- Twenty-nine jurisdictions now have AI governance expectations on insurers. Twenty-four states and the District of Columbia have adopted the NAIC Model Bulletin since December 2023; California, Colorado, New York, and Texas operate under their own insurance-specific frameworks. If a carrier writes business in any of these markets, AI governance program build-out is no longer preparation — it is current regulatory expectation.
- The NAIC AI Systems Evaluation Tool pilot runs March through September 2026. Twelve states are piloting a structured framework for assessing insurer AI governance, and they are using it in market conduct exams, financial exams, and financial analyses alike. NAIC’s published timeline has the refined version considered for adoption at the November Fall National Meeting, so the pilot is a preview of the questions every state will be equipped to ask.
- Adoptions are not uniform — several states materially changed the language. Virginia asks insurers to eliminate the risk of adverse consumer outcomes where the NAIC text says mitigate. Iowa defines “bias” and interprets “outcomes testing” in the bulletin itself. Connecticut requires its domestic insurers to file an annual AI certification. A multi-state carrier needs the version-by-version differences, not the assumption of uniformity.
- Colorado’s insurer carve-out is not relief. Colorado repealed and replaced its 2024 AI Act with SB 26-189, effective January 1, 2027. Insurers subject to § 10-3-1104.9 are deemed in compliance for the practice of insurance — though not for their own employment decisions — because the insurance-specific regime already asks more. That regime, 3 CCR 702-10, was expanded in October 2025 from individual life to private passenger auto and health benefit plans, with evidence of compliance available to the Division on request from July 1, 2026.
- No publicly reported enforcement actions yet — and the gap is closing. Through Q1 2026 there were no publicly reported state enforcement actions under any adopted bulletin. The pilot, the coming examination template, and the parallel buildout of state AI examination capacity converge on the same horizon: 2027. That makes 2026 the year to mature a governance program, not the year to start one.
This article is a Q2 2026 snapshot, current to the NAIC map published April 1, 2026. Four corrections have been applied since publication: Colorado’s 2024 AI Act never took effect and was repealed and replaced by SB 26-189, effective January 1, 2027; 3 CCR 702-10 is a governance and risk management framework rather than an outcomes-testing mandate, and its July 1, 2026 date applies to auto and health benefit plan insurers; the Evaluation Tool pilot began in March 2026, not January; and the adoption count is 24 states plus the District of Columbia. Since this snapshot, Mississippi adopted Bulletin 2026-9 on July 22, 2026, and the NAIC has renamed the Evaluation Tool the AI Risk Evaluation Supplement.
The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. Twenty-eight months later, 29 jurisdictions have moved on it. That is fast. State insurance regulation does not usually move at this pace, and the pattern points at something more interesting than the bulletin text itself: state insurance commissioners have decided that AI governance is going to live under their supervision, not under whatever federal regime might or might not arrive. The bulletin gave them a coordinated way to plant that flag.
For a carrier’s project management office, the practical implication is straightforward but easy to underestimate. Twenty-nine markets have at least an articulated regulatory expectation around insurer AI use. Twenty-two more do not — yet. The question for any multi-state carrier is no longer whether to build a governance program; it is whether the program is built to handle 29 versions of broadly similar requirements, with the live possibility that the remaining 22 follow.
The Map at a Glance
The 25 jurisdictions — 24 states plus the District of Columbia — that have adopted the NAIC Model Bulletin since December 2023, in alphabetical order: Alaska, Arkansas, Connecticut, Delaware, District of Columbia, Hawaii, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, Oklahoma, Pennsylvania, Rhode Island, Vermont, Virginia, Washington, West Virginia, and Wisconsin. The most recent adopter on the official April 1 NAIC map is Hawaii, whose Insurance Commissioner Memorandum No. 2025-13A took effect December 10, 2025.
