Regulators are tightening focus on AI governance, emphasizing the system’s purpose, data sources, training, validation, risk classification, documentation, performance monitoring, change histories, and the ability to audit and explain outcomes, with clear human oversight for approval, challenge, intervention, and post-change actions.

Across insurers, roughly three-quarters struggle to identify which vendors use AI, with many only partially aware or not assessing AI use at all, creating a third-party risk blind spot.

NAIC guidance builds on a 2023 governance framework and anticipates a potential 2026 model law on third-party data and models, possibly including licensing for model vendors serving insurers.

Risk tiering concentrates scrutiny on vendors that influence consumer decisions, such as MGAs with delegated underwriting authority, while giving less review to vendors with minimal consumer impact.

Carriers should inventory AI usage across all vendors—what AI does, its autonomy level, and required human oversight—rather than relying on generic vendor policies.

A multi-state pilot will run through September, with public release of version 5.0 in September and planning for versions 6.0 and 7.0 ahead of the fall national meeting.

The supplement, renamed to reduce confusion, functions as a common information-gathering framework translating NAIC AI principles into concrete inquiries rather than a certification or new law.

A real-world example showed an insurer’s AI chatbot approving a claim far above the correct amount, highlighting risks that can trigger regulatory scrutiny and erode trust.

Regulators are shifting toward third-party governance without stifling innovation, with a 12-state field test of the AI Systems Evaluation Tool to map use, governance, risk, and vendor involvement during market conduct and financial exams.

Romano advocates an 'express lane' for vendor oversight with guardrails that scale scrutiny by consumer impact and data sensitivity, involving business owners, compliance, legal, and technology.

The overarching trend is that regulators will demand evidence of effective AI controls and governance, moving from policy documents to demonstrable controls and outcomes in underwriting, pricing, and claims.

Experts emphasize governance focusing on how vendors use AI in decisioning, data sources, training, bias, and data handling, especially where AI affects price, coverage, claims outcomes, or customer communications.