What the bulletin says
- It is a model: each state issues its own version. The NAIC text is addressed “To: All Insurers Licensed to Do Business In” a state and reminds them that decisions made or supported by AI must comply with existing insurance laws, including those on unfair trade practices and unfair discrimination.
- It expects each insurer to develop, implement and maintain a written program (an “AIS Program”) for the responsible use of AI systems that make or support decisions related to regulated insurance practices, vested in senior management accountable to the board or a board committee.
- The program should be proportionate to the risk: it names the nature of the decisions, the degree of potential harm to consumers, the extent of human involvement, transparency to the consumer, and reliance on third-party data and AI.
- It covers the insurance life cycle, including marketing, underwriting, rating and pricing, claim administration and fraud detection, and AI built in-house or by a third-party vendor.
- It tells insurers a regulator may ask for the written program, governance records, and information about specific AI systems in an investigation or examination.
Where the bulletin points, in plain terms
| Bulletin topic | What it says | What an agency can ask or note |
|---|---|---|
| Who it addresses | Insurers licensed in the state | Whether your carriers have said it affects appointed agencies; the text itself does not address agencies |
| Governance | Written program, senior-management accountability | Who in your agency approves any AI tool, written down |
| Third-party AI | Due diligence on vendors; contract terms such as audit rights and cooperation with regulators, where appropriate | What each AI vendor can see and what your contract with it says |
| Consumer impact | Controls scaled to the potential harm of the decision | Keep AI to drafting and office work, with a person making the decision on coverage, pricing and claims |
| Documentation | Regulators may request records of AI use | Keep a short list of the AI tools used and what they are used for |
Where Virginia and other states stand
- Virginia.The NAIC’s map (status as of November 13, 2026) lists Virginia: Administrative Letter 2024-01, adopted July 22, 2024.
- Not the same everywhere.The same map lists California (Bulletin 2022-5), Colorado (3 CCR 702-10) and New York (Insurance Circular Letter No. 7, 2024) under insurance-specific regulation or guidance, not as bulletin adoptions.
- State versions differ.The NAIC text itself notes that states may define terms differently, so read your own department’s version before relying on the model text.
- Check the date.Adoption status changes as states act; the NAIC map is the source to recheck.
Where AdminOnsite fits
The bulletin does not tell agencies to buy anything, and AdminOnsite makes no claim that it satisfies any state’s bulletin. What it can do is shorten the answer to a carrier or regulator question about third-party AI: the AI runs on a Mac mini in your office, so client files the AI works on are not sent to an AI provider, and AdminOnsite staff with remote access are the one service provider to list. Whether your agency has any obligation under your state’s version is a question for your carriers, your state department and your advisors. Related: AI for insurance agencies and secure AI for business.
Questions
What is the NAIC AI model bulletin?
A model bulletin the NAIC adopted on December 4, 2023. It sets out expectations that insurers keep a written program governing their use of AI systems and comply with existing insurance law.
Does the NAIC AI bulletin apply to insurance agencies?
The model text is addressed to insurers licensed in a state and does not address agencies. How a state’s version or a carrier’s requirements reach an agency is a question for your carriers and state department.
Has Virginia adopted the NAIC AI bulletin?
The NAIC’s map, with status as of November 13, 2026, lists Virginia as adopted through Administrative Letter 2024-01 on July 22, 2024.
Does the bulletin say anything about third-party AI vendors?
Yes, for insurers: due diligence on third-party AI and, where appropriate and available, contract terms such as audit rights and cooperation with regulatory inquiries.
Does AdminOnsite make an agency compliant with the bulletin?
No. We make no compliance claims. The box keeps client files the AI works on in your office; any obligations under your state’s version remain yours and your carriers’ to define.