The insurance industry has spent the last decade absorbing a wave of AI-driven innovation: predictive underwriting models, automated claims triage, real-time fraud detection, and behavioral pricing algorithms that would have seemed like science fiction in 2010. That innovation is real, and the efficiency gains are measurable.
What changed in 2024 and 2025 is the regulatory response and how rapidly it moved from principle to examination.
For carriers operating across multiple states, 2026 is the year the governance question stops being theoretical. Regulators are no longer asking whether you use AI. They are asking how you govern it, how you test it for bias, and what your documentation looks like when an examiner requests it. The answers matter in ways they did not even 18 months ago.
The NAIC AI Pilot
In December 2023, the National Association of Insurance Commissioners adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers. The bulletin established expectations that any insurer using AI in regulated insurance practices should maintain a written governance program, an AIS Program, covering oversight structures, risk management, bias testing, third-party vendor management, and documentation adequate for regulatory review.¹
The NAIC’s approach was explicitly principle-based. The bulletin does not prescribe specific testing methodologies or mandate particular governance structures. It establishes a floor and signals examiner intent. Critically, it reminds insurers that decisions made or supported by AI remain subject to all applicable insurance laws, including unfair trade practice statutes and anti-discrimination requirements, regardless of whether a human was in the loop.²
By late 2025, 23 states and Washington, D.C. had adopted the bulletin in some form, with more states following suit.³ Over half of all states have adopted this or similar guidance, prompting the NAIC to formally urge the administration to affirm state authority over insurance AI oversight.⁴ The adoption pace signals that the bulletin is fast becoming a de facto national standard — but it is not a uniform one.
The NAIC’s own examiner surveys expose the core compliance gap carriers should be concerned about. The Big Data and Artificial Intelligence Working Group completed surveys across auto, homeowners, life, and health insurance lines between 2022 and 2025. The findings are notable:
AI adoption rates are high across the industry (92% of health insurers, 88% of auto insurers, 70% of homeowners insurers, and 58% of life insurers report current or planned AI usage.)⁵
But despite widespread adoption, the NAIC found that nearly one-third of health insurers still do not regularly test their models for bias or discrimination.⁶ That gap is precisely what regulators are moving to close.
The NAIC’s AI Systems Evaluation Tool, developed for use during market conduct examinations, is currently in a multistate pilot running from January through September 2026, with twelve participating states including Colorado, Maryland, Louisiana, Florida, Virginia, Connecticut, Pennsylvania, Wisconsin, Rhode Island, Iowa, Vermont, and California.⁷ Whatever the pilot produces will inform examination practice industry-wide.
The Patchwork is not a Framework
The defining compliance challenge is not whether you will be subject to AI oversight. You will. The challenge is that the oversight takes meaningfully different forms depending on which states you write business in.
At one end of the spectrum, Colorado enacted SB 205, the nation’s most comprehensive standalone AI governance statute, carrying full anti-discrimination requirements and annual impact assessment obligations for deployers of high-risk AI systems, with an effective date that has been pushed to June 30, 2026 following a special legislative session.⁸ The Colorado Division of Insurance’s existing regulation under C.R.S. §10-3-1104.9 predates the SB 205 framework and separately governs the use of external consumer data and predictive models, with quantitative bias testing requirements that expanded to auto insurance and health benefit plans effective October 2025.⁹
New York took a different path. DFS Circular Letter 2024-7, finalized July 11, 2024, establishes a detailed set of fairness principles and proxy assessment requirements for all insurers using AI or external consumer data in underwriting and pricing — without adopting the NAIC bulletin at all.¹⁰ New York’s approach is rooted in existing anti-discrimination law rather than a new statutory framework, but its operational requirements (multi-step bias testing, vendor audit rights, adverse decision disclosures) are specific and enforceable through existing examination authority.
Florida is watching a separate legislative track in 2026. HB 527, which cleared its first House stop unanimously in December 2025, would require a qualified human professional to review and approve any claims denial in which AI or algorithms were involved, with an effective date proposed for July 1, 2026.¹¹ Florida’s market recovery story, including the Citizens Property Insurance depopulation program, adds a layer of carrier operational complexity that makes claims AI governance both more consequential and more scrutinized.
