Most states have adopted the NAIC Model Bulletin, which expects every carrier using AI to keep a written AIS Program covering governance, risk management, testing, and third-party oversight. A few states go further with rules of their own. Carriers prove compliance with records an examiner can review, and examiners expect more than the policy document.
The NAIC Model Bulletin is the baseline in most states
On December 4, 2023, the NAIC adopted "Use of Artificial Intelligence Systems by Insurers" as a model bulletin. As of the NAIC's November 3, 2026 implementation map, 29 jurisdictions have adopted it (27 states plus the District of Columbia and Puerto Rico). Mississippi, South Carolina, and North Dakota all signed on in the second half of 2026.
The bulletin creates no new law. It tells carriers that existing unfair trade practice and unfair discrimination laws apply to any decision an AI system touches, and it expects a written AIS Program sized to the potential harm to consumers. That program covers governance with board-level accountability, risk management, testing and monitoring, and oversight of AI bought from vendors. The bulletin explainer walks through each section, and the full guide to the bulletin and its examination tool goes deeper.
Colorado, New York, California, and Texas set their own rules
The NAIC map lists these states as having insurance-specific AI rules or guidance in place of the bulletin. Virginia adopted the bulletin with stronger wording on consumer harm.
| State | Rule | What's distinct |
|---|---|---|
| Colorado | 3 CCR 702-10, Regulation 10-1-1 (amended Oct. 15, 2025) | Risk-based governance framework with documented quantitative testing for unfair discrimination. Auto and health benefit plan carriers must have it available on request from July 1, 2026, plus an officer-signed annual compliance report. |
| New York | DFS Insurance Circular Letter No. 7 (July 11, 2024) | Underwriting and pricing. Proxy testing of external consumer data, written standards for vendor AI, and audit rights in vendor contracts "where appropriate and available." |
| California | Bulletin 2022-5 (June 30, 2022) | Bias and proxy discrimination from AI and big data in marketing, rating, underwriting, claims, and fraud investigation. |
| Texas | Bulletin B-0036-20 (2020) and B-0003-26 (June 12, 2026) | Carriers answer for the accuracy of third-party data. TDI expects a person to review consequential AI decisions and procedures furnished on request. |
| Virginia | Administrative Letter 2024-01 (July 22, 2024) | Adopts the bulletin, but the AIS Program "should be designed to eliminate the risk" of adverse consumer outcomes. The model says mitigate. |
Colorado also passed SB 26-189, its automated decision-making law, which takes effect January 1, 2027. It treats carriers already subject to the state's insurance AI statute as compliant in the practice of insurance. The 2026 state AI regulations guide covers each state in detail.
Examiners ask for evidence, and the questions are standardized
The NAIC turned the bulletin into a standard examiner question set, now called the AI Risk Evaluation Supplement (formerly the AI Systems Evaluation Tool). Its exhibits ask about:
- Exhibit A: how many AI systems the carrier uses, and where
- Exhibit B: the AIS Program, as a narrative or a checklist
- Exhibit C: high-risk AI models
- Exhibit D: the data used in those high-risk models
Regulators start with Exhibit A and decide from the answers whether to go further. Twelve states piloted the tool from March to September 2026 in market conduct exams, financial analysis, and financial exams. As of November 10, 2026, version 7.0 has not been adopted; it is on the agenda for an adoption vote at the Big Data and Artificial Intelligence (H) Working Group's November 16 Fall National Meeting session.
Federal action has not displaced any of this. Executive Order 14365 directed the Justice Department to challenge state AI laws, but McCarran-Ferguson leaves insurance to the states absent an act of Congress, Congress has passed no preemption, and the NAIC has asked the administration to "affirm state regulation of AI in the business of insurance."
Carriers prove compliance with records that already exist
An examiner reads the AIS Program and then asks to see it working. Each item below should exist before the request arrives:
- The AIS Program document, with a named senior owner and board approval
- An AI inventory that includes vendor models, since licensed AI counts
- A risk tier for each system, so underwriting, pricing, and claims models carry the most documentation
- Testing and drift records, bias and fairness included, before deployment and on a schedule afterward
- Vendor diligence and audit rights that let the carrier answer Exhibit C and D questions about third-party models
- A decision audit trail showing which inputs produced which outcome and what a person did with it
- Board reporting on AI risk, owners, and results
- Incident records with detection, timeline, and remediation
Testing history and monitoring logs can't be recreated after an examiner asks for them. The piece on why regulators are forcing AI governance covers where examiners find gaps.
Swept AI keeps this evidence current
Swept AI keeps governance mapped to NAIC and state requirements and current as they change. It records an audit-ready log of every AI interaction plus a model and agent inventory examiners can review, and it produces a board-ready Trust Report covering scope, methods, owners, and results.
To see where your program stands against the bulletin, take the NAIC Readiness Scorecard.
What do FAQs
As of the NAIC's November 3, 2026 implementation map, 29 jurisdictions have adopted it: Alaska, Arkansas, Connecticut, Delaware, the District of Columbia, Hawaii, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Mississippi, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, North Dakota, Oklahoma, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, Vermont, Virginia, Washington, West Virginia, and Wisconsin. California, Colorado, New York, and Texas have insurance-specific AI rules or guidance of their own.
Colorado Regulation 10-1-1 (3 CCR 702-10, amended effective October 15, 2025) requires life, private passenger auto, and health benefit plan carriers using external consumer data, algorithms, or predictive models to keep a risk-based governance and risk management framework, including documented quantitative testing for unfair discrimination. Auto and health carriers must have it available on request from July 1, 2026, and file an officer-signed compliance report on that date and annually after.
A written AIS Program, an AI inventory that includes vendor models, a risk tier for each system, testing and drift records, vendor diligence and contract audit rights, a trail from data to decision, board reporting, and incident records. These map to the exhibits of the NAIC AI Risk Evaluation Supplement.
Not today. Executive Order 14365 (December 11, 2025) directed the Justice Department to challenge state AI laws, but an executive order is not an act of Congress, and the McCarran-Ferguson Act leaves insurance regulation to the states unless Congress legislates specifically on insurance. Congress has not passed AI preemption, so state insurance AI rules remain in force.
It is the NAIC's standard question set for examiners reviewing a carrier's AI use, formerly called the AI Systems Evaluation Tool. Its exhibits cover AI usage, the AIS Program, high-risk AI models, and the data used in those models. Twelve states piloted it from March to September 2026, and version 7.0 is scheduled for a working group adoption vote on November 16, 2026.