A written program for the AI you use, and the records to back it up. The NAIC bulletin expects every insurer to govern the AI that makes or supports regulated decisions, and its definition is broad enough to reach a claims adjuster drafting a letter in ChatGPT, not only a pricing model.
What is the bulletin?
The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023, and each state insurance department issues it as its own bulletin. Its core line: insurers “are expected to develop, implement, and maintain a written program (an “AIS Program”) for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices.” The program should be “tailored to and proportionate with” how much the insurer relies on AI.
Which states have adopted it?
As of August 31, 2026, 26 jurisdictions: 25 states and the District of Columbia, including Illinois, New Jersey, North Carolina, Pennsylvania, Virginia and Washington. The same map lists California, Colorado, New York and Texas as having their own insurance AI rules or guidance.
Does it cover staff using ChatGPT?
When the use supports a regulated decision, the definition reaches it. An “AI System” is any machine-based system that can “generate outputs such as predictions, recommendations, content (such as text, images, videos, or sounds), or other output influencing decisions.” The program covers AI “whether developed by the Insurer or a third-party vendor,” across the life cycle from underwriting and pricing to “claim administration and payment, and fraud detection.” A chatbot summarizing a claim file or drafting a denial letter fits that description as well as any model does.
What does an examiner ask for?
The bulletin is direct: “Regardless of the existence or scope of a written AIS Program,” in an investigation or market conduct action “an Insurer can expect to be asked about its development, deployment, and use of AI Systems.” The list of requests includes the written program, its scope, “including any AI Systems and technologies not included in or addressed by the AIS Program,” due diligence on third-party AI, and the contracts with those vendors. So the AI staff use outside the program is part of the question.
What should an insurer do now?
- Inventory the AI in use, including the general tools staff reach for, and which decisions they touch.
- Write the program at the scale of that use, with the governance the bulletin names: “Monitoring, auditing, escalation, and reporting protocols.”
- Document as you go. The bulletin expects requirements “to document compliance with the AIS Program policies,” and that record is what you hand an examiner.
Where Verillian fits
Verillian keeps a record of every captured AI interaction on your own infrastructure, so when an examiner asks how staff use AI, the answer comes from your own record. Each entry is signed on the device and hash-chained to the one before it, and your own admin server flags any entry that does not link or verify when it arrives. Verillian never receives your prompts, responses or records.
Sources read on 28 October 2026.