The NAIC AI Model Bulletin is addressed to insurers, not to independent agencies. It asks insurers to run a written AI Systems Program covering governance, risk controls and third-party vendors. An agency is not named, but carriers may extend expectations through contracts, and existing unfair-practice rules still apply to producers. Treat it as a prompt to inventory your AI use.
That answer has two layers, and agencies often collapse them. The bulletin itself is a model document: it only becomes enforceable in a state when that state's insurance department issues it. And even where it is issued, its wording targets insurers. So the practical question is not "are we bound?" but "what will our carriers ask us, and what would a state examiner want to see if our AI use touched a consumer decision?" For most small agencies the practical answer is an inventory of AI tools, a one-page policy and a written question to each carrier. This is general information, not legal advice.
What the bulletin actually says, in plain words
The NAIC adopted the model bulletin on 4 December 2023. Its text opens by reminding insurers that decisions or actions affecting consumers, made or supported by advanced analytical and computational technologies including AI systems, must comply with existing insurance laws, including those on unfair trade practices and unfair discrimination. It is a reminder of existing law more than a new rulebook.
The core expectation is a written program, called an AIS Program, for the responsible use of AI systems that make or support decisions about regulated insurance practices. The program should reduce the risk of "adverse consumer outcomes", and its controls should match the risk: the nature of the decision, the potential harm to consumers, how much a human is involved, how explainable the result is, and how much the insurer relies on third parties. The bulletin lists what a good program covers: governance, risk management and controls, and internal audit; data practices including currency, quality and bias analysis; validation and testing; protection of non-public consumer information; record retention; and notice to impacted consumers that AI systems are in use.
It also covers third parties. The program should address AI systems and data bought from vendors, including due diligence, and contract terms where appropriate that give the insurer audit rights or audit reports and require the vendor to cooperate with regulatory inquiries. In the definitions, a "third party" is any organisation other than the insurer that provides services, data or other resources related to AI. Finally, the bulletin tells insurers what a regulator may ask for in an examination: the written program, inventories of models and AI systems, documentation of data sources, validation and testing records, and vendor oversight material.
The Complete Excel Course with AI Integration
From formulas and pivot tables to Power Query, DAX, VBA and AI with Copilot, ChatGPT and Claude — hands-on from the first lesson.
By Sagnik Bhattacharya and Virginia Thorn, Primetime Emmy Award winner
Buy nowWhere agencies sit: addressed to insurers, felt by agencies
The bulletin's addressees are "all insurers licensed to do business" in the state. Agencies, brokers and producers are not named in the text. Three routes can still bring its expectations to your desk.
- Carrier contracts and questionnaires: an insurer building its AIS Program will ask how AI is used across its distribution. An agency that uses AI on quotes, applications or customer messages may be asked to say so and to describe controls.
- Third-party status: if an agency supplies the carrier with AI-generated data or scoring, such as a lead score or a risk summary, the carrier may treat it as a third party under its program and ask for due diligence material. Whether that applies to you depends on the contract.
- Existing insurance law: unfair trade practice and discrimination rules, producer licensing standards and privacy obligations can apply to agents whether or not the bulletin does. The bulletin's own reasoning is that these laws apply "regardless of the tools and methods" used.
This is why the bulletin matters for agencies even though it does not name them. If a regulator reviewed a decision that touched a consumer and an AI tool was involved, you would want to show what the tool did, who checked it and what data it saw.
Adoption: what the NAIC map shows now
Law-firm summaries from late 2025 gave counts in the low-to-mid twenties, and the NAIC's own map dated 1 April 2026 showed 25 adopting jurisdictions. Both are out of date. The NAIC's implementation map with a status date of 3 November 2026 lists 29: 27 states, the District of Columbia and one territory. Four of the newest entries are dated June, July, September and October 2026, so the number is still moving. One trap: the NAIC's artificial intelligence topic page still links the April copy, so check the status date printed at the top of whichever map you open. Four further states are listed separately because they issued their own insurance-specific AI regulation or guidance instead of adopting the model text.
