What does the NAIC AI model bulletin mean for an insurtech or an AI vendor selling to insurers?

What the bulletin is, and what it is not

The NAIC is the group of state insurance commissioners, and on December 4, 2023 it adopted a model bulletin on the use of AI systems by insurers. A model bulletin is a template. It has no force until a state insurance department issues its own version to the insurers it licenses, so the legal text that matters to a business is the state’s bulletin, not the NAIC’s.

What the template says is short in principle. Decisions that affect consumers must follow the insurance laws on unfair trade practices and unfair discrimination, whether a person or an AI system made them. Insurers are expected to write down how they govern AI, test it and watch it for errors, bias and drift, and to be ready for a regulator to ask for the evidence. It does not ban any technique and it does not prescribe a method. It says outright that an insurer may show compliance by other means.

It also defines AI broadly. An AI system is a machine-based system that produces predictions, recommendations, content or other output that influences decisions, with varying levels of autonomy. A rate-scoring model, a claims triage tool, a chatbot that steers a quote and a fraud flag all fit.

Who it binds: insurers, not you

The bulletin is addressed to insurers that hold certificates of authority in the state. Its program expectations are for the insurer: governance run by senior management accountable to the board, controls matched to how much harm a decision could do to a consumer, and records of data, validation and monitoring. A software vendor, a data provider or a managing general agent is not the addressee.

That does not make it irrelevant to you. The program is supposed to cover AI systems across underwriting, pricing, claims, marketing and fraud detection whether the insurer built them or a third party did. The insurer cannot satisfy that for the system you sold it without something from you.

How it reaches a vendor: the contract and the questionnaire

The third-party section asks the insurer to do due diligence on the vendor and on its data or AI, and, where appropriate and available, to put two things in the contract. The first is audit rights, or the right to receive audit reports from a qualified outside auditor. The second is a duty to cooperate with regulatory inquiries and investigations about the insurer’s use of the product. Then it asks the insurer to actually use those rights.

The examination section tells the insurer what a regulator may ask for, and the list includes the vendor contract itself. The terms the bulletin names are representations, warranties, data security and privacy, data sourcing, intellectual property, confidentiality and cooperation with regulators. It also lists due diligence done on the third party, any audit of the third party’s compliance, and validation, testing and auditing records, including evaluation of model drift.

In practice that becomes a vendor security and model questionnaire, a new audit clause in the renewal and, if the insurer is asked, a request that you produce your testing documentation. Two states show how the same idea is written down. Colorado’s Regulation 10-1-1 keeps the insurer responsible for its vendors but lets the vendor hand the Division the documents directly. New York’s Circular Letter No. 7 says an insurer may not rely solely on a vendor’s claim that its product does not discriminate, though it need not understand the AI’s detailed inner workings.

Where it stands: states that adopted it and states with their own rules

The NAIC keeps a map. As of April 1, 2026 it lists 25 jurisdictions as adopted, which is 24 states plus the District of Columbia, with Nebraska shown as an issued guidance document. California, Colorado, New York and Texas are listed apart because they already had insurance-specific rules or guidance. The NAIC states that the map does not decide whether a state’s action contains every element of the model.

Two practical points follow. A vendor that sells nationally will meet the same few asks in many states, so building one package of documents is cheaper than answering each insurer from scratch. And a state not on the adopted list is not free of the same expectations, since the unfair trade practice and unfair discrimination laws the bulletin points to apply to insurers regardless of whether a bulletin has been issued. Check the map for the states you serve, because it changes.

What it means for your own insurance

A vendor’s contract with an insurer will often ask it to indemnify the insurer if a regulator finds a problem with the vendor’s model. Technology errors and omissions (E&O) insurance may pay what the law would make you owe, and may carve out liability you took on only by contract, so read the indemnity against the policy before signing. Fines and penalties are commonly excluded.

If the product recommends coverage to the public, you may be an agent as well as a vendor, and the E&O that fits an agent is a different policy. Our insurtech page walks through which of the two applies to which kind of company.