AI rules for insurers in 2026: life, auto, home, health, and commercial

Which AI rules apply to insurers in 2026?

An insurer’s AI rules depend on the state and the line of business. In most states the NAIC model bulletin sets what an examiner will ask for across all lines. New York adds testing and governance expectations for underwriting and pricing. Colorado has a governance rule for life, private passenger auto, and health benefit plan insurers that use external consumer data and models. Health insurers also face state laws that limit how far AI can drive medical necessity denials.

No federal statute is written specifically for AI in insurance. The rules below are state insurance law, one EU regulation, and federal Medicare Advantage rules for plans in that program. Health insurers covered by Section 1557 of the Affordable Care Act also have a federal duty to identify and mitigate discrimination risk in certain patient care decision support tools (45 CFR 92.210). The site’s insurance AI guide covers each state rule in depth; this page sorts them by line of business and by what an organization has to produce.

Which rules apply to life, auto, home, health, and commercial lines?

The NAIC bulletin, in states that adopted it, reaches every line. The other rules attach to specific lines, so each book of business has its own map.

• Life. Colorado’s governance rule has applied to life insurers that use external consumer data since November 2023. New York Circular Letter No. 7 covers life underwriting and pricing. In the EU, risk assessment and pricing of individuals for life insurance is high-risk from December 2, 2027.
• Private passenger auto. Colorado extended its governance rule to auto insurers effective October 15, 2025. Commentary on the amended rule reports that it names telematics as external consumer data. Circular Letter No. 7 covers auto underwriting and pricing in New York.
• Home. Colorado’s regulation does not reach homeowners lines. The NAIC bulletin and, in New York, Circular Letter No. 7 do. Colorado’s SB 26-189 covers consequential insurance decisions made on or after January 1, 2027, subject to the court order noted in the table. Confirm with counsel whether a homeowners insurer counts as “subject to” 10-3-1104.9 for the law’s deemed-compliance provision.
• Health. Health carries the most rules: Colorado’s governance rule for health benefit plans, the state utilization review laws below, Medicare Advantage rules for plans in that program, and EU high-risk status for pricing of individuals.
• Commercial. Commercial lines face the fewest AI-specific rules. The NAIC bulletin is written around adverse consumer outcomes, and most state AI rules protect individuals. The bulletin’s exam expectations still apply to any AI system that affects consumers. Separately, an AI system used to make employment decisions about the insurer’s own staff falls under employment law, including Colorado’s SB 26-189 from January 1, 2027, subject to the same court order.

What will an examiner ask an insurer to produce?

Expect a document request, not a questionnaire about principles. Section 4 of the NAIC bulletin lists what a department may request in an investigation or market conduct action, and it applies whether or not the insurer has a written AI program.

• The written AI Systems Program, evidence of its adoption, and its scope, including any AI systems it does not cover
• Policies and procedures for developing, acquiring, and monitoring AI systems, including data lineage, data quality, bias analysis, and model validation thresholds
• Records of the committees that oversee AI, and of monitoring and audits of compliance with the program
• For third-party systems, the due diligence performed, the vendor contracts, audits of the vendor, and validation and drift testing

The NAIC’s examination supplement may make these requests uniform. Renamed in August 2026 from the AI Systems Evaluation Tool to the AI Risk Evaluation Supplement, it has four exhibits. As the working group described version 5.0 on August 31, 2026, Exhibit A covers AI systems and models and adds a model inventory request, Exhibit B the company’s AI Systems program, Exhibit C individual AI models, and Exhibit D the data elements the models use. Pilot states used formal examinations, separate surveys or data calls, or a combination. Version 5.0 opened a 30-day comment period on August 31, 2026, and the working group plans to present version 7.0 for adoption at the Fall National Meeting. As of October 21, 2026, it had not been adopted.

In New York, add the Circular Letter No. 7 testing record: the three-step unfair discrimination analysis, the metrics used, and the search for a less discriminatory alternative.

What may a health insurer not let AI decide?

A growing number of states restrict how AI or other sources can drive medical necessity denials. The five below are not a complete list, but they show how much the wording differs, and the differences decide what a workflow must look like. Washington’s law, for example, has applied since June 11, 2026, and other states enacted laws in 2026 that take effect later. Check every state where you review care.

• Texas SB 815. A utilization review agent may not use an automated decision system to make, wholly or partly, an adverse determination. The law permits such systems for administrative support or fraud detection, and the commissioner may audit and inspect their use at any time.
• Maryland HB 820. An AI, algorithm, or other software tool may not deny, delay, or modify health care services. The tool must base determinations on the enrollee’s clinical history, the individual circumstances a requesting provider presents, or other clinical information in the record, not solely on a group dataset. Covered entities must have the tool’s performance, use, and outcomes reviewed, and revised if necessary, at least quarterly. Carriers’ quarterly reports to the Commissioner must state whether such a tool was used in making adverse decisions.
• Nebraska LB 77. An AI-based algorithm may not be the sole basis of a decision to deny, delay, or modify services based in whole or in part on medical necessity. The agent must disclose AI use to the department, network providers, enrollees, and on its public website.
• California SB 1120. Only a licensed physician or qualified professional may deny or modify care for medical necessity; AI tools may not make those decisions and must rely on the patient’s own records.
• Arizona HB 2175. A medical director must individually review a claim or prior authorization denial that involves medical necessity, must exercise independent medical judgment, and may not rely solely on recommendations from any other source. The law does not mention AI; the bar covers recommendations from any source.

