Governance and regulation

The regulatory and risk landscape

• NAIC Model Bulletin on the Use of AI Systems by Insurers (Dec 2023): adopted by 25 states plus D.C. as of early 2026 (adoption map). It expects every insurer using AI to maintain a written AI governance program covering inventory, risk assessment, human oversight, testing, and vendor-AI diligence. Regulators can request this documentation during market conduct exams.
• NAIC AI Systems Evaluation Tool: a standardized examination framework being piloted by twelve states March–September 2026 (pilot summary). Translation: AI governance is moving from "expectation" to "exam item."
• AI does not suspend existing law. Unfair trade practices, unfair discrimination, and rate regulation apply to AI-assisted decisions exactly as to human ones. "The model did it" is not a defense.
• Colorado remains the bellwether for algorithm and data-governance requirements (the SB 21-169 regime, currently life-focused but widely expected to expand by line).
• NIST AI Risk Management Framework (plus its Generative AI Profile) is the de facto scaffolding for a defensible governance program, and the one the NAIC bulletin echoes.
• EU AI Act: relevant only with EU business or operations. The two high-risk deadlines that matter to carriers fall in December 2027 (underwriting) and August 2028 (regulated products) under the amended implementation timeline; the regulation track of the timeline dates them alongside the NAIC milestones.

Top risks to manage, in order

1. 1Confidentiality: employees pasting policyholder or company data into consumer AI tools. Solved with enterprise agreements plus policy. Fix this first
2. 2Accuracy / hallucination in outputs that reach customers, regulators, or decisions.
3. 3Unfair discrimination / bias if AI touches risk selection or pricing.
4. 4Vendor risk: AI is arriving embedded in software insurers already buy; know where.
5. 5Over-reliance: staff accepting AI output without review ("automation bias").

Questions leaders should be asking

Use these in management meetings; they map to what examiners will ask:

1. Do we have a written AI governance policy and an inventory of where AI (including vendor-embedded AI) is used today?
2. Do employees have a sanctioned, enterprise-grade AI tool, and a clear rule about consumer tools?
3. For each use case: what is the human review step, and who is accountable for the output?
4. How would we answer a market conduct exam question about AI in underwriting or claims, today?
5. Which vendors have added AI features to products we already license, and what data do they see?
6. What is our measurement plan: are we tracking time saved, error rates, and adoption, or just launching pilots?
7. Who owns AI governance? (Common answer: a small cross-functional group of data science, legal/compliance, IT security, and a business sponsor.)

A pragmatic 90-day posture

1. Weeks 1–4: adopt an interim acceptable-use policy (template below); procure enterprise AI access with zero-data-retention / no-training terms; brief all staff.
2. Weeks 4–8: stand up the governance group; inventory current AI use including vendor tools; select 2–3 pilot use cases with named owners and success metrics.
3. Weeks 8–13: run pilots with human-in-the-loop review; measure; report results and a scale/kill decision to the executive team.

04813weeks

Interim policy, enterprise access, staff briefing · weeks 1–4

Governance group, AI inventory, pilot selection · weeks 4–8

Pilots with human review; measure; decide · weeks 8–13

◆

◆ scale-or-kill decision reported to the executive team

The goal is governed momentum: moving fast enough to learn, with guardrails proportionate to risk. The two failure modes are symmetric: banning AI (staff will use personal accounts invisibly, so-called "shadow AI") and ungoverned enthusiasm (which regulators are now actively examining for).

For the multi-year strategic view (where the industry stands, what competitors have deployed, and a phased 36-month progression with governance gates and economics) see the companion AI integration phases.

---

Responsible-use policy template

1. Scope

These guidelines apply to all employees and contractors using: general-purpose AI assistants; AI features embedded in vendor software (including underwriting, claims, and productivity platforms); and internally built AI/LLM applications. Traditional predictive models remain governed by existing model-governance policy; where an AI system feeds a regulated decision, both policies apply.

2. Sanctioned tools: the bright line

1. Use only company-approved AI tools [list; e.g., enterprise instances under company agreements with no-training and retention terms].
2. Never enter company, policyholder, claimant, broker, or employee information into personal or consumer AI accounts. This includes "just this once," and it includes screenshots.
3. Requests for new tools or AI-enabled vendor features go to [AI governance group] before use.

3. Data rules

Outputs derived from confidential inputs inherit the input's classification.

4. Human accountability

1. You own what you ship. AI output that you send, file, or act on is your work product. Review it as you would a junior colleague's draft.
2. Consequential decisions require human review. No AI output may, without documented human review, determine or effectively determine: risk selection or declination, pricing or rating, claim acceptance/denial or reserve values, coverage interpretations communicated externally, or personnel decisions.
3. Verify facts, numbers, and citations. Any figure, quotation, legal or regulatory citation, or policy-language reference must be checked against the source before use.
4. Disclosure: [company position; recommended minimum: disclose AI assistance within work products supporting actuarial opinions and regulatory filings; customer-facing disclosure per applicable state law].

5. Use-case risk tiers

6. Governance structure

• AI Governance Group: [named members; recommended: data science lead (chair), Legal/Compliance, IT Security, business-unit sponsor]. Owns this policy, the AI inventory, tool approvals, and tier classification.
• AI inventory: a living register of every AI system in use (internal, vendor-embedded, and experimental) with owner, tier, data touched, and evaluation status. This inventory is the first thing a market-conduct examiner will ask for.
• Vendor AI diligence: procurement and renewals must ask: Does this product use AI? On what data? Can it be disabled? What are the provider's training and retention terms?
• Incident handling: suspected AI-caused errors reaching customers, regulators, or financials are reported to [channel] within [24 hours]; treat like any other E&O-relevant incident.
• Records: for Medium/High-tier systems, retain prompts, configurations, model versions, evaluation results, and review decisions per [retention schedule].

7. Security notes

• AI systems that read external documents (submissions, emails, claims correspondence) are exposed to prompt injection: adversarial instructions embedded in those documents. Such systems must be designed with least-privilege tool access and no unreviewed external actions; Medium tier minimum.
• Report suspected AI-related phishing or deepfake contact (voice or video impersonation of executives, brokers, or claimants is now a standard fraud vector) to IT Security immediately.

8. Training requirement

All staff complete [AI awareness briefing] before tool access; Medium/High-tier system owners complete [role-specific training]. Re-certification [annually]. Review cycle for this document: [quarterly] by the AI Governance Group.