AI governance in insurance: what regulators are now expecting

TL;DR: U.S. insurance regulators are moving AI governance from guidance to operational expectation, with the NAIC Model Bulletin pressing insurers to inventory AI systems, formalise oversight, and manage third-party risk across the lifecycle, according to Holistic AI. The practical shift is less about model novelty and more about provable accountability, traceability, and control.

NHIMG editorial — based on content published by Holistic AI: AI Governance in Insurance: How U.S. Regulators Are Setting New Standards

Questions worth separating out

Q: How should insurers govern AI agents that access policy and claims data?

A: Insurers should govern AI agents as non-human identities with explicit scope, short-lived permissions, and auditable action trails.

Q: Why do AI systems in insurance need lifecycle governance rather than one-time approval?

A: Because AI risk changes after deployment.

Q: What do insurers get wrong about third-party AI risk?

A: They often focus on procurement checks and forget the ongoing governance dependency.

Practitioner guidance

• Build a complete AI inventory Record every AI system in use across underwriting, claims, customer service, analytics, and third-party platforms.
• Map governance to the AI lifecycle Assign controls at design, training, deployment, monitoring, and retirement so that drift, ownership change, and decommissioning are all covered by evidence.
• Tie AI oversight to identity controls Review the human approvers, service accounts, and vendor access paths that let AI systems operate.

What's in the full article

Holistic AI's full blog covers the operational detail this post intentionally leaves for the source:

• The article expands the NAIC Model Bulletin expectations into implementation-oriented AI governance steps for insurers.
• It outlines how insurers should inventory AI systems across business units and third-party tools.
• It summarises state-level adoption signals and the regulatory direction of travel.
• It connects governance expectations to practical compliance readiness actions.

👉 Read Holistic AI's AI governance analysis for U.S. insurance regulators →

AI governance in insurance: what regulators are now expecting?

Explore further

View Full Forum →  |  NHI Foundation Course →