NAIC AI model bulletin puts insurers on the hook for AI governance

At a glance

What this is: Openlayer says the NAIC AI Model Bulletin is turning insurer AI oversight into an evidence problem, with examiners expecting proof of testing, monitoring, and accountable governance.

Why it matters: For IAM, NHI, and AI governance teams, the issue is that approval, monitoring, and vendor oversight now need auditable ownership and runtime evidence, not just policy statements.

By the numbers:

• 25 states had formally adopted the NAIC Model Bulletin by July 2026.

Context

The NAIC AI Model Bulletin sits at the intersection of insurance governance, model risk, and regulatory evidence. It is not just about whether an insurer uses AI, but whether it can show who owns the system, how it was validated before use, and how it is monitored once it affects underwriting, claims, or pricing decisions.

That matters because regulatory expectations are becoming operational, not theoretical. For organisations running AI across multiple states, the governance burden now includes documented review, vendor accountability, and proof that monitoring outcomes were acted on by someone with authority. In identity terms, this is a control-and-ownership problem as much as a model-risk problem.

For insurers, the starting position is no longer enough if it depends on informal sign-off or undocumented review. The article argues that examiners increasingly want evidence they can inspect, and that makes this a typical pressure point for any enterprise AI programme that spans jurisdictions.

Key questions

Q: What do insurers need to prove when AI is part of underwriting or claims decisions?

A: They need to prove who owns the model, how it was tested before deployment, how it is monitored after release, and how exceptions are escalated. Regulators are looking for evidence, not just policy language, so the governance programme must produce versioned records, reviewer attribution, and outcome logs that can survive examination.

Q: Why do third-party AI models still create regulatory risk for insurers?

A: Because the insurer remains accountable for the model’s outputs even when the model comes from a vendor. The bulletin’s look-through approach means regulators will expect the carrier to show documentation, fairness evidence, and monitoring records. A procurement contract does not replace operational control over outcomes.

Q: Where do AI fairness controls fail if teams only look at aggregate accuracy?

A: They fail when subgroup harms are hidden inside a good overall score. A model can appear accurate in aggregate while still producing adverse impact for protected classes or calibration gaps by group. The practical test is whether the programme can show subgroup-level evidence and a documented escalation path when thresholds are breached.

Q: How should insurers prepare for state examination of AI governance?

A: They should maintain a living AI inventory, retain test and monitoring records, and document who can approve, pause, or retire each system. Examiners are likely to ask for proof that governance is operating, not just written down, so the evidence chain needs to be complete from approval through ongoing oversight.

Technical breakdown

How the NAIC bulletin turns AI oversight into an audit trail problem

The bulletin converts broad AI principles into evidence requirements that regulators can examine. In practice, that means insurers need to show model inventory, ownership, pre-deployment testing, post-deployment monitoring, and documented escalation paths. The shift is important because a policy that says AI is governed is not the same as a system that produces durable proof of governance. For insurers, the relevant control surface now includes lifecycle records, reviewer attribution, and versioned outcomes, not just the model itself.

Practical implication: build governance so every model decision can be traced to a named owner, a test result, and a review action.

Why third-party AI creates a look-through accountability problem

When insurers buy scoring or decisioning models from vendors, the regulatory burden does not move with the contract. The insurer remains responsible for outputs, fairness, and ongoing oversight even when it cannot inspect model internals directly. That creates a look-through problem: the accountable party is the one making the decision, not the one supplying the model. This is especially relevant where AI systems influence adverse actions, because examiners will ask for evidence of control over outcomes, not proof that the vendor was involved.

Practical implication: treat vendor AI as part of your governed estate and require evidence you can present during examination.

Bias testing needs subgroup evidence, not aggregate accuracy

The article shows why AI fairness checks cannot stop at overall performance. Models that look accurate in aggregate can still produce harmful gaps across protected classes, especially when proxy variables such as ZIP code, occupation, or credit attributes track sensitive characteristics. That is why regulators expect adverse impact analysis, demographic parity review, and subgroup calibration checks before deployment and during ongoing use. The key issue is that average performance can hide disparate treatment or disparate impact, which means the control has to measure outcomes by group rather than by one global score.

Practical implication: test by protected class and subgroup, and require evidence of threshold breaches before a model can go live.