The map carries a caution worth repeating: it records state action or pending action and does not determine whether a state's version contains every element of the model. Wording, effective dates and examination practices differ. Look up your own state on the NAIC map, then read your department's bulletin itself. If you write in several states, do it for each, because an agency licensed in three states faces three versions.
The NAIC is also working on supervisory tooling. Its artificial intelligence page says 12 states were piloting an AI Systems Evaluation Tool as of March 2026, and that a Third-Party Data and Models group, formed as a task force in 2024 and now a working group, is developing a framework for third-party AI data and models. The page says the evaluation tool is expected to be adopted at the NAIC's 2026 Fall National Meeting. For an agency the signal is that vendor oversight is where regulators are heading, so your tool list matters.
The main worked example: a six-person agency builds its AI inventory
An illustration with invented details. A six-person independent agency writes personal and small commercial lines with eight carriers. Over a lunch, the principal asks each person what AI they touch. The list that comes back is longer than expected.
| Tool or use | What it touches | Consumer decision involved? | Risk (low, medium, high) |
|---|---|---|---|
| General chatbot to tidy email wording | Staff-written text, sometimes names | No | Low if names removed |
| AI notetaker on client calls | Recorded conversations, coverage details | Indirectly | Medium |
| Website chatbot answering policy questions | Public visitors, possibly personal data | Yes, answers may influence choices | High |
| Lead scoring in the CRM | Prospect data, may sort who is called first | Yes, access to service | High |
| AI to summarise policy wordings at renewal | Policy documents | Indirectly, informs advice | Medium |
| Submission intake tool that fills carrier forms | Application data | Yes, data goes to the carrier | High |
| Marketing text generator | No personal data | No | Low |
| Phone assistant for after-hours calls | Caller details, claim notices | Yes | High |
Eight uses, four rated high. The principal now knows where to put attention. For the four high-risk rows, the agency records the vendor, what data goes in, whether a person reviews the output before a consumer sees it or a carrier receives it, and what the vendor says about data use. That is the agency-sized version of the inventories the bulletin expects insurers to keep, and it takes about half a day. The detail of tools like the phone assistant is in can AI answer calls and qualify leads for an insurance agency.
Five agency scenarios and how the bulletin's logic applies
Scenario one: AI sorts which leads get a call
If a score decides who gets a prompt call and who waits, it affects access to service. The questions an examiner would ask are the bulletin's: what data feeds it, could it favour or disfavour groups unfairly, who checks. Remove protected-type inputs, sample the outcomes monthly, and keep a person able to override it.
Scenario two: a chatbot explains coverage
A chatbot that says "yes, that is covered" is giving coverage advice. Limit it to general information, link to the policy wording, and hand over to a licensed person for anything specific. Log the questions it cannot answer. The bulletin's emphasis on notice to consumers suggests telling visitors that it is an automated assistant.
Scenario three: AI compares wordings at renewal
This is a helpful use, and its failure mode is a missed exclusion. Keep a human reading the operative clauses. How brokers use AI to compare policy wordings sets out a checking routine.
Scenario four: submission data goes to carriers
If an AI tool fills carrier forms from client documents, an extraction error becomes a misstatement on an application. That is a consumer-harm route and a carrier-relationship route at once. Sample every batch against the source, and record who approved it.
Scenario five: AI drafts claims communications
Claims messages carry fair-handling expectations. Use AI for tone and structure only, never to decide or characterise a claim, and keep all coverage statements human. See how brokers use AI to handle claims enquiries.
Five common misreadings of the bulletin
The bulletin attracts confident summaries, some of them wrong. Five misreadings come up most often among agencies.
"It bans AI in insurance." It does not. The text encourages innovation that contributes to safe and stable markets, and asks for governance in proportion to risk. A tool that rewrites your marketing email sits at the low end; a tool that helps decide eligibility sits at the high end.
"It only matters if we use a fancy model." The definitions are broad: an AI system is a machine-based system that can generate outputs such as predictions, recommendations or content that influence decisions, and predictive models and machine learning are included. A CRM's lead-scoring feature can fall inside that net even if nobody calls it AI.
