AI in Insurance: Regulators Split on Next Steps
Regulators are split on whether to advance a model law to govern insurers' use of AI. The Big Data and Artificial Intelligence Working Group met Monday to weigh options after years of incremental progress.
The National Association of Insurance Commissioners adopted AI "principles" in August 2020, followed by a model bulletin in December 2023. Twenty-four states have adopted the bulletin so far, according to Michael Humphreys, Pennsylvania insurance commissioner and chair of the working group.
Why some regulators want to move now
Industry use of AI is accelerating, and some regulators say oversight needs to keep pace. "I think it's vitally important for us to be moving forward with some action ... as it relates to model laws or model regulations in the AI space," said Colorado Insurance Commissioner Michael Conway. He warned that if state insurance regulators lag, other agencies-state or federal-will fill the gap.
Colorado has already set binding rules for life insurers using external consumer data and information sources (ECDIS). Effective Nov. 14, 2023, life carriers must maintain a governance and risk management framework covering algorithms, data, and fairness controls tied to ECDIS. See NAIC's guiding principles for context on expectations around fairness, accountability, and transparency: NAIC AI Principles. Colorado's approach stems from SB21-169: Colorado SB21-169.
Why others urge patience
Iowa Insurance Commissioner Doug Ommen urged caution. He noted that the model bulletin and an evaluation tool already give regulators the footing to examine how carriers are using AI and ECDIS. That insight, he said, should inform any model law or regulation rather than moving first and fixing later.
Consumer advocates: move forward
Consumer advocates say the current bulletin fell short on discrimination safeguards outlined in the original AI principles. Peter Kochenburger, a visiting law professor and NAIC consumer liaison, argued that consumers lack clear rights around AI use in underwriting and claims. He urged the group to keep moving and not wait for "additional information" that could take years.
NCOIL's model: human-in-the-loop and audit trails
The working group also heard an update on a model law from the National Council of Insurance Legislators. The NCOIL Model Act Regarding Insurers' Use of Artificial Intelligence, based on a Florida bill that did not pass, would require that any denial of a claim or portion of a claim be made by a qualified human professional. That professional must review the accuracy of any AI output and insurers must keep detailed records of those actions.
Industry trade groups pushed back, arguing a one-size-fits-all model ignores differences in AI types and insurance lines. They called a model law "premature" and asked for a more thorough process. NCOIL plans to continue discussions during its annual meeting in November.
What insurers should do now
- Establish or refine an AI governance framework covering ECDIS, models, fairness testing, privacy, and security.
- Inventory AI use across underwriting, pricing, claims, fraud, and customer service. Document purposes, inputs, and decision impact.
- Define human review points for adverse decisions and build audit-ready records of human oversight and rationale.
- Stand up bias testing and monitoring. Validate data quality, shift detection, and model performance across protected classes where permitted.
- Map state requirements. Colorado's rules for life carriers set a baseline for governance and documentation that may spread.
- Tighten third-party risk management. Require vendors to disclose training data sources, model lineage, testing methods, and change logs.
- Train underwriting, claims, compliance, and actuarial teams on responsible AI practices and documentation standards.
- Align with the NAIC model bulletin. Be prepared to show examiners your framework, policies, testing results, and issue remediation.
Bottom line
Expect more scrutiny, uneven adoption across states, and possible federal interest. Whether a model law lands soon or later, carriers that build strong governance, human oversight, and clear documentation will move faster with less friction.
If you're building internal AI literacy and controls, see curated options for upskilling by role: AI courses by job.
Your membership also unlocks:
