AI Governance for Insurance Carriers: Where AI Runs Across the Value Chain and What Regulators Expect

Eighty-eight percent of auto carriers are using or planning to use AI. So are seventy percent of home carriers and fifty-eight percent of life carriers. Those figures come from industry surveys run between 2022 and 2023, and adoption has accelerated since. Insurance AI governance has not kept pace, and AI governance for insurance carriers is now something state regulators examine directly instead of something a carrier describes in a policy binder.

This guide covers why regulators, courts, and reinsurers are forcing the issue now; where AI runs across the insurance value chain and what goes wrong in each place; how those failures surface in a loss ratio; and what working governance infrastructure looks like.

Why Insurance AI Governance Became a Regulatory Requirement

Every state has its own insurance department, its own commissioner, and its own rules on pricing, underwriting, claims handling, and consumer protection. AI gets no carve-out from any of them. What changed is that regulators moved past general principles and started writing rules about algorithmic accountability.

State law and the NAIC bulletin

Colorado's SB21-169 prohibits carriers from using external consumer data, algorithms, or predictive models that unfairly discriminate based on race, color, disability, or sex, and it requires carriers to disclose to the commissioner how they use external data sources. That is a disclosure obligation with enforcement behind it.

The NAIC's model bulletin, "Use of Artificial Intelligence Systems by Insurers," calls for a written AI program, governance over third-party models, and ongoing monitoring that ensures fair outcomes. State departments are translating it into examination procedures, and the NAIC's AI Systems Evaluation Tool pilot is pushing toward a standard request: on a few business days' notice, produce an inventory of AI systems in use, the governance documentation behind them, and decision-level audit trails. Our NAIC bulletin enforcement readiness guide walks through what examiners ask for, and the 2026 state AI regulations guide tracks which states have adopted what.

The pressure is not only domestic. The EU AI Act lists AI used for risk assessment and pricing in life and health insurance as high-risk (Annex III), which brings documented governance, human oversight, and continuous monitoring obligations for carriers writing those lines in the EU. The FS AI RMF, published by the Cyber Risk Institute in 2026, codifies model risk management, third-party AI oversight, and bias monitoring expectations that apply to carriers.

The NIST AI Risk Management Framework, published in January 2023, has become a reference point for responsible practice, and exam questions tend to cluster around robustness (does the fraud model hold up against new patterns and adversarial probing), bias across protected classes, privacy as telematics and sensor feeds widen the attack surface, transparency to policyholders, and efficacy (an underwriting model that misprices risk creates solvency exposure). A carrier that maps its policies to these areas but cannot show live bias metrics has a compliance artifact. It does not yet have a compliance program.

What examiners ask for at the second meeting

Documentation gets a carrier through the first meeting with a state examiner. At the second meeting the examiner asks for monitoring outputs, drift alerts, bias measurement results, and incident logs. Specifically, examiners want:

• a complete inventory of AI systems with risk classifications;
• documented testing procedures, including fairness testing across protected classes;
• monitoring outputs that show ongoing oversight rather than point-in-time assessments;
• incident logs showing that when a problem was detected, the organization responded.

Multiple states already include AI questions in market conduct examinations. A committee that meets quarterly cannot oversee models that update weekly, and a questionnaire completed at deployment says nothing about the model six months later. That space between documented and operational governance is where regulatory exposure lives.

The litigation trajectory

The legal profession is raising the same alarm. The Michigan Bar Journal published a detailed analysis of AI risk in insurance covering bias in claims processing, privacy exposure from data aggregation, and transparency failures that leave policyholders unable to understand decisions about their coverage. When the bar that governs insurance litigators publishes on your AI risk, plaintiffs' firms are already reading it.

Suits have already been filed against major carriers, State Farm among them, alleging that claims AI systematically increased scrutiny for specific demographic groups. The legal theory is simple: disparate impact claims require proof of effect, and intent does not matter. Every carrier using AI in claims, underwriting, or pricing is generating a data trail a plaintiff's expert can analyze for discriminatory patterns.