These are different tests. Nebraska’s AI bar, by its terms, reaches an AI-based algorithm that is the sole basis of the decision. A separate section of the same law requires a physician, or a clinical peer when the requester is not a physician, to make prior authorization adverse determinations. Under Texas’s law, an automated decision system may not make an adverse determination even in part. A utilization review workflow run across these states has to be checked against each state’s text, not against a general human-review standard.

Medicare Advantage plans are governed by CMS rather than state law on this point. See the health care guide.

What are the AI claim denial lawsuits, and where do they stand?

Three putative class actions accuse large health insurers of using algorithms to deny care. Each rests on allegations that have not been proven, and the insurers contest them. As of October 21, 2026, none had reached a judgment on the merits, and all three dockets were open.

• UnitedHealth (Estate of Lokken v. UnitedHealth Group, D. Minn.). Plaintiffs allege that UnitedHealth used an AI model, nH Predict, rather than people to make coverage determinations on post-acute care for Medicare Advantage members. The court’s order notes that UnitedHealth denies any use of nH Predict. On February 13, 2025, the court let the breach of contract and good faith and fair dealing claims proceed and dismissed five others with prejudice, most of them as preempted by the Medicare Act. Filings in September 2026 show the case still in litigation.
• Cigna (Kisting-Leung v. Cigna, E.D. Cal.). Plaintiffs allege that Cigna used an automated algorithm, PxDx, to let its doctors deny claims in batches that did not match pre-set criteria. On March 31, 2025, the court dismissed the ERISA benefits claim with leave to amend and let the ERISA fiduciary claim and a California unfair competition claim proceed for some plaintiffs. The case is open.
• Humana (Barrows v. Humana, W.D. Ky.). Plaintiffs allege that Humana relied on nH Predict for coverage decisions on Medicare Advantage post-acute care and that employees could not deviate from its output. An order filed August 15, 2025 let breach of contract, good faith and fair dealing, unjust enrichment, and common law fraud claims proceed and dismissed four others with prejudice. The docket shows the case still in litigation in October 2026.

For a compliance team, the useful lesson is procedural. Each complaint centers on an allegation that no person meaningfully reviewed the individual case, and several of the state laws above now address that question in statute.

What should an insurer put in an AI vendor contract?

Responsibility stays with the insurer. Circular Letter No. 7 says an insurer may not rely solely on a vendor’s claim of non-discrimination. The NAIC bulletin says an insurer’s AI program should address, as appropriate, due diligence to ensure that decisions made or supported by a vendor’s AI system that could lead to adverse consumer outcomes will meet the legal standards imposed on the insurer itself.

• Audit rights, or the right to receive audit reports from qualified auditors, as the bulletin suggests where appropriate and available
• A duty to cooperate with regulatory inquiries and investigations about the insurer’s use of the product
• Access to the data, variables, and test results the insurer needs to run its own unfair discrimination testing
• Enough explanation of outputs to state specific reasons in adverse decision notices; in New York, the insurer may not rely on the proprietary nature of a vendor’s algorithm to justify a lack of specificity
• For utilization review vendors, terms that match the state law: Maryland’s law reaches pharmacy benefits managers and private review agents that work for a carrier, and California’s reaches contracted entities
• Notice of material model changes, so drift testing and the inventory stay current

Vendors may face their own regime. On July 8, 2026, the NAIC’s Third-Party Data and Models (H) Working Group exposed a draft regulatory framework for third-party data and model vendors used in property and casualty pricing and underwriting. An earlier draft would have reached claims, utilization review, marketing, and fraud detection as well; the group narrowed it after comments. Willkie Farr describes an NAIC-hosted multistate vendor registry and reports that the group aims to present a draft for adoption by the 2026 Fall National Meeting. The framework is a draft, not a rule.

What should an insurer do first?

• Map each state you write in to its rule: NAIC bulletin, Colorado, New York, California, Texas, or none yet; recheck the NAIC adoption map each quarter
• Build one AI and model inventory across all lines, tagged by line, state, use (pricing, underwriting, claims, utilization review, fraud, marketing), and vendor
• Assemble the Section 4 exam file now: the written program, its board or committee approval, committee minutes, testing records, and vendor diligence
• For every health utilization review workflow, document where a licensed clinician makes the medical necessity denial and what role each tool plays, then check that role against each state’s text; in Texas, an automated decision system may not make an adverse determination even in part
• For Maryland, confirm quarterly reports flag adverse decisions in which an AI, algorithm, or software tool was used; for Nebraska, confirm the public website disclosure is posted
• Run and document outcome testing on New York underwriting and pricing models, including the less discriminatory alternative search
• For Colorado life, auto, and health lines, document the testing your governance framework describes and confirm with the Division whether quantitative testing standards have been adopted
• Amend vendor contracts to add audit, cooperation, data access, and change-notice terms
• For Colorado auto and health lines, confirm the July 1, 2026 report was filed, calendar the next one, decide how SB 26-189 applies to each other line from January 1, 2027, and track the enforcement bar in X.AI LLC v. Weiser
• If you price life or health cover for individuals in the EU, scope the Annex III high-risk duties against the December 2, 2027 date

Where to read more

The insurance AI guide covers the NAIC bulletin, Colorado’s regulation, and New York’s testing method in detail. The health care guide covers Medicare Advantage and California’s health laws, the state AI laws guide covers Colorado SB 26-189, and the EU AI Act guide covers high-risk duties and the Omnibus dates.

This page is general information as of October 2026, not legal or actuarial advice; confirm requirements with counsel and each state insurance department.