- Twenty-nine jurisdictions now have AI governance expectations on insurers. Twenty-five states and the District of Columbia have adopted the NAIC Model Bulletin since December 2023; California, Colorado, New York, and Texas operate under their own insurance-specific frameworks. If a carrier writes business in any of these markets, AI governance program build-out is no longer preparation — it is current regulatory expectation.
- The NAIC AI Systems Evaluation Tool pilot runs through September 2026. Twelve states are piloting a structured framework that examiners will use during market conduct exams to assess insurer AI governance. Even non-pilot states will adopt the resulting template, so the pilot is a free preview of what every market conduct exam will look like by 2027.
- Adoptions are not uniform — at least three states materially changed the language. Virginia rewrote “mitigate the risk” as “eliminate the risk” and stiffened “consider addressing” to “should address.” Iowa was first to define both “bias” and “outcomes testing” formally. Connecticut requires an annual AI compliance certification. A multi-state carrier needs the version-by-version differences, not the assumption of uniformity.
- Colorado’s exemption from its general AI Act doesn’t reduce insurer obligations. The Colorado AI Act took effect February 1, 2026 with an explicit insurer carve-out — but only because insurers are already covered by 3 CCR 702-10, the state’s pre-existing insurance AI framework. That older framework’s outcomes-based testing requirement becomes enforceable in June 2026. Carriers writing in Colorado have a stricter regime than the AI Act itself.
- No formal enforcement actions yet — and the gap is closing. Through Q1 2026 there were no reported state enforcement actions under any adopted bulletin. The Evaluation Tool pilot, the March 2026 NAIC Issue Brief on federal AI legislation, and parallel buildout of state AI examination capacity all converge on the same horizon: 2027. Mature programs in 2026, not begin them.
The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. Sixteen months later, 29 jurisdictions have moved on it. That is fast. State insurance regulation does not usually move at this pace, and the pattern points at something more interesting than the bulletin text itself: state insurance commissioners have decided that AI governance is going to live under their supervision, not under whatever federal regime might or might not arrive. The bulletin gave them a coordinated way to plant that flag.
For a carrier’s project management office, the practical implication is straightforward but easy to underestimate. Twenty-nine markets have at least an articulated regulatory expectation around insurer AI use. Twenty-two more do not — yet. The question for any multi-state carrier is no longer whether to build a governance program; it is whether the program is built to handle 29 versions of broadly similar requirements, with the live possibility that the remaining 22 follow.
The Map at a Glance
The 25 jurisdictions that have adopted the NAIC Model Bulletin since December 2023, in alphabetical order: Alaska, Arkansas, Connecticut, Delaware, District of Columbia, Hawaii, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, Oklahoma, Pennsylvania, Rhode Island, Vermont, Virginia, Washington, West Virginia, and Wisconsin. The most recent adopter on the official April 1 NAIC map is Hawaii, whose Insurance Commissioner Memorandum No. 2025-13A took effect December 10, 2025.
Four jurisdictions are tracked separately by the NAIC because they regulate insurer AI use under their own pre-existing frameworks rather than via Model Bulletin adoption: California (Bulletin 2022-5), Colorado (3 CCR 702-10, with amendments effective October 2025), New York (Insurance Circular Letter No. 7), and Texas (Bulletin B-0036-20). Three of these predate the NAIC bulletin entirely. They are not gaps — they are different approaches that arrived at similar destinations earlier, and a carrier in those markets faces the state framework, not the NAIC version.
Twenty-two states have taken no formal action: Alabama, Arizona, Florida, Georgia, Idaho, Indiana, Kansas, Louisiana, Maine, Minnesota, Mississippi, Missouri, Montana, New Mexico, North Dakota, Ohio, Oregon, South Carolina, South Dakota, Tennessee, Utah, and Wyoming. The pattern of adoptions over the past year suggests these are timing-driven gaps rather than ideological holdouts; carriers should plan for at least half of these to act within the next 18 months.
Not All Adoptions Are Equal
Most adopting states copied the NAIC text with no substantive changes. A handful did not, and the divergences are the ones that change actual program design.
| State | What changed vs. NAIC text | PM implication |
|---|---|---|
| Virginia | Rewrote “mitigate the risk” to “eliminate the risk.” Stiffened “consider addressing” to “should address” across program elements. | Higher obligation standard. Examination questions follow the language. |
| Iowa | First state to define “bias” and “outcomes testing” formally. Bias = distortion or error producing inaccurate results. | Iowa’s definitions become the de facto definitions in Iowa exams — and other states will reach for them. |
| Connecticut | Added an annual AI compliance certification, requiring named officer attestation. Not in the NAIC text. | Forces governance program to produce something signable and externally defensible every year. |
| West Virginia | Removed sections on legislative authority and regulatory oversight. Substantive obligations similar but framing softer. | Open question whether softer framing produces softer examinations. |
The takeaway for multi-state carriers is unglamorous: the version of the bulletin that applies in a particular state may not match the version that applies in the next. Treating adoptions as uniform is a documentation gap waiting to be discovered during a market conduct exam.
The Big Four and Their Frameworks
Four jurisdictions sit outside the NAIC adoption count but are arguably the more important markets to understand, because they represent some of the largest insurance books in the country and they got there first.