Plaintiffs' attorneys have also learned to request the evidence of implementation along with the governance policy itself. Show us the model registry. Show us the monitoring outputs. Show us when you detected the bias and what you did about it. A policy document without operational backing reads as evidence of negligence. At the 2026 PLRB Claims Conference, a panel on The Future of Insurance Podcast flagged a newer exposure: the prompts an adjuster types into an AI tool may be discoverable, and a question framed to find grounds for denial will get a different answer than one framed to find coverage.

Liability also runs the other way, toward the carrier's own book. Our analysis of AI liability, CGL exclusions, and coverage gaps covers how carriers are pricing AI risk in their insureds.

Where AI Runs Across the Insurance Value Chain

Strategy decks treat "AI in insurance" as one initiative. In practice it is dozens of systems, each with its own data, failure mode, and regulatory hook. The table below summarizes the value chain; the sections after it cover the specifics.

Underwriting and pricing

An AI underwriting model at a top-20 personal lines carrier processed applications 90% faster than its manual predecessor and improved risk assessment accuracy 25% against actuarial benchmarks. Carriers using AI underwriting report 10–15% less adverse selection and loss ratio gains of 3–5 points. Fourteen months after deployment, a fairness audit at that carrier found pricing disparities of 11–17% for applicants in predominantly Black zip codes compared with identical risk profiles in predominantly white ones. Race was never an input.

The mechanism is combinatorial. Credit score, zip code, education, and occupation are each individually defensible rating factors, and each carries some demographic signal; an FTC study and ongoing NAIC working group reviews have found disparate impact from credit-based insurance scores. Machine learning amplifies that signal through feature interactions. It cannot tell whether an interaction between vehicle age and zip code reflects poor road maintenance or a concentration of older vehicles in lower-income, disproportionately non-white neighborhoods. A feedback loop then reinforces the pattern: pricing a segment higher shrinks its applicant pool, which thins the data, which raises uncertainty, which raises the price.

That makes bias a feature-engineering problem, and the remediation follows from it. Proxy testing needs protected-class outcome analysis that adjusts for legitimate risk factors, statistical screening of each input for proxy potential, counterfactual tests that alter an applicant's inferred demographics and watch whether the decision moves, and intersectional analysis (a model can look acceptable for Black applicants and for women separately while producing adverse outcomes for Black women). It also has to be temporal. A disparity growing 0.5% a month trips no single alarm but compounds across a year. The carrier above had to reprocess every affected policy and rebuild the model with fairness constraints. Our compliance AI audit trail specification lays out the decision-level records that make this testing defensible to an examiner.

Usage-based insurance compresses the timeline. Between 46% and 70% of new auto policies sold through direct channels now include usage-based elements, and McKinsey estimates generative AI could unlock $50 to $70 billion in new insurance revenue. In UBI the model is the rate table, and it reprices continuously while the policyholder mix broadens past safe early adopters, drivers learn to behave only while monitored, and retraining on its own pricing can compound a mispriced segment. Disparate impact arrives through behavior. A model that penalizes late-night driving falls hardest on shift workers, who are disproportionately lower-income and minority. A quarterly fairness audit that catches a pattern introduced three weeks into the quarter finds it six weeks after the harm began, and a drift event in one of 30 states does not pause pricing in the other 29.

Electric vehicles break the actuarial foundation. Average EV collision repair reached $6,066 per claim in early 2024, 29% above the $4,703 ICE average, according to Mitchell. EV repairs use 89% OEM parts versus 65% for ICE and nearly double the mechanical labor hours; battery packs run $12,000 to $20,000, and ADAS recalibration adds $500 to $1,500 per claim. Most pricing portfolios are 90% or more ICE, so the model extrapolates from ICE risk while battery chemistry and body design change every 18 to 24 months. EVs made up 7.8% of U.S. new car sales in 2025, peaking at 10.5% in Q3 before federal incentive changes, and Cox Automotive expects roughly 8% in 2026. Annual validation on a book like that is an autopsy.

