State Regulators Push Back on Federal AI Moratorium: What Insurance Operations Leaders Need to Know
State insurance regulators have urged Congress to reject proposals for a federal moratorium that could pause or preempt state authority over AI. Their core concern: broad federal definitions of "AI" and "automated decision systems" could pull routine insurance tools into new restrictions, slowing claims and underwriting when speed matters most.
The National Association of Insurance Commissioners (NAIC) signaled that state-based oversight is the proper venue and warned that sweeping definitions risk disrupting day-to-day operations, not just experimental projects. For operations leaders, the takeaway is simple-keep your AI and automation programs moving, but double down on governance, documentation, and contingency plans.
Why regulators are pushing back
Insurance has always been regulated at the state level, and the NAIC wants to avoid a one-size-fits-all freeze that stalls normal work. Many proposals define AI so broadly that standard tools-triage algorithms, document routing, fraud models, and even basic rules engines-could get treated like high-risk systems.
- Claims: FNOL triage, severity scoring, subrogation identification, fraud scoring, adjuster routing.
- Underwriting: prefill, risk segmentation, pricing models, producer decision support.
- Back office: RPA, document classification, call analytics, workflow prioritization.
Operational risk if definitions go too broad
Overreach doesn't just mean more paperwork. It can force slowdowns, manual rework, and vendor delays-especially painful during catastrophe events and seasonal spikes.
- Longer cycle times from new approvals, attestations, and model documentation.
- Model freezes or throttling if "AI" triggers blanket restrictions.
- Increased audit friction for everyday tools that never raised flags before.
- Vendor bottlenecks while partners reinterpret compliance obligations.
- Manual workarounds that introduce error risk and backlog.
A practical playbook for claims and underwriting
Prepare for stricter scrutiny without stalling progress. Build a control system that survives shifting definitions.
- Inventory and risk-tier all automations and models. Separate high-impact decisions (coverage, pricing, fraud flags) from low-impact utilities (document sorting, dedupe).
- Document data lineage: sources, transformations, third-party data, and retention. Keep an audit-ready trail.
- Set human-in-the-loop guardrails for high-impact decisions. Define clear override rules and escalation paths.
- Establish drift and performance monitoring. Track fairness, accuracy, and operational KPIs (cycle time, touch rate, leakage).
- Create model and automation "fact sheets" (purpose, inputs, outputs, limitations, contacts, last review).
- Strengthen vendor management: require change notices, validation summaries, and incident reporting within SLAs.
- Maintain contingency plans and kill-switches. Prove you can revert to safe defaults without grinding operations to a halt.
- Train adjusters, underwriters, and frontline teams on appropriate AI use, overrides, and documentation.
- Align with legal, compliance, and privacy early. Pre-clear templates for impact assessments and consumer notices.
Plan for dual oversight: state-first with potential federal touchpoints
Expect state-led oversight to remain primary, with possible federal expectations layered on top. The safest path is a risk-based program built on public frameworks and clear accountability.
- Adopt a common framework for AI risk management and map it to state requirements.
- Create a unified control library so one set of evidence satisfies multiple reviewers.
- Define metrics you can defend: fairness thresholds, override rates, appeal outcomes, and consumer complaint patterns.
- Stand up a cross-functional AI/automation council for approvals, exceptions, and incident review.
- Budget for validation, monitoring, and documentation as first-class operational costs.
For reference frameworks, see the NIST AI Risk Management Framework (NIST AI RMF) and NAIC materials on AI governance (NAIC AI Working Group).
Questions to put in front of your vendors now
- Which components of your product meet common definitions of "AI" or "automated decision" and why?
- What monitoring and drift controls do you provide? How often can we access audit logs and performance reports?
- How do you detect and handle bias? Share recent test results and remediation steps.
- What's your incident response process and notification SLA?
- Can you prove reproducibility of outputs for a given input and model version?
- What's your plan if regulations require explainability or human review at specific thresholds?
What this means for your roadmap
Don't pause legitimate automation because terms are in flux. Instead, tag anything that could be seen as "AI," apply proportionate controls, and keep projects moving with strong documentation. That posture satisfies most regulatory expectations without sacrificing cycle time or service.
The debate isn't about banning AI in insurance. It's about scope and accountability. If your program can show clear purpose, appropriate oversight, and a clean audit trail, you'll stay compliant while protecting throughput in claims and underwriting.
Need structured upskilling for your teams?
If you're building internal capability for AI governance and automation in operations, explore role-based learning paths here: Complete AI Training: Courses by Job.
Your membership also unlocks:
