In ten minutes you will know what the NAIC AI bulletin says, where it applies, how it lands on an agency's desk, and the five things to do before a carrier asks.
You did not write an underwriting algorithm. You do not run a claims model. So why should an independent agency care about a bulletin written for insurers?
Because the carriers you represent are being told to watch everyone whose work touches their AI. That includes you.
What the bulletin is
The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023. It is guidance, not law. It becomes enforceable in a state when that state's insurance department issues it, as Openlayer's July 2026 review puts it.
The core ask is simple to say and hard to do: if an insurer uses AI in decisions that affect consumers, it needs a written program to govern it. Optro's August 2026 walkthrough breaks that program into a few parts:
- Governance. A written program with named people accountable for it.
- Risk management and controls. Testing for accuracy, bias and drift, repeated over time, not done once.
- Third-party oversight. The bulletin treats AI systems and data from vendors the same as systems built in house.
- Documentation. Records a regulator can ask to see during an exam.
- Consumer notice. Telling people when AI systems are in use.
The bulletin also lets an insurer build on an existing framework, and it names the NIST AI Risk Management Framework as one option.
Who it covers, and how it reaches you
It covers insurers. It reaches agencies through that third-party piece.
Think about where AI touches a policy before the carrier ever sees it. An agency tool pre-fills an application. A model reads a loss run and summarizes it for the submission. A chatbot answers a client's question about a deductible. Every one of those can feed a carrier's decision.
A carrier that has to document its vendors and data sources will, sooner or later, send you a questionnaire. You want to answer it in an afternoon, not a panic.
Where it has been adopted
About half the states, plus Washington, D.C. The exact count depends on the date you check and whether "substantially similar" counts.
- The NAIC tracks adoptions on its implementation map. The latest version we checked carries a May 1, 2026 status date.
- Lumenova's March 2026 guide counted 25 states and D.C. from the March 3, 2026 map, and noted 11 jurisdictions had issued bulletins by April 2024, among them Alaska, Connecticut, Illinois, Kentucky and Maryland.
- Openlayer counted 25 states with 8 more in progress as of July 2026.
Four big states have their own insurance-specific AI frameworks, and Lumenova notes the NAIC bulletin sits alongside them, not above them:
| State | Its own framework |
|---|---|
| Texas | Bulletin B-0036-20, September 2020 |
| California | Bulletin 2022-5, June 2022 |
| Colorado | SB21-169 and its governance regulation, 3 CCR 702-10, effective November 2023 |
| New York | Insurance Circular Letter No. 7, issued July 11, 2024 |
New York's letter covers insurers' use of AI systems and external consumer data in underwriting and pricing, and like the NAIC model it expects insurers to oversee the vendors they rely on.
If you write in several states, assume the strictest one sets your bar.
What regulators will ask for next
Exams, not fines, are the near-term pressure.
As of the first quarter of 2026, no formal enforcement action under an adopted bulletin had been publicly reported, per Optro. The machinery is being built instead. The NAIC began piloting its AI Systems Evaluation Tool, since renamed the AI Risk Evaluation Supplement, with 12 participating states in March 2026, and formal adoption was expected at the 2026 Fall National Meeting.
Translation for a carrier: examiners will arrive with a structured list of questions. Translation for you: the carrier will want your answers ready when the examiner asks about distribution partners.
What your agency should do now
Five steps. None needs a consultant.
- List every AI tool in the building. Include the ones people pay for on personal cards. Liberty Mutual's 2026 study found 65% of agents used AI for work in the past year, so assume it is there.
- Mark where each tool touches a client decision. Drafting a marketing email is low risk. Summarizing a loss run that goes into a submission is not.
- Write a one-page AI policy. Approved tools, what data may go in, who reviews output. Here is how to write an AI policy for your agency, template included.
- Ask your AI vendors the hard questions about training, retention and breach notice. Is ChatGPT safe for insurance client data? has the list.
- Keep a record when AI shapes advice. What the client asked, what the tool produced, what a licensed person checked and changed. That record answers a carrier, an examiner and an E&O adjuster at the same time.
Start the list with this table. Copy it into a sheet and fill one row per tool.
AI TOOL INVENTORY: [AGENCY NAME] Updated: [DATE] Owner: [NAME]
Tool | Plan / account type | Who uses it | What it is used for | Client data that goes in | Touches a carrier decision? (Y/N) | Human review step | Vendor trains on our data? (Y/N) | Contract or terms link
---- | ------------------- | ----------- | ------------------- | ------------------------ | --------------------------------- | ----------------- | ------------------------------- | ---------------------
[ChatGPT Business] | [Business] | [CSRs] | [Email drafts, form summaries] | [None / redacted only] | [N] | [Producer reads before sending] | [N] | [link]
Where the human sits
Every framework above comes back to one idea: a person is accountable for what the AI produced.
That is how Salience works with agencies. You forward the request, Salience prepares the certificate, application or renewal, and nothing goes out until someone at your agency approves it. The approval is the human in the loop, and it leaves a record.
If the vocabulary in vendor pitches is part of the problem, read what AI agents for insurance agencies actually are.
This is a summary, not legal advice. Read your state's bulletin and talk to counsel or your E&O carrier about your situation. For more on risk, data and rules, see what to watch out for with AI.
Give us a call
Hey, all the tech is great, and innovation is great. There's a lot of responsibility and liability across the entire space, and a lot of people are saying the same words that mean different things. Give us a call. We plug in specifically to your processes and take care of the GDS first to unlock you and bring home the bacon.
Call +1 (916) 866-7867 or book a walkthrough.
Would you rather approve this than type it?
Forward the request or the prior application. Salience prepares the form, flags what's missing, and nothing goes out until you approve it.
Frequently asked questions
What is the NAIC AI model bulletin?
It is guidance the National Association of Insurance Commissioners adopted on December 4, 2023 on how insurers should govern the AI systems they use. It asks insurers for a written AI program covering governance, risk controls, testing, vendor oversight and documentation, and it carries legal weight in a state once that state issues it.
Which states have adopted the NAIC AI model bulletin?
About half the states plus Washington, D.C. One guide counted 25 states and D.C. from the March 3, 2026 version of the NAIC's implementation map. California, Colorado, New York and Texas also have their own insurance AI frameworks. Check the NAIC map for the current list.
Does the NAIC AI model bulletin apply to insurance agents?
It is written for insurers. It reaches agencies through the insurer's duty to oversee third parties and the data and systems they rely on, so expect carriers to ask how your agency uses AI in work you do on their behalf.
Where is the NAIC AI model bulletin adoption map?
The NAIC publishes it as a PDF on its website, content.naic.org, and updates it as states act. The latest version we checked carries a May 1, 2026 status date.
Is the NAIC AI bulletin being enforced?
No formal enforcement action under an adopted bulletin had been publicly reported as of early 2026. Regulators are building the exam side instead: the NAIC began piloting an AI evaluation tool with 12 states in March 2026.