Autonomous vehicles move the risk into the algorithm. In October 2023 a Cruise robotaxi in San Francisco dragged a pedestrian 20 feet after she was knocked into its path; Cruise lost its permit and paid more than $2 million in penalties (NHTSA $1.5 million, DOJ $500,000, California PUC $112,500). Mercedes-Benz accepts liability while its Level 3 Drive Pilot is engaged. At Levels 4–5 there is no driver to rate, so underwriting becomes evaluation of the operational design domain, sensors, edge-case behavior, and a software version that can change overnight. OEMs hold the telemetry, a single perception defect can produce fleet-wide correlated losses that look more like cyber than auto, and the rules vary: California requires AV operators to carry $5 million in liability coverage, the UK's Automated Vehicles Act 2024 assigns primary liability to the "authorized self-driving entity," and the U.S. has no federal AV statute.

Claims

Claims is where AI volume is highest. Carriers report 75% faster settlement cycles, 30–50% cost reductions, and 70% of straightforward claims resolved in real time, with 60–70% of standard auto and property claims moving through FNOL without human intervention. None of those numbers says whether the decisions were right.

A regional auto carrier's AI triage system processed 12,000 FNOL submissions in six weeks, routed 83% to the correct queue, and cut first contact from 48 hours to 6. Three months later an internal audit found it had hallucinated policy language on 4% of liability assessments, citing coverage clauses that did not exist in the policyholder's contract. Nobody caught it because the outputs looked authoritative. We have seen misrouting rates vary 3x across zip codes from training data imbalance alone, and "flooding in my basement" route differently from "pipe burst in lower level" for the same event. One property carrier's roof model overestimated repair costs 22% on tile roofs and underestimated 18% on flat commercial roofs. Aggregate accuracy looked fine; the variance created $3.1 million in unnecessary reserves on one side and solvency exposure on the other.

Authority drift is the copilot failure mode. Adjusters with AI assistance handle 40–60% more claims per day. When a settlement suggestion has been right 95% of the time, adjusters stop scrutinizing the other 5%, and the copilot becomes an autopilot without anyone approving the change. The signal is a declining rate at which adjusters modify AI suggestions, and most carriers do not track it.

Drones are in production at State Farm, USAA, Allstate, and Erie. A drone operator covers 15–20 properties a day against 4–6 for a ladder-and-clipboard adjuster. Error rates run higher on aged and tile roofing, where weathering mimics storm damage, and the highest-stakes failure is separating pre-existing wear from event damage, since training data rarely pairs before-and-after images of the same roof. A model can score well on damage type and poorly on causation, which is what drives the payment, and lighting, angle, and resolution changes degrade classification while the confidence score stays flat. Several states define adjusting as evaluating claims and determining amounts payable, a functional definition an AI estimate already fits.

Generative AI in documents needs a dividing line. Underwriters spend 60–70% of their time extracting information from documents, and the generative AI insurance market has reached $1.5 billion with a 38.9% compound annual growth rate. Pulling square footage from a submission tolerates variability in phrasing. A claim summary does not. When an adjuster reads a two-page summary of 200 pages of records, "gradual pipe deterioration" versus "sudden pipe failure" decides whether a maintenance exclusion or a covered peril applies. Governing both uses identically either smothers the low-risk one or under-supervises the high-risk one; summaries need completeness, accuracy, and neutrality checks against the source. The PLRB panel described agentic tools already in this seam: triaging demand packages that must be answered in 10 days, refreshing research on long-running Michigan claims with unlimited medical, and a restoration company's FNOL agent that policyholders spoke to with surprising candor. Swept CEO Shane Emmons called persistent model bias "heresy," something the AI latches onto and keeps resurfacing.

Fraud is an arms race, and the fraud model depreciates. The industry loses an estimated $308 billion a year to fraud, and the NICB estimates fraud adds $80 billion annually to insurance costs across lines. Generative AI gave fraud rings deepfake records, synthetic identities that pass KYC, convincingly messy claim narratives, and coordinated micro-fraud kept under investigation thresholds. Industry reporting puts AI-enabled fraud attempts up roughly 4x since 2022, though part of that likely reflects better detection. One commercial lines carrier watched its fraud model's precision fall from 78% to 51% over 18 months without retraining, as adversaries probed its thresholds and features like commute patterns lost meaning after remote work. The useful signal is the confirmation rate against flag rate: a stable flag count with falling confirmations means degradation. False positives also concentrate. A model with a 5% false positive rate overall can run 12% in specific regions or groups, and each one is a legitimate policyholder investigated during a loss.

