What To Do If You Receive An NAIC AI Systems Evaluation Tool Pilot Request

Summary & Takeaways:

• The NAIC's AI Systems Evaluation Tool Pilot Project has begun generating domiciliary regulator requests for participation.
• The NAIC's Big Data and AI Working Group recently added context to the AI Tool Pilot Project via its February meeting discussion.
• Participating insurers must treat the request like an early-stage exam inquiry, inventory their AI, assume the Pilot Tool is evolving, lock down confidentiality and trade secret protection, and watch for updates from the NAIC Spring Meeting.

NAIC's Expanding Role in Insurance AI Governance

The National Association of Insurance Commissioners (NAIC) continues to act as the hub for how state insurance regulators develop artificial intelligence (AI) regulatory principles relating to consumer protection, underwriting and claims practices, market conduct, and overall risk. NAIC charges and priorities include developing model guidance, coordinating multi-state workstreams, and creating practical tools for state regulators.

The NAIC's AI Systems Evaluation Tool Pilot Project (the "NAIC Pilot") is one of the clearest signals yet that AI governance is moving from policy discussions to supervisory oversight. If your domiciliary regulator asks you to participate in the NAIC Pilot, treat the request as both: (i) an opportunity to help shape the emerging AI regulatory framework and build credibility and trust in the subject area; and (ii) a de facto early exam-style inquiry that may influence risk targeting and examination scope.

Tool Pilot Overview

The NAIC Innovation, Cybersecurity, and Technology (H) Committee's 2026 charges include: "Consider and coordinate the development of regulatory guidance and examination standards related to innovation, cybersecurity, data privacy, the use of big data and artificial intelligence (AI) including machine learning (ML) in the business of insurance, and technology . . ."¹ In support of that charge, the NAIC's Big Data and AI Working Group (BDAIWG) developed draft Artificial Intelligence Systems Evaluation Optional Supplemental Exhibits for State Regulators,² including Exhibit A (Quantify Regulated Entity's Use of AI Systems); Exhibit B (AI Systems Governance Risk Assessment Framework with Two Options: Narrative or Checklist); Exhibit C (High Risk AI Systems Details and Exhibit D; AI Systems Model Data Details).

These exhibits are being used in the NAIC Pilot. Initial participating states include CA, CO, CT, FL, IA, LA, MD, PA, RI, VT, VA, and WI. The projected NAIC Pilot window runs from March 2026 to September 2026, and some insurers have already received participation requests.

What Regulators Are Saying

BDAIWG's February 13, 2026 meeting minutes provide several interesting points for insurers:

• Regulators may tailor the tool and shift the dialogue based on responses.
• Confidentiality will rely on exam authority (states "will leverage their exam authority").
• The tool is expected to evolve based on pilot feedback and could be considered for broader adoption at the Fall National Meeting.
• Participation could be mandatory for companies depending on participating state discretion and circumstances.
• NAIC Pilot states may coordinate to reduce duplicative outreach across states.
• States are still deciding whether and how the NAIC Pilot aligns with financial examination process versus other inquiry tracks.

Key Response Factors

If your organization receives a request to participate, consider the following:

• Treat the Request Like an Early-Stage Exam Inquiry. Before drafting responses, align internally on: (i) what you are being asked to provide; (ii) who owns which responses (e.g., Legal/Compliance, IT/Security, Underwriting/Claims); and (iii) what the responses could trigger (e.g., follow-ups, deeper dives into high risk uses). The NAIC Pilot is being positioned as a risk identification tool, meaning that responses could influence how regulators asses an insurer's inherent risk profile. That stated, we are also aware that some participating regulators are providing assurances to participants that the NAIC Pilot will not be used as a compliance tool.
• Inventory Your AI. Most regulators will start with Exhibit A to scope your AI footprint. You should therefore build or refresh your inventory identifying: (i) AI-enabled use cases across underwriting, pricing, marketing, claims, fraud, customer service, compliance, HR, and cybersecurity; (ii) whether each system is in-house, vendor-provided, or hybrid; (iii) key inputs (data categories) and key outputs (decisions/recommendations); (iv) degree of automation; (v) whether the use case could be framed as "high risk" (e.g., consumer impact, eligibility, pricing, adverse action, material effect); (vi) governance controls; and (vii) third-party risk management.
• Assume the Pilot Tool is Evolving. The NAIC Pilot Exhibits and queries are still developing, and may be interpreted differently across states. Ask clarifying questions early, including: (i) how the regulator defines "AI System" for the purposes of the request; (ii) whether the regulator expects information at the program or system level; and (iii) whether the regulator expects disclosure of model architecture. NAIC Pilot states are encouraging participants to not only provide meaningful responses, but also feedback on the NAIC Pilot tool itself, allowing participants to assist in the development of the tool prior to a more fulsome industry rollout.
• Lock Down Confidentiality and Trade Secret Protection. Do not assume confidentiality automatically attaches to your responses. Before producing responses: (i) identify the governing confidentiality authority; (ii) use required confidentiality forms; (iii) mark everything; and (iv) control the transmission.

Watch For Updates and Extrapolate

The NAIC Pilot tool will continue to develop through NAIC meeting cycles, including updates expected at the NAIC Spring Meeting in San Diego. Insurers should monitor BDAIWG meeting minutes. To learn more about the NAIC Pilot, and ways to strengthen your AI governance program, reach out to one of our AI Team or Insurance Practice Group members.

Footnotes

1. See https://content.naic.org/committees/h/innovation-cybersecurity-technology-cmte.

2. See https://content.naic.org/sites/default/files/inline-files/AI%20Systems%20Evaluation%20Tool%204.0%20%28Clean%29.pdf.