What a Governance Program Under the Bulletin Generally Needs to Show
The NAIC Model Bulletin is broadly understood to set expectations for how insurers oversee AI systems used in underwriting, claims, pricing, and related functions. It does not prescribe a single technical architecture. Instead, it points toward a governance structure: documented policy, defined accountability, and evidence that oversight is active rather than aspirational. Because state adoption of the bulletin can vary in timing and specific language, governance leaders should confirm current requirements against their state insurance department's published guidance rather than treating any single interpretation as universal. What is consistent across most governance program reviews is the underlying expectation: a policy document by itself is rarely sufficient. Examiners tend to look for proof that the policy is operational, meaning there is a person or committee responsible for it, a record of decisions made under it, and controls that trace back to specific AI use cases in production. Building that operational layer, not just the policy, is the core implementation challenge.
Governance Committee Structure and Accountability
A governance committee is commonly the mechanism examiners look for as evidence that oversight is active. Effective committees are cross-functional, typically drawing on legal, compliance, actuarial, IT or data science, and the business unit that owns the AI use case. Single-department ownership of AI governance is frequently flagged as a gap during review, since it tends to leave technical, actuarial, and legal risk considerations unaddressed simultaneously. The committee's role is not only to approve new AI use cases but to maintain a record of decisions, including what was reviewed, what changed, and what escalation path was used when a risk was flagged. Clear delineation of roles, who owns intake, who signs off on risk assessments, and who is responsible for vendor due diligence, reduces ambiguity when an examiner asks who is accountable for a specific model. Meeting cadence matters as much as membership. A committee that meets once at program launch and never again is unlikely to satisfy an expectation of sustained oversight, regardless of how well the initial policy was written.
Third-Party and Vendor AI Oversight
Insurers that rely on vendor-supplied AI or ML tools generally need a distinct oversight workflow rather than folding vendor models into a general policy statement. Accountability for outcomes typically does not transfer to the vendor simply because the model was built externally, which means due diligence at onboarding, ongoing monitoring data from the vendor, and a documented review cadence become part of the governance record. This is where the gap between written policy and operational evidence is most visible. A policy that references vendor oversight in general terms is different from a program that can produce specific due-diligence records and monitoring logs for each vendor tool in use. For insurers deploying AI agents that call internal or vendor-supplied tools, a runtime layer that enforces tool approval workflows, applies least-privilege permissions to agent access, and produces audit logging of what was executed can give the governance committee a technical record that maps directly to its policy decisions, rather than relying solely on manual attestations.