Social inflation is the case where AI is being asked to price a legal environment. Average bodily injury severity reached $29,100 per injured party by late 2024, up 36% since 2020, according to CCC Intelligent Solutions; total losses are 27% of claims against 16% in 2022, and ADAS recalibration adds $300 to $800 to a bumper job, pushing many past $2,000. The median nuclear verdict reached $23.8 million in 2023, per the Institute for Legal Reform. A CAS and Triple-I analysis estimated social inflation added more than $20 billion in excess commercial auto liability losses between 2010 and 2019, and reserves built on pre-2018 development patterns understate ultimates by 10–25%. One commercial auto carrier reserved $1.2 million on a lower-back injury with under $400,000 in treatment costs and saw a $47 million verdict. Carriers are answering with litigation risk scoring, NLP on demand letters, and reserve models fed venue and litigation funding signals. Litigation scores can encode zip-code demographics, NLP can learn to flag articulate letters instead of unreasonable ones, and jurisdiction models built on three recent verdicts overfit. The subtlest risk is a feedback loop: high-score claims get better handling and settle well, the model retrains on outcomes it caused, and only randomly allocating enhanced handling to some low-score claims separates measurement from self-fulfilling prophecy.

Catastrophe and flood modeling

Insured natural catastrophe losses reached $137 billion to $151 billion in 2024, depending on the source, more than 25% above the 10-year average. Swiss Re estimated $318 billion in global disaster losses for 2024, with 57% uninsured. Traditional cat models, built after Hurricane Andrew exposed the industry's blind spot on aggregate exposure, assume stationarity. Atlantic hurricane intensification rates have risen 25% over four decades, wildfire seasons that ran four months now run eight, and "100-year" floods have hit the same regions three times in a decade.

AI modeling works from observation. Daily satellite imagery at resolutions down to 3 meters separates a home with cleared defensible space from one in dry brush that a ZIP-and-year-built model rates the same. During the 2023 Maui wildfires, satellite classification identified destroyed structures within 48 hours, where traditional adjustment took weeks, and ML has improved rapid intensification prediction 15–20% over statistical baselines. Regulators in Florida, California, and Texas review rate-making models component by component, which an end-to-end ML model resists, and drift is built in: a wildfire model trained on 2020–2025 data may miss emerging patterns by 2027.

Flood shows the protection gap most clearly. Hurricane Helene dropped nearly 14 inches of rain on Asheville in three days in September 2024; fewer than 1% of affected homeowners carried flood insurance. Verisk put insured flood losses at $6 billion to $11 billion, while Aon put total economic losses above $75 billion. Between 2015 and 2019, more than 40% of NFIP claims came from outside high-risk zones, according to FEMA, and the Northeast has seen a 55% increase in heavy precipitation events since 1958, per the National Climate Assessment. Private flood premium grew from $600 million in 2016 to more than $2.5 billion by 2025 on AI models that score risk probabilistically and dynamically. Their weak spot is that the richest loss data sits inside the flood zones these models are meant to see past: a 0.8% probability for an unmapped property may rest on ten comparables instead of ten thousand, and the confidence score will not say so. Supervision has to segment calibration by data density, validate climate adjustments, track stormwater input freshness, and watch loss ratios by confidence band for adverse selection.

Every emerging risk shares two hazards. Carriers pricing with similar models fail in the same direction at once, and model chains amplify error: if a 10% shift in a cat model's PML estimate moves reinsurance purchasing recommendations 30%, component-level monitoring misses it. Where ground truth is thin, monitor leading indicators such as input distribution shift and divergence between models estimating the same risk.

