What the Bulletin Is and Who It Covers
The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers was adopted by the National Association of Insurance Commissioners on December 4, 2023. It is not a standalone statute. The bulletin states explicitly that it does not establish new requirements, but instead reminds insurers that existing laws, including unfair trade practices statutes and rating and underwriting requirements, apply fully to decisions made using artificial intelligence.
The bulletin defines an Artificial Intelligence System (AIS) broadly: a machine-based system that, for a given set of objectives, generates outputs such as predictions, recommendations, or decisions that influence insurance-related decisions. This definition is intentionally wide. It captures machine learning models, generative AI tools, and other predictive models and algorithms used across underwriting, rating, claims, marketing, and fraud detection, not just newer generative AI products.
For compliance leaders, the practical effect is that any predictive or automated decisioning tool touching a consumer-facing insurance outcome is a candidate for inclusion in the insurer's AIS inventory, regardless of whether the business unit that built or licensed it thinks of it as "AI."
Core AIS Program Requirements
The bulletin directs insurers to develop, implement, and maintain a written AIS program that addresses three connected elements:
- Governance: oversight across the full AI lifecycle, from development or acquisition through validation, deployment, and ongoing monitoring, with defined accountability including board- and senior-management-level oversight of AI-related decisions and risk.
- Risk management: testing for accuracy, reliability, and the potential for unfair discrimination or bias in outcomes. The bulletin does not prescribe a specific testing methodology, leaving insurers latitude in how they structure validation and monitoring, provided the program can demonstrate these risks are actively assessed rather than assumed away.
- Internal controls: policies, procedures, and control points that tie governance and risk management together operationally, ensuring the AIS program actually operates as designed and not just as documented on paper.
Governance cannot sit solely with a data science or IT team; senior leadership needs documented awareness and responsibility for AI outcomes.
Third-Party AI Oversight Obligations
A significant portion of the bulletin addresses AI tools and data obtained from outside vendors. The bulletin states plainly that use of a third party does not reduce the insurer's own responsibility for compliance. This places the burden of oversight on the insurer even when the underlying model, scoring engine, or data source is developed and operated externally.
In practice, this requires insurers to obtain enough information from vendors, whether through contractual terms, due diligence documentation, or ongoing performance reporting, to support the insurer's own governance and risk management obligations. A vendor's unwillingness or inability to provide this information becomes a compliance risk for the insurer, not just a vendor management issue.
Insurers should treat third-party AI tools as part of the same AIS inventory and governance framework applied to internally built systems, rather than as a separate category with lighter oversight.
AIS Governance vs. Existing Model Risk Management
Many insurers already operate actuarial or predictive model governance frameworks that predate the bulletin. The bulletin does not ask insurers to discard these frameworks. It positions AIS governance as complementary oversight that extends existing model risk management to explicitly cover AI-specific concerns, including third-party accountability and board-level reporting on AI use.
For compliance teams, the practical task is a gap analysis: identifying where an existing model risk management program already satisfies AIS governance expectations, and where distinct documentation or oversight elements need to be added. Internal policy language should distinguish between general model governance and AIS-specific controls so that both regulators and internal auditors can see how the two frameworks relate, rather than assuming one silently covers the other.