For the 20-plus states that adopted the NAIC bulletin with minimal customization, the picture is less dramatic but still operationally significant. Adoption means that examiners in those states are expected to use the NAIC’s new AI Systems Evaluation Tool during market conduct examinations, and the tool asks structured questions about governance programs, bias testing, vendor oversight, and documentation that carriers need answers for.
The Federal Preemption Tension
Layered on top of the state patchwork is a new and still-unresolved federal dynamic. In December 2025, President Trump signed an executive order directing a federal AI governance framework and creating a DOJ AI Litigation Task Force with an explicit mandate to challenge state AI laws viewed as inconsistent with national policy. The order specifically called out Colorado’s anti-discrimination framework as an example of legislation it viewed as problematic.¹²
In March 2026, the White House released a National AI Legislative Framework recommending federal preemption of ‘unduly burdensome’ state AI laws, while stopping short of creating a new federal regulatory body and proposing to channel oversight through existing sector-specific agencies.¹³
The NAIC responded directly, publishing an Issue Brief reaffirming state authority over insurance AI oversight under the McCarran-Ferguson Act and urging Congress to protect the state-based system.¹⁴ The federal-state tension remains unresolved as of publication, and is likely to remain in litigation for years.
For carriers, the operative reality is this: state AI laws remain fully in force until federal preemption is enacted and upheld. Building a governance program now, one that satisfies both the NAIC bulletin’s requirements and the more specific obligations in high-priority states, is not just a regulatory exercise. It is a litigation risk management strategy.
About This AI in Insurance Blog Series
This series covers the AI regulatory landscape state by state, with posts focused on the jurisdictions that matter most to carriers navigating compliance in 2026:
- Post 2: Colorado — The most substantive standalone framework in the country, including the SB 205 timeline shift, the C.R.S. §10-3-1104.9 quantitative testing regime, and what compliance actually looks like in practice.
- Post 3: New York — DFS Circular Letter 2024-7’s proxy assessment requirements, vendor accountability rules, and what carriers need to document before an examination request arrives.
- Post 4: Florida — HB 527’s human review mandate and how it intersects with Florida’s ongoing market recovery, including the Citizens depopulation story.
- Post 5: The NAIC States at Scale — What adoption of the NAIC bulletin without customization actually means for examiners, carriers, and the AI Systems Evaluation Tool pilot.
- Post 6: What Comes Next — The anticipated NAIC model law on third-party oversight, the federal preemption question, and the governance foundations every carrier should be building now.
About WaterStreet
About WaterStreet Company: WaterStreet provides cloud-based policy administration software for small to mid-size P&C carriers. Our platform is designed to support the governance, documentation, and workflow requirements carriers increasingly need to meet regulatory expectations in an AI-driven environment.
Contact Us to see a demo or learn more!
Sources:
1. NAIC, Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (December 2023)
2. Holland & Knight, The Implications and Scope of the NAIC Model Bulletin on the Use of AI by Insurers (May 2025)
3. Fenwick, Tracking the Evolution of AI Insurance Regulation (December 2025)
4. NAIC, Statement on AI Executive Order (December 2025)
5. Fenwick, Tracking the Evolution of AI Insurance Regulation (December 2025)
6. Fenwick, Tracking the Evolution of AI Insurance Regulation (December 2025)
7. Crowell & Moring, NAIC Intensifies AI Regulatory Focus (March 2026)
8. Baker Botts, Colorado AI Act Implementation Delayed (September 2025)
9. Buchanan Ingersoll & Rooney, When Algorithms Underwrite (October 2025)
10. NY DFS, Insurance Circular Letter No. 7 (July 2024)
11. Insurance Journal, Florida House Panel Passes Bill Requiring Human Touch on Claims Denials (December 2025)
12. Seyfarth Shaw, President Trump Signs Executive Order Preempting State AI Laws (December 2025)
13. Freshfields, White House Publishes AI Legislative Framework (March 2026)
14. Crowell & Moring, NAIC Intensifies AI Regulatory Focus (March 2026)