Parametric products

Parametric insurance is a $15 billion niche in a $7 trillion industry. It pays a fixed amount when a defined trigger fires, in as little as 72 hours against 30 to 60 days for a typical commercial property claim. Basis risk held it back: the station records 125 mph when the trigger is 130 and a destroyed property gets nothing, or it records 135 and a sheltered property gets a full payout. AI reduces basis risk with composite triggers (satellite wind fields, multiple stations, surge, pressure), thresholds calibrated to local building stock, and simulated false and missed trigger rates that turn basis risk into a number in the product spec. Swiss Re's parametric hurricane product for Caribbean nations pays within 14 days, and satellite-validated index crop insurance now reaches tens of millions of smallholder farmers, mainly in India. Trigger functions are models. They need the same validation after each event that any pricing model gets.

Distribution and customer experience

Industry estimates put embedded insurance at $176 billion to $210 billion in gross written premium by 2026. When the carrier's model scores, prices, and binds inside a partner's checkout, the carrier sees API calls and nothing else, yet still owns the compliance outcome if a partner omits disclosures or violates anti-tying rules. At 200 partners across 50 states, aggregate dashboards hide the partner where the fraud model just started rejecting legitimate buyers. Embedded programs need a decision record for every transaction, metrics per partner, jurisdiction, and product, drift detection at API speed, and monitoring of disclosure completion and complaints by partner.

Inside the carrier's own channels, the line that matters runs between copilot and autonomous AI. A copilot drafting a reply for an agent has bounded risk because a human sees every output. An autonomous system that issues a certificate or pays a windshield claim sends errors straight to the customer: at 1,000 decisions a day, a 5% error rate is 50 wrong outcomes daily. Anything that confirms coverage needs validation against the policy form, because a chatbot that calls excluded flood damage covered creates a dispute the carrier will likely lose.

Consumers are drawing the same line. The Insurity 2026 AI in Insurance Consumer Survey of more than 1,000 adults found support for AI in P&C nearly doubled, from 20% in 2025 to 39% in 2026, while the share less likely to buy from a carrier using AI fell from 44% to 36%. Comfort depends on the task: 46% are comfortable with AI generating a quote, 39% with AI tracking claim status, and 38% with AI updating personal information, but only 22% with AI filing a claim for them and 16% with AI canceling or renewing a policy. As Insurance Business reported, nearly half distrust AI making determinations on claim approvals, fraud flags, or policy adjustments. Trust in AI-driven decisions sits at 33%, with 26% saying they need more information first. Insurity President Jatin Atre put it directly: "Consumers have moved past the hype cycle. They are not impressed by the fact that insurers are using AI. They care about how it is being used." His prescription was "visible human oversight." If the denial letter does not show that a human reviewed the AI output, the oversight is invisible to the customer, the examiner, and the plaintiff's attorney alike.

Cyber

At-Bay's 2026 InsurSec Report, built on more than 100,000 policy years of claims, prices detection latency precisely. Financial fraud incidents reported within three days recovered about 70% of stolen funds, 53% between four and fourteen days, and below 30% after two weeks.¹ Average financial fraud theft rose 16% to $285,000 (top loss $9.65 million), and third-party liability severity jumped 70%, with CIPA tracking-pixel matters now 34% of that segment against 7% in 2023.¹ Average ransomware severity rose 16% to $508,000. One crew, Akira, drove more than 40% of ransomware claims with average demands of $1.2 million; 86% of its intrusions involved a SonicWall VPN appliance, and 60% of its victims had EDR deployed. Businesses under $25 million in revenue saw ransomware severity rise 40% to $422,000.² Fast reporting let At-Bay recover $56 million in 2025.³

Two lessons carry over to any carrier's AI stack. One is the recovery curve: a miscalibrated severity model caught the same week is a reserve adjustment, and caught a quarter later it is paid loss. The other is concentration. At-Bay's Adam Tyra said the biggest determinant of ransomware risk "wasn't your industry, your size, or even your security budget. It was whether you operated a specific type of network appliance."³ Swap in "foundation model provider" and a silent inference change from one vendor can shift loss-cost predictions across hundreds of carriers at once. Every Akira victim that avoided full encryption had 24/7 managed detection and response.¹

How Model Drift Shows Up in a Loss Ratio

By the time drift reaches the loss ratio, the reinsurer has usually noticed. Data science treats drift as a retraining problem and actuarial treats loss ratio variance as a rate problem, so 2026 earnings calls keep featuring CFOs explaining 4 to 8 point deteriorations as "frequency and severity above expectation" when the cause was a rating model that degraded eighteen months earlier. Hippo Holdings' 273% homeowners loss ratio in Q1 2023 is the extreme case of a mechanism running inside every carrier that rates with machine learning.

