The United States approaches a “fork in the road” on AI development, while state insurance regulators continue enhancing their examination powers.
In a summer full of headlines, discussion regarding an elevated concern over safety and regulation of artificial intelligence (AI) may be what we remember most. Reported AI safety incidents followed growing public concern, fueled by discussion among experts and commentators, that AI development may be outpacing safety efforts, particularly around self-improving systems (recursive self-improvement, or RSI). Reactions from the AI industry, government, and media reignited debate over federal regulation versus industry self-regulation, with some calling for a pause in AI development and others pushing to move full speed ahead in pursuit of US dominance.
With competing proposals in Congress unlikely to advance in the near term, the question of how to manage liability for frontier AI development remains unresolved. Some in the government and the industry oppose a liability shield for AI developers, arguing that exposure to liability is precisely what compels them to adopt robust risk management practices. At the same time, the insurance industry continues to weigh how far it is willing to go in covering AI-related risks.
Against this backdrop, state insurance regulators are forging ahead with plans to apply their existing statutory and examination authority to insurers’ use of AI. We summarize a few recent developments below.
NAIC governance framework – AI risk evaluation supplement
We detailed in prior reports the work, since 2019, of state insurance regulators to regulate AI, primarily through the National Association of Insurance Commissioners (NAIC). Regulators have expressed concern over various safety and related risks, including the potential for AI systems to produce biased or discriminatory outcomes for consumers, limited transparency into automated decision-making, insufficient human review of generative AI, and data privacy.
To date, roughly half the states have adopted the NAIC’s Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (Model Bulletin), which outlines a comprehensive governance framework for insurers’ use of AI and machine learning (ML). In addition to New York, other states have expanded on these principles, with examples summarized below. Colorado remains the only state imposing new requirements via legislation, though implementing rules have yet to be adopted, and there seems to be uncertainty around overall AI regulation in the state.
The NAIC is nearing completion of its AI Risk Evaluation Supplement (Supplement) (renamed from the AI Systems Evaluation Tool) as a practical examination-level framework for state regulators to assess AI governance practices of insurers. On August 31, 2026, the NAIC’s Big Data Working Group exposed version 5.0 of the Supplement for a 30-day public comment period ending September 29, 2026. This version of the Supplement reflects feedback from a 12-state1 pilot that began in March 2026. A final version is targeted for adoption at the NAIC Fall National Meeting in November. Insurers (including those domiciled outside the pilot states) should anticipate that the Supplement will serve as the standard framework for AI-related regulatory inquiries going forward.
The Supplement is designed to complement existing market conduct, financial analysis, and financial examination procedures. It includes optional exhibits for regulators to assess an insurer’s AI usage, governance practices, high-risk models, and data inputs. The 12 pilot states have been using the Supplement for market conduct exams, financial exams, financial analyses, and general regulatory inquiries for companies across property/casualty, life, and health lines.
The Supplement has the potential for indirect regulation of managing general agents, third-party administrators, and other third parties. Exhibit B of the Supplement, which evaluates an insurer’s AI Systems Program of controls for managing AI risk, asks insurers to explain oversight of third-party models and identify models operating inside the insurer’s system, including any AI embedded in third-party products. Third parties should expect their insurer partners to flow down documentation, audit, and disclosure requirements to support the insurer’s response to such regulatory inquiries.
Version 5.0 expands the Supplement’s scope to ML and general language models, meaning insurers deploying these technologies can now expect regulators to ask specifically about those systems and the governance surrounding them. Other key changes include clarified definitions aligned with the NAIC Financial Condition Examiners Handbook, a clearer distinction between AI “systems” and AI “models,” tightened materiality language, and additional questions on third-party oversight.
Following the close of written comments, the Big Data Working Group has tentatively scheduled a public meeting on October 8, 2026, to hear verbal comments. A subsequent version will then be exposed for a 14-day comment period in October, with a final version targeted for adoption at the NAIC Fall National Meeting in November 2026.
The NAIC’s Third-Party Data and Models Working Group continues to develop its Risk-Based Regulatory Framework for Third-Party Data and Model Vendors (Third-Party Framework), which is intended to provide regulatory oversight of third-party data and predictive models. The Third-Party Framework includes a broad definition of “third party,” which covers organizations providing data, models, or model outputs to insurers for use in pricing, underwriting, claims, marketing, or fraud detection, such as insurtech vendors, data aggregators, and AI platform providers.
The Working Group may produce a model law on this topic in 2026/2027. If ultimately adopted by the NAIC and implemented in a given state, the Third-Party Framework may result in the indirect regulation of third-party models as insurers remain accountable under state insurance laws for their use of such models. Insurers may seek to flow down compliance obligations.
More headlines and debate over the evolution and safety of AI/ML are a certainty, as is the impact of state insurance regulation on AI/ML use in the industry. Coupled with generally applicable state and federal regulation of model builders and deployers, we expect no pause in the number of developments to follow (with AI’s help) that could impact the insurance industry. And don’t be surprised if the AI liability insurance market has a major influence.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
[View Source]