Four jurisdictions are tracked separately by the NAIC because they regulate insurer AI use under their own pre-existing frameworks rather than via Model Bulletin adoption: California (Bulletin 2022-5), Colorado (3 CCR 702-10, with amendments effective October 2025), New York (Insurance Circular Letter No. 7), and Texas (Bulletin B-0036-20). Three of these predate the NAIC bulletin entirely. They are not gaps — they are different approaches that arrived at similar destinations earlier, and a carrier in those markets faces the state framework, not the NAIC version.
Twenty-two states have taken no formal action: Alabama, Arizona, Florida, Georgia, Idaho, Indiana, Kansas, Louisiana, Maine, Minnesota, Mississippi, Missouri, Montana, New Mexico, North Dakota, Ohio, Oregon, South Carolina, South Dakota, Tennessee, Utah, and Wyoming. The pattern of adoptions over the past year suggests these are timing-driven gaps rather than ideological holdouts; carriers should plan for at least half of these to act within the next 18 months.
Not All Adoptions Are Equal
Most adopting states copied the NAIC text with no substantive changes. A handful did not, and the divergences are the ones that change actual program design.
| State | What changed vs. NAIC text | PM implication |
|---|---|---|
| Virginia | Asks for a written AI program designed to eliminate, rather than mitigate, the risk of adverse consumer outcomes. | Higher obligation standard. Examination questions follow the language. |
| Iowa | Defines bias as a distortion or error producing inaccurate results, and reads “outcomes testing” as validating that a model works as intended without unfairly discriminatory outcomes. | Iowa’s definitions are the operative ones in Iowa exams — and other states may reach for them. |
| Connecticut | Domestic insurers must file an annual AI Certification, first due September 1, 2024. Not in the NAIC text. | Forces the governance program to produce something signable and externally defensible every year. |
| West Virginia | Leaves out much of the legislative-authority language and the regulatory oversight and examination section, while keeping the OIC’s authority to ask about AI use. Framing softer. | Open question whether softer framing produces softer examinations. |
The takeaway for multi-state carriers is unglamorous: the version of the bulletin that applies in a particular state may not match the version that applies in the next. Treating adoptions as uniform is a documentation gap waiting to be discovered during a market conduct exam.
The Big Four and Their Frameworks
Four jurisdictions sit outside the NAIC adoption count but are arguably the more important markets to understand, because they represent some of the largest insurance books in the country and they got there first.
California — Bulletin 2022-5 (June 2022)
The regulator-side opening shot. Focused on Big Data and unfair discrimination concerns rather than a formal AI governance program structure, but the substantive concern is the same as the NAIC bulletin’s: bias risk in pricing and underwriting decisions. The California Department of Insurance has been investigating these issues actively since 2022, and the absence of a NAIC-aligned framework does not mean the absence of regulatory pressure.
Colorado — 3 CCR 702-10 (effective Nov 2023; amendments Oct 2025)
The most substantive of the four state-specific frameworks. It requires insurers using external consumer data and information sources, and the algorithms and predictive models built on them, to maintain a documented governance and risk management framework — including a documented description of quantitative testing for unfair discrimination. The August 2025 amendment, effective October 15, 2025, extended the regulation from individual life insurers to private passenger auto and health benefit plan insurers, who must have evidence of compliance available to the Division on request from July 1, 2026. Colorado’s general AI law took a different path: the 2024 AI Act never took effect and was repealed and replaced by SB 26-189, effective January 1, 2027, which deems insurers subject to § 10-3-1104.9 compliant for the practice of insurance but not for their own employment decisions. The carve-out is not a discount. It is available only to carriers already doing the governance work.
New York — Insurance Circular Letter No. 7 (July 2024)
Closer in tone to the NAIC bulletin but with the New York Department of Financial Services’ characteristic specificity around documentation expectations and third-party vendor oversight. Carriers operating in New York should expect document requests during market conduct exams that go beyond what the NAIC text would suggest.
Texas — Bulletin B-0036-20 (September 2020)
The oldest of the four and the narrowest in scope — focuses primarily on data accuracy in claims handling, underwriting, and rating practices. A Texas carrier is not exempt from broader AI governance expectations; it just operates in a market where the formal regulatory hook is narrower.
