Why Adoption Status Is Not a Simple Yes or No
The NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers is a template. It is not a statute, and individual states typically issue their own version through a bulletin, guidance document, or regulation that references the NAIC text rather than adopting a binding law. This matters because the mechanism a state uses affects how enforceable the requirements are and what regulatory authority backs them. A compliance tracker built around a single adopted or not-adopted label misses this distinction and can understate the actual obligation in a given jurisdiction.
What the Template Establishes
Where a state does adopt the bulletin's core structure, the template generally expects insurers to maintain a written AI program, document oversight of third-party AI vendors, and produce risk management documentation that regulators can review. Adoption of this structure does not tell you the scope. Some states adopt the framework while narrowing or expanding applicability thresholds, adjusting compliance timelines, or limiting the lines of insurance business covered. Two states can both show as adopted while imposing materially different obligations on the same insurer.
Where a State Has Not Acted
A state showing no formal adoption does not necessarily mean AI use is unregulated there. Existing unfair trade practices statutes and general market conduct examination authority can still be applied to AI-driven underwriting, claims, or pricing decisions even without a bulletin in place. Compliance teams should treat non-adoption as an open question to monitor rather than an absence of obligation, and document what existing authority a state regulator could rely on in the interim.
Governance Implications for Compliance Leaders
Before finalizing a company-wide AI risk management framework, confirm whether a state's version of the bulletin changes enforcement posture, such as triggering a market conduct exam under different conditions than the NAIC template describes. Where implementation timelines differ by state, the rationale for a phased control rollout should be documented and traceable to each jurisdiction's effective date, since regulators may ask for that justification during an exam. Third-party AI vendor oversight is a recurring area of variation. Some adopting states layer additional documentation or attestation expectations onto the base template, which affects how vendor risk assessments and tool approval records need to be structured and retained.