California — Bulletin 2022-5 (June 2022)
The regulator-side opening shot. Focused on Big Data and unfair discrimination concerns rather than a formal AI governance program structure, but the substantive concern is the same as the NAIC bulletin’s: bias risk in pricing and underwriting decisions. The California Department of Insurance has been investigating these issues actively since 2022, and the absence of a NAIC-aligned framework does not mean the absence of regulatory pressure.
Colorado — 3 CCR 702-10 (effective Nov 2023; amendments Oct 2025)
The most substantive of the four state-specific frameworks. Establishes an outcomes-based testing requirement for life insurers using external consumer data and predictive models. The rule’s enforceability provision activates June 2026. Crucially, the broader Colorado AI Act (effective February 2026) explicitly exempts insurance, fraternal benefit societies, and AI developers serving insurers — but that is because the insurance-specific rule is already in place and is, in some ways, stricter. A Colorado-domiciled life insurer faces an outcomes-based test that the NAIC bulletin does not impose at all.
New York — Insurance Circular Letter No. 7 (July 2024)
Closer in tone to the NAIC bulletin but with the New York Department of Financial Services’ characteristic specificity around documentation expectations and third-party vendor oversight. Carriers operating in New York should expect document requests during market conduct exams that go beyond what the NAIC text would suggest.
Texas — Bulletin B-0036-20 (September 2020)
The oldest of the four and the narrowest in scope — focuses primarily on data accuracy in claims handling, underwriting, and rating practices. A Texas carrier is not exempt from broader AI governance expectations; it just operates in a market where the formal regulatory hook is narrower.
The Evaluation Tool Changes the Game
The single most important development for Q2 2026 is not on the static state map. The NAIC’s Big Data and Artificial Intelligence (H) Working Group is currently piloting a multistate AI Systems Evaluation Tool with twelve participating states. The pilot started in January 2026 and runs through September 2026.
The Evaluation Tool is a structured framework — Exhibits A through D, with the working group still revising the exhibits in February and March 2026 meetings — designed to give state examiners a standardized approach to reviewing insurer AI governance programs during market conduct exams. The pilot’s mechanism is unsubtle: twelve states will conduct AI-focused exam segments using the tool, identify what works and what doesn’t, and feed that back into a refined version that becomes available to all states.
The implications are not subtle either. The AI Systems Evaluation Tool will set the de facto template for how AI program scrutiny works going forward, regardless of whether a particular state adopted the Model Bulletin or chose its own framework. Industry trade groups have pushed back on the tool’s references to specific governance and risk assessment frameworks, urging that those references not be interpreted as creating new regulatory requirements beyond the bulletin itself. That pushback is real, and the working group is responsive to it. But the structural fact remains: by Q4 2026, every state insurance department in the country will have access to an examination tool that did not exist this time last year.
For carriers, the practical move is to treat the Evaluation Tool as the self-assessment benchmark. Whatever the final version looks like, the questions the tool asks during an exam are the questions a governance program needs to be ready to answer. And every quarter that passes between now and the pilot’s September close is a quarter of advance notice that does not get repeated.
What’s Next
The pilot wraps in September 2026. The working group will likely propose final tool revisions for adoption at the NAIC Fall National Meeting in November. Expect the Evaluation Tool to be available to all state insurance departments by the end of 2026, and expect the first market conduct exams using the tool — outside the pilot states — to occur during the first half of 2027.
- Federal AI legislation. The NAIC published a formal Issue Brief in March 2026 staking out its position on federal preemption questions. The brief argues, in essence, that insurance AI regulation is a state competency and should remain so. That posture will be tested if the federal landscape shifts.
- Colorado enforcement. The June 2026 enforceability date for outcomes-based testing in 3 CCR 702-10 is the first hard deadline in the U.S. for any state-level AI insurance rule. Whatever happens there will set early enforcement precedent.
- The gray states. Of the 22 states without formal action, several have working groups or pending legislation that could move during 2026 or 2027. Florida, Ohio, and Tennessee are worth watching specifically.
For PMs at insurance carriers, the operational implication is consistent: the next 12 months are when a governance program either matures or gets caught underbuilt. The regulatory infrastructure is being constructed in real time, and the carriers that look ready in 2027 are the ones whose programs are documented, audited, and externally defensible by Q4 2026.
Framework References
NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers (NAIC, December 4, 2023) — Sections 3 and 4 cited. Foundational text adopted by 25 jurisdictions to date.
Implementation of NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers (NAIC, April 1, 2026) — Full state-by-state citation list. Source for Q2 2026 adoption status.
NAIC Principles on Artificial Intelligence (NAIC, August 14, 2020) — Referenced in Section 1 of the Model Bulletin. Predicate framework that the Model Bulletin operationalizes.
Colorado 3 CCR 702-10, Governance and Risk Management Framework Requirements for Life Insurers (Colorado Division of Insurance, effective November 13, 2023; amendments effective October 15, 2025) — Outcomes-based testing requirement enforceable June 2026.
Colorado AI Act (SB 24-205) (Colorado General Assembly, effective February 1, 2026) — Article 50 of Title 6, C.R.S. Insurer exemption clause cited.
This article is part of AIPMO’s Insurance series. See also: AI Governance in Insurance | AI in Insurance Underwriting | AI Governance in Financial Services | AI Governance in Healthcare