Drift reaches the loss ratio through four pathways:

1. Mispriced segments. A segment's loss distribution shifts (roof age becomes more predictive of hail severity, a vehicle's theft profile changes after a publicized security flaw), the model keeps charging the old rate, and price shoppers select into the underpriced cell. The actuary sees "growth in adverse segments." Adverse selection looks like growth.
2. Missed fraud. As the fraud score's separation compresses, more fraudulent claims pass through auto-pay. Claims sees severity rising while SIU reports caught fraud as "stable to declining." Missed fraud costs 50 to 200 basis points of loss ratio depending on line, and At-Bay's recovery curve shows why late detection means the loss is already paid.¹
3. Severity miscalibration in reserving. ML reserving overlays that underestimate medical inflation, social inflation, or regional labor rates set case reserves and IBNR low. The correction arrives four to six quarters later as adverse development on prior accident years.
4. Retention skew. After 2022, policyholders who used to shop at a 6% increase began shopping at 3%. Retention models trained on pre-2022 data overstated stickiness, carriers took too much rate, premium walked, and the book that stayed was the least price-sensitive and highest-loss. Planning calls it "mix shift" without naming the model.

A loss ratio lags by construction. Calendar-year results lag underlying frequency and severity by one to two quarters in short-tail lines and four to eight in long-tail casualty. Drift that starts affecting decisions in January 2026 shows up in Q2 paid and incurred, becomes an indication in the Q3 reserve study, and reaches a rate filing in Q4 for mid-2027 effective dates. Eighteen months is the best case. The Casualty Actuarial Society's model risk working group has flagged the lag. The NAIC Big Data and AI Working Group's bulletin requires ongoing monitoring of AI/ML models but sets no cadence faster than financial reporting, so most carriers monitor quarterly. Regulation does not cause the lag; operating habit does.

Three metrics, watched continuously, lead the loss ratio by one to two quarters:

• Segmented calibration. Predicted versus actual loss cost by territory, class, tenure cohort, and score band. Aggregate calibration hides offsetting shifts.
• Production score distribution. A fraud score whose mean moves half a standard deviation with no change in underlying claim characteristics signals input drift that will show as leakage one to three quarters later. Population stability statistics are well established. The missing piece is acting on them daily.
• Decision-to-outcome lag. Short-signal models (fraud, conversion, retention) can be checked weekly. Long-signal models (severity, reserving) need proxies such as escalation rates, attorney involvement, and treatment patterns.

Reinsurers increasingly run their own evaluations on cedent submissions and can see drift across many cedents using similar model architectures. A property reinsurer pricing a 2026 treaty may understand a cedent's model performance better than the cedent does, and the terms reflect it. We cover this in more depth in reinsurers are already underwriting your AI. The carrier that finds its own drift first gets a rate-action conversation instead of a treaty renegotiation.

The Operating Gap Between Deployment and Governance

More than half of insurance CEOs name AI as their most critical technology for the next three years, yet over 70% say AI regulation should match the rigor of climate commitment rules, and over 40% of executives rank data management as a top concern. Fewer than half of executives running generative AI believe its benefits outweigh its risks. Industry research blames gen AI failures mostly on weak business line support and data foundations, with capital far down the list, and by one widely cited estimate only about 5% of insurance AI initiatives have delivered tangible business value.

The bottleneck is operational, in four places.

Cadence mismatch. AI ships on engineering timelines; governance runs on committee timelines. A claims model can make ten thousand decisions in the time a quality team reviews ten. The result is shadow AI: teams retrain models and edit prompts outside formal process. One life carrier found 47 models in production and could document only 31. The other sixteen were processing real policyholder data with no oversight.

