaction on request? Controls that fail the second question are reviewed, not enforced.

Trussed enforces policy in the execution path across models, agents, tools, MCP servers, AI sites and coding assistants. For each individual interaction or tool call, it can allow, redact, block, rate limit or escalate for human approval. Each decision generates audit-ready evidence, and that evidence is mapped to NAIC requirements alongside other frameworks. Deployment is self-managed in the customer's cloud, with configurable retention and data residency. Trussed is in continuous production in a regulated enterprise, with customers in insurance among four regulated verticals.

The scope is specific. Enforcement applies to individual interactions and tool calls. It does not replace the written program, bias testing or vendor diligence, which remain the insurer's responsibility under the bulletin and the statute.