NHI Mgmt Group analysis

AI governance in insurance is becoming an evidentiary discipline, not a policy discipline. The bulletin does not merely ask whether a carrier has an AI policy on paper. It pushes firms to prove testing, monitoring, and accountability in a way regulators can inspect after the fact. That matters because governance without records cannot survive examination. Practitioners should treat this as a shift from framework adoption to control proof.

The look-through model changes how third-party risk works for AI. Insurers cannot outsource responsibility for the outputs of vendor-supplied models, even when they lack technical access to internals. That creates a governance obligation to obtain sufficient documentation, test outcomes independently, and monitor post-deployment drift. For identity and access leaders, the same lesson applies whenever a third party influences consequential decisions: ownership remains with the enterprise.

Bias testing is now an operational control, not a statistical afterthought. The bulletin’s fairness expectations force organisations to measure subgroup outcomes, not just overall model quality. That means the control is only real if it produces auditable evidence across protected classes and ties review thresholds to escalation. Practitioners should expect regulators to treat missing subgroup evidence as a control failure, not a documentation gap.

Insurers need an auditable AI lifecycle, not just governance language. The named concept here is the evidence gap: the distance between saying an AI system is controlled and being able to prove it with records. That gap is what examiners will probe across inventory, testing, monitoring, and vendor oversight. Organisations should close it by treating model governance as a continuous evidence chain from approval to retirement.

From our research library:

• 52% of respondents see AI security decision-making power shifting toward platform and infrastructure teams rather than the executive suite, according to the 2026 Infrastructure Identity Survey.
• Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
• Read next: Identity Security Programme Guide

What this signals

Evidence gap: the most important governance failure in insurer AI programmes is often not model quality, but the inability to prove who approved the model, what it did in production, and when exceptions were handled. For multi-state carriers, that gap widens because regulatory expectations are converging in principle but still vary in implementation.

The operational question is shifting from whether an AI system is compliant in theory to whether it can survive examination in practice. That makes AI lifecycle evidence, reviewer accountability, and post-deployment monitoring part of the control plane, not the paperwork layer.

Insurers should expect governance reviews to focus more heavily on proof of ownership and monitoring than on model claims alone. Where organisations cannot show those records, they are already behind the baseline the bulletin is creating.

For practitioners

• Document a named AI owner for every production model Assign clear accountability for underwriting, claims, pricing, and fraud models so examiners can trace decisions to a person or committee with authority to act.
• Keep versioned pre-deployment test records Store the input set, subgroup breakdown, threshold used, reviewer decision, and model version for every fairness or performance test run.
• Monitor post-deployment drift and adverse impact Track subgroup performance over time and require escalation when outputs change materially after release or vendor updates.
• Require vendor evidence for model oversight Make procurement collect documentation on training data sources, known limitations, audit rights, and incident notification duties before a third-party model is approved.

Key takeaways

• The NAIC bulletin is changing AI governance in insurance from a policy exercise into an evidence exercise.
• The strongest compliance pressure comes from accountability, vendor look-through risk, and subgroup fairness testing.
• Insurers that cannot produce versioned records, named owners, and monitoring evidence will struggle in examination.

Key terms

• AI System Assessment: An AI system assessment is a structured review of an AI-enabled tool’s purpose, risk level, and accountable owner before or during use. It creates a documented record that can be traced through the asset register, helping governance teams prove how the system was evaluated and approved.
• Adverse impact analysis: A fairness test that checks whether a protected group experiences worse outcomes than a reference group. In practice, insurers use it to evaluate selection rates, approval rates, or adverse action rates across subgroups, then compare the results against a defined threshold that can be defended during review.
• Look-Through Accountability: The principle that an organisation remains responsible for AI outputs even when a third party supplied the model. In insurer governance, the vendor relationship does not transfer regulatory accountability, so the buyer must retain evidence, oversight, and escalation capability.
• AIS Program: A written artificial intelligence governance program that defines how an organisation approves, monitors, and controls AI use. In regulated environments, it binds ownership, testing, third-party oversight, and evidence so the business can show accountability rather than simply state it.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, and secrets management from a practitioner perspective. It helps security and identity teams build the ownership, evidence, and lifecycle controls that modern governance programmes depend on.