Strategy without an operating layer. The typical consulting arc (identify, build the business case, deploy, scale) has no phase for ongoing supervision, which is like launching a product without loss reserves; a new auto product can look profitable for eighteen months before development reveals its profile. Pilots stall on questions strategy never answered: who owns remediation, how fairness is shown to regulators, how 50 or 80 models are tracked at once. Carriers that built the operating layer report AI-driven sales moving 80% of transactions online with a 36-point lift in recommendation scores, after-hours chatbots raising conversion 11%, and 50,000 claims communications drafted a day, and the carriers posting 6.1x shareholder returns are the ones governing AI as fast as they deploy it.

Agentic chains. In an agentic onboarding flow (intake, risk profiling, pricing, compliance check, orchestrator), a compliance agent that misses a requirement does not cause the pricing agent to flag it, and each step can look reasonable while the sequence goes wrong.

Talent. The Bureau of Labor Statistics projects the industry will lose about 400,000 workers to retirement and attrition by 2026, with half the current workforce retiring within 15 years. Forty-three percent of carriers expect to hold staffing flat, 10 points more than in 2025. The real loss is judgment, like the adjuster who knows which contractor inflates restoration estimates by 30%. An override recorded as a binary data point teaches a model nothing about why it happened, so capture has to come before automation: structured audits of expert overrides, six-to-twelve-month shadow deployments whose expert-versus-model disagreements become training data, and expert observations encoded as features. The PLRB panel added that automating entry-level claims work removes the ground where adjusters used to learn.

What AI Governance for Insurance Carriers Looks Like in Practice

Working governance is infrastructure that runs on the same clock as the AI it oversees. Supervision intensity should match the consequence of the decision: a claims summary needs output-level fact checks against source documents, a fraud model needs stratified false positive analysis, a triage model needs routing accuracy by severity band (94% overall can hide 72% on high-severity claims), and a catastrophe model needs automated guardrails that keep working during the event that consumes the people who would otherwise watch it. Five capabilities hold that together.

1. Sanctioned AI behind a governed gateway. Shadow AI shrinks when employees get the tools they actually want. Route Claude, ChatGPT, and other models through a private gateway in an isolated cloud so policyholder data stays inside the carrier's boundary, guardrails stop inappropriate work before it starts, and alerts fire when a vendor changes model behavior or an AI feature appears uninvited in software you already licensed. That alert is the carrier's answer to the Akira concentration question: which upstream AI dependency, if it changed tonight, would touch more than a quarter of our automated decisions by Monday? It also means no single model vendor holds the carrier's workflows, context, or pricing hostage. See how Swept Access does this.

2. A complete inventory with ownership. Every model, internal or vendor, recorded with its purpose, data dependencies, risk classification, regulatory obligations, performance baselines, and owner. Usage belongs in the record too. A model approved for advisory use that starts driving automated decisions has changed its risk profile without changing its code.

3. Spend visibility tied to value. Usage metered in real time by user and department, caps and budgets per team, and model size matched to the task, so the carrier pays for usage instead of idle seats. It also shows which tasks produce value.

4. Continuous oversight mapped to NAIC and state requirements. Segmented calibration, fairness by protected class and proxy, drift and score-distribution alerts, adjuster modification rates, per-partner metrics, and confirmation-versus-flag rates for fraud, all on automated thresholds with defined escalation paths and the ability to constrain or roll back a model. Map these to the bulletin's expectations and state rules so a new requirement shows up as a gap in monitoring rather than a surprise at the next exam.

5. Audit-ready evidence and board reporting by default. A log of every AI interaction: model, inputs, output, human reviewer, what changed, and when. That single record answers the consumer asking whether a human looked at their claim, the examiner asking the same question, and the litigator who will subpoena it. Rolled up, it gives the board AI performance in business terms. When a CRO can see a triage model making 10,000 decisions a week at 96% accuracy with zero fairness violations, continued deployment is an easy call, and when an underwriting model trends toward unacceptable drift, intervention is just as easy.

Governance built this way speeds deployment. A carrier that can show every system is monitored can move AI into more valuable work, while carriers without that evidence relitigate risk on every new use case.

If you want a quick read on where your program stands against the NAIC bulletin and state expectations, take the insurance AI risk assessment, or see how Swept handles continuous governance for carriers.