"We are small, so nobody will look." The bulletin scales controls to risk, not size. Examiners look at insurers first, but insurers inspect their distribution. A small agency that cannot describe its AI use will stand out in a carrier questionnaire.
"The vendor is responsible." The bulletin pushes responsibility back to the insurer even when a vendor built the system, and your carriers will reason the same way about you. Buying a tool does not transfer the duty to use it carefully.
"It is a single national rule." It is a model from a standards body of state regulators. Its force comes entirely from what each state does with it, which is why the map matters and why a national agency cannot assume one answer.
A carrier questionnaire, answered
To see how the inventory helps, take an illustrative questionnaire from a carrier and the six-person agency's answers. The questions are the kind a carrier building its own program might send; they are not quoted from any real carrier.
| Question | Agency answer (illustrative) |
|---|---|
| Does the agency use AI in handling our policyholders' data? | Yes, in four uses, listed in the attached inventory. |
| Does any tool influence coverage, price or eligibility decisions? | No. Lead scoring affects call order only and a person can override it. |
| Is human review applied before outputs reach policyholders or us? | Yes, a licensed person reviews, recorded in the file note. |
| Do vendors train on policyholder data? | Per vendor terms reviewed on [date]: two do not, one offers an opt-out that we have set. |
| How are incidents handled? | Reported to the owner the same day, logged, and notified to the carrier where policyholder data is involved. |
Look at the third vendor answer. The agency found that one tool trains on content by default and has an opt-out, and it set the opt-out. That is exactly the discovery an inventory makes possible. Without it, the agency would have answered "no" from assumption and been wrong.
A 30-60-90 day plan for an agency
In the first 30 days, build the inventory and write the one-page policy. Ask every staff member what they use, including personal accounts for work, because unapproved tools are the usual surprise. Switch off any tool that trains on client data by default, or stop putting client data into it.
By day 60, put the written questions to each carrier and file the replies. Review the four highest-risk uses and add one control to each, such as a review step, a disclosure line on the chatbot, or a monthly sample. If a tool cannot be controlled, retire it. By day 90, hold the first review: update the inventory, run the file sampling, and record any incidents and fixes. Put the next review date in the calendar and name the person who owns it.
This plan costs mostly time: roughly one to two days of the principal's attention over three months, plus a few hours per person. It is proportionate for a small agency and produces the paper trail a carrier or examiner would want to see. If you would rather work through the inventory with someone who has seen many setups, a 1:1 call can cover that; see the contact page.
Where agency uses meet consumer notice
The bulletin expects insurers to have processes that give impacted consumers notice that AI systems are in use, with appropriate information for the stage of the insurance lifecycle. For an agency, a sensible reading is to be open wherever a consumer deals directly with an automated tool. A website assistant should say it is automated. A recorded or transcribed call should be announced, with the consent practice your state requires. A message drafted with AI help needs no label if a licensed person has reviewed and sent it as their own, though some agencies add a line in their terms of business about how AI supports their work.
Write the wording once and reuse it. For a website assistant: "I'm an automated assistant. I can share general information, but I can't give advice on your cover. A member of our team can help with that." The sentence tells the consumer what the tool is and where the human is, which are the two things notice is meant to achieve.
A one-page agency AI policy you can adapt
[Agency name] AI use policy (illustrative; check with your adviser)
Owner: [name]. Reviewed: [date], then every six months.
1. Approved tools: [list]. Nothing else may touch client or prospect data.
2. Never enter: government ID or tax numbers, bank or card details, medical information, claim details, or recordings of clients without consent.
3. Human review: a licensed person reads anything AI drafts before a client or carrier sees it, and approves anything that could affect coverage, price or eligibility.
4. Disclosure: automated assistants identify themselves; staff tell clients when calls are recorded or transcribed.
5. Vendors: we record each vendor's data use terms, location of data, and whether they train on our data.
6. Records: we keep an inventory (tool, use, data, owner, date reviewed) and keep AI-assisted file notes as we would any other.