The Evaluation Tool Changes the Game
The single most important development for Q2 2026 is not on the static state map. The NAIC’s Big Data and Artificial Intelligence (H) Working Group is currently piloting a multistate AI Systems Evaluation Tool with twelve participating states. The pilot started in March 2026 and runs through September 2026.
The Evaluation Tool is a structured framework — Exhibits A through D, with the working group revising the exhibits across its February 2026 meetings — designed to give state examiners a standardized approach to reviewing insurer AI governance programs. Pilot states are using it in market conduct exams and reviews, in financial analysis, and in financial exams. The pilot’s mechanism is unsubtle: twelve states will use the tool in live regulatory work, identify what works and what doesn’t, and feed that back into a refined version issued for public comment.
The implications are not subtle either. The AI Systems Evaluation Tool will set the de facto template for how AI program scrutiny works going forward, regardless of whether a particular state adopted the Model Bulletin or chose its own framework. Industry trade groups have pushed back on the tool’s references to specific governance and risk assessment frameworks, urging that those references not be interpreted as creating new regulatory requirements beyond the bulletin itself. That pushback is real, and the working group is responsive to it. But the structural fact remains: by Q4 2026, every state insurance department in the country will have access to an examination tool that did not exist this time last year.
For carriers, the practical move is to treat the Evaluation Tool as the self-assessment benchmark. Whatever the final version looks like, the questions the tool asks during an exam are the questions a governance program needs to be ready to answer. And every quarter that passes between now and the pilot’s September close is a quarter of advance notice that does not get repeated.
What’s Next
The pilot wraps in September 2026. The working group will likely propose final tool revisions for adoption at the NAIC Fall National Meeting in November. Expect the Evaluation Tool to be available to all state insurance departments by the end of 2026, and expect the first market conduct exams using the tool — outside the pilot states — to occur during the first half of 2027.
- Federal preemption. The state-versus-federal question over AI oversight remains unresolved. State insurance regulators have built this framework on the premise that insurance AI supervision is a state competency; any federal move would test that premise directly.
- Colorado. July 1, 2026 is when private passenger auto and health benefit plan insurers must have evidence of compliance with 3 CCR 702-10 available on request, and January 1, 2027 is when SB 26-189 takes effect. How the Division handles the first round will set early expectations.
- The gray states. Of the 22 states without formal action, several have working groups or pending legislation that could move during 2026 or 2027. Florida, Ohio, and Tennessee are worth watching specifically.
For PMs at insurance carriers, the operational implication is consistent: the next 12 months are when a governance program either matures or gets caught underbuilt. The regulatory infrastructure is being constructed in real time, and the carriers that look ready in 2027 are the ones whose programs are documented, audited, and externally defensible by Q4 2026.
Framework References
NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers (NAIC, December 4, 2023) — Sections 3 and 4 cited. Foundational text adopted by 24 states and the District of Columbia as of the April 1, 2026 map.
Implementation of NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers (NAIC, April 1, 2026) — Full state-by-state citation list. Source for Q2 2026 adoption status.
NAIC Principles on Artificial Intelligence (NAIC, August 14, 2020) — Referenced in Section 1 of the Model Bulletin. Predicate framework that the Model Bulletin operationalizes.
Colorado 3 CCR 702-10, Regulation 10-1-1, Governance and Risk Management Framework Requirements (Colorado Division of Insurance, effective November 13, 2023; amendments effective October 15, 2025) — Extends the framework to private passenger auto and health benefit plan insurers; compliance available on request July 1, 2026.
Colorado SB 26-189, Automated Decision-Making Technology in Consequential Decisions (Colorado General Assembly, signed May 14, 2026; effective January 1, 2027) — Repeals and replaces SB 24-205. Insurer deeming provision cited.
This article is part of AIPMO.co’s Insurance series. See also: AI Governance in Insurance | AI in Insurance Underwriting | AI Governance in Financial Services | AI Governance in Healthcare
To err is AI; to govern, human.