AI Compliance in Insurance: NAIC Bulletin, Colorado, and New York

Is there a national AI rule for insurers?

No. Insurance is regulated state by state, and the closest thing to a national AI standard is a model bulletin that each state decides whether to adopt.

The National Association of Insurance Commissioners adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023. Several states modified the text when they adopted it.

The bulletin does not create a new standard of conduct. It reminds insurers that decisions made or supported by AI must comply with existing law, including unfair trade practices and unfair discrimination laws, and it tells them what regulators will ask for in an examination.

In practice, read the bulletin as the list of documents an examiner will ask to see.

Which states have adopted the NAIC bulletin?

As of October 8, 2026, the NAIC’s adoption map lists 27 states, the District of Columbia, and Puerto Rico as having adopted the bulletin:

Alaska, Arkansas, Connecticut, Delaware, the District of Columbia, Hawaii, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Mississippi, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, North Dakota, Oklahoma, Pennsylvania, Puerto Rico, Rhode Island, South Carolina, Vermont, Virginia, Washington, West Virginia, and Wisconsin.

The same map lists four states with their own insurance-specific AI regulation or guidance: California (Bulletin 2022-5, June 30, 2022), Colorado (3 CCR 702-10), New York (Circular Letter No. 7), and Texas (Bulletin B-0036-20, September 30, 2020).

Four adoptions came in 2026: Puerto Rico in June, Mississippi in July, South Carolina in September, and North Dakota on October 5. The count moves. Check the map before relying on it.

What does the NAIC bulletin expect?

The NAIC bulletin expects each insurer to have a written AI Systems Program, or AIS Program. It should cover AI systems used in regulated insurance practices whether the insurer built them or bought them from a vendor.

• Governance, with senior management accountable to the board or a board committee
• Risk management and internal controls across the AI lifecycle
• Coverage of product development, marketing, underwriting, rating and pricing, case management, claims, and fraud detection
• Processes for acquiring and overseeing third-party AI systems and data
• Documentation the department may request in an investigation or examination

The NAIC is also building an examination tool. Twelve states (California, Colorado, Connecticut, Florida, Iowa, Louisiana, Maryland, Pennsylvania, Rhode Island, Vermont, Virginia, and Wisconsin) piloted an AI Systems Evaluation Tool from March through September 2026. Commentators expected a revised version to be considered for adoption late in 2026. If adopted, it would give every state department a common checklist for AI exams.

What does Colorado require?

Colorado’s SB21-169, codified at C.R.S. 10-3-1104.9, bars insurers from using external consumer data and information sources, algorithms, or predictive models in a way that unfairly discriminates on the basis of race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression. The Division of Insurance writes the implementing rules.

The governance rule, Regulation 10-1-1 (3 CCR 702-10), took effect in November 2023 for life insurers that use external consumer data. An amended version took effect October 15, 2025 and extended the framework to private passenger auto and health benefit plan insurers. Law firm summaries report that those insurers owed an interim progress report by December 1, 2025, and full compliance with the first annual compliance report by July 1, 2026. Commentary on the amended rule reports that it names telematics as external consumer data.

The governance framework includes board oversight, an inventory, testing for unfair discrimination, ongoing monitoring, and annual reporting.

Quantitative testing standards are the open piece. A Division bulletin, as summarized by an industry publisher, says that because testing standards have not been adopted under Regulation 10-1-1, insurers are not currently required to describe quantitative testing in their annual reports. Confirm the current status directly with the Division.

Colorado’s general ADMT law, SB 26-189, also matters. The enacted law provides that an insurer subject to 10-3-1104.9 is in compliance with the new law regarding the practice of insurance. An insurer that is not deemed compliant must give the law’s adverse-outcome disclosures (C.R.S. 6-1-1708(1)). Employment decisions by insurers stay covered.

What does New York Circular Letter No. 7 require?

Circular Letter No. 7 sets out DFS’s expectation that insurers test AI and external data used in underwriting and pricing for unfair discrimination in three steps, govern those systems at the board level, and give specific reasons for adverse decisions. It applies to insurers authorized in New York that use AI systems or external consumer data in underwriting or pricing. It does not address claims or other stages of the insurance life cycle beyond underwriting and pricing, although it expects underwriting eligibility criteria to be disclosed in advertising and marketing materials. Unlike Colorado’s original rule, it applies to AI systems whether or not external data is used.

The three-step unfair discrimination analysis

1. Test whether the data or AI system produces disproportionate adverse effects for similarly situated insureds or protected classes.
2. If it does, determine whether a legitimate, lawful, and fair explanation accounts for the difference.
3. Search for and document a less discriminatory alternative that meets the same business need. Adopt it if one exists. Repeat the search at least annually.

DFS encourages using more than one metric. It lists the adverse impact ratio, denial odds ratios, marginal effects, standardized mean differences, z-tests and t-tests, and drivers of disparity such as Shapley values or regression coefficients. It also expects a qualitative assessment that can explain how the system works and why each variable relates to risk.

Governance, vendors, and notices

• Board oversight, written policies reviewed at least annually, an AI inventory, change logs, and drift monitoring
• The insurer may not rely solely on a vendor’s assurance of non-discrimination; responsibility stays with the insurer
• New York insurance law already requires specific reasons for certain adverse decisions, such as property and casualty cancellations and nonrenewals, and notice of the right to receive them for certain life and health decisions; where AI or external data is used, DFS expects the reasons to include all information the decision was based on and its source, and the insurer may not rely on the proprietary nature of a vendor’s algorithm to justify a lack of specificity
• If an underwriting process that uses AI or external data will not approve an applicant, so that the applicant can be insured only through traditional underwriting, written notice of the reasons within 15 days; where specific external data caused that result, a process to review those data for accuracy

How should an insurer test for unfair discrimination?

Test outcomes as well as inputs. Regulators ask whether a model produces different results by group, and most insurers do not collect race or ethnicity data from applicants, which makes the answer harder to get but does not make it optional.

Removing a protected attribute from a model does not show the model is fair if another variable, such as a credit attribute or a location, carries the same signal.

What about claims and health insurance?

Circular Letter No. 7 covers underwriting and pricing. Claims handling falls under the NAIC bulletin in adopting states and under each state’s unfair claims practices law.

For health coverage, California’s SB 1120 bars AI tools from making medical necessity denials and requires decisions based on the enrollee’s own records. Medicare Advantage plans must base medical necessity on the individual patient’s circumstances. See the health care guide.

What should a carrier do first?

Start by confirming which rule applies in each state, then build the program, inventory, and testing record an examiner will ask for.

• Confirm which rule applies in each state you write: NAIC bulletin, a state-specific rule, or none yet
• Write or update the AIS Program and get board or committee approval
• Build a model and data inventory that includes vendor systems
• Run outcome testing on underwriting and pricing models, and document the method
• Review adverse action notice templates for specific, sourced reasons
• Add audit, cooperation, and data correction rights to vendor contracts
• For Colorado auto and health lines, confirm the July 1, 2026 report was filed and calendar the next one

None of this is a new kind of duty. Unfair discrimination law already required insurers to justify their rating factors; AI makes that justification harder to write. See the governance frameworks guide for how NIST and ISO programs map onto these expectations.

This guide is general information as of October 2026, not legal or actuarial advice. Confirm requirements with each state insurance department.