7. Problems: report errors to [name] the same day; we log them and fix the process.Two lines in this policy do most of the work: the human-review rule and the inventory. Together they answer the questions a carrier is likely to ask. The risk register idea is explained in a simple AI risk register for small businesses.
What to ask your carriers, in writing
Send a short note to each carrier's agency-support contact. Ask whether it expects agencies to follow any AI-specific requirements, whether the producer agreement has been or will be amended, whether it needs a list of AI tools used with its policyholders' data, whether it has an approved list of vendors, and whom to contact about incidents. Keep the replies. The agent who has asked and recorded the answer is in a better position than the agent who assumed.
Subject: AI use and agency requirements
Hello [first name], we're reviewing how our agency uses AI tools (call notes, drafting, quoting support). Does [carrier] have any requirements or guidance for agencies on AI use with your policyholders' data, and has the agency agreement changed for this? If you need a list of the tools we use, tell us the format you prefer. Thank you, [your name]Vendor questions that mirror the bulletin
The bulletin's third-party section translates neatly into questions an agency can put to any AI vendor. What data does the tool store and for how long? Is customer content used to train models? Can you delete a record on request? Where is the data processed? Is there an audit report or a security certification you can read? How does the vendor test for errors and bias? What happens when the vendor changes the model? A vendor that cannot answer in writing is telling you something. More general questions are in questions to ask an AI vendor before you sign.
How to check it is working
Review the inventory twice a year and after any new tool. Sample ten AI-touched files a quarter against the policy: was a person's review recorded, was anything entered that should not have been, did the output match the source? Record the result and one improvement. If a carrier or examiner ever asks, a thin but dated trail of inventory, policy and quarterly samples is far stronger than a long policy nobody follows. And if your state department publishes its own version of the bulletin, read it against your inventory once, because the words that matter are in that version.
NAIC bulletin questions agencies ask
Is the bulletin a law that binds my agency?
No. It is a model bulletin that state insurance departments adapt and issue, and its text is addressed to insurers holding a certificate of authority. State rules differ, and the unfair trade practice laws it relies on can also reach agents, so ask your state department or an insurance lawyer what applies to licensed producers.
How many states have adopted it?
The NAIC's implementation map, status as of 3 November 2026, lists 29 adopting jurisdictions: 27 states, the District of Columbia and one territory. Four other states are shown with their own insurance-specific rules or guidance. Check the status date printed on any map you open, because older copies still circulate.
Do I need a written AI policy?
The bulletin asks insurers for a written AIS Program, not agencies. A short agency AI policy is still sensible because carriers may ask about it, and because it records what staff may do. Keep it to one or two pages: approved tools, banned uses, review rules and an owner.
What should I ask my carriers?
Ask whether the carrier expects agencies to follow any AI requirements, whether its contract or producer agreement has changed, and whether it needs a list of the AI tools you use with its customers' data. Put the answers, and the date you asked, in a file.
Further reads
- How to Classify Business Data Before Using AI Tools — Sort customer data by sensitivity before any tool sees it.
- AI Bias in Small Business Decisions: Hiring, Pricing and Credit — How bias creeps into pricing, credit and similar decisions.
- How to Automate Insurance Renewals With AI and Keep More Clients — Renewal automation and where a human must stay in.
- Where AI Saves Time in a Small Insurance Brokerage — Where time is saved in an agency without raising risk.
- Does Cyber Insurance Cover AI Incidents? What Insurers Ask — What insurers ask your agency about AI use.
- AI Submission Intake: Stop Re-Keying Data Into Insurer Portals — Submission intake automation and where data goes.
- Hiring an AI Consultant for an Insurance Agency: Scope and E&O — A pre-hire question list with E&O and carrier checks, three first-project options sized against the saving, and a handover checklist.
- Does Agency E&O Cover AI Mistakes? What to Ask Your Carrier — A per-tool list of questions for your E&O carrier, the exclusion wording to look for, and the written AI policy that gives you evidence. Not legal advice.
- AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.
Sources: NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (adopted 4 December 2023), NAIC implementation map of the model bulletin (status as of 3 November 2026; the older 1 April 2026 copy for comparison), NAIC artificial intelligence topic page.