The NAIC AI model bulletin explained for insurers and MGAs
What the NAIC model bulletin on the use of AI systems by insurers expects, how it applies to pricing and underwriting, and what MGAs and technology vendors should prepare.
In December 2023 the National Association of Insurance Commissioners adopted a model bulletin on the use of artificial intelligence systems by insurers. A model bulletin is not law in itself. Each state decides whether to issue it, and a large number of states have now done so, in some cases with changes of their own.
The bulletin does not ban particular techniques. It sets out what regulators expect insurers to have in place when they use AI in decisions that affect consumers, including pricing, underwriting, claims and marketing.
What the bulletin expects
The central requirement is a written program for the responsible use of AI systems, often called an AIS program. The bulletin describes what that program should cover.
- Governance. Clear accountability for AI use, with oversight at senior management level and defined roles for the people who build, approve and monitor AI systems.
- Risk management and internal controls. Processes to identify and reduce the risk that AI systems produce inaccurate, arbitrary or unfairly discriminatory outcomes, proportionate to how the system is used and the harm it could cause.
- Compliance with existing law. Decisions supported by AI must still comply with insurance laws, including those on unfair trade practices and unfair discrimination.
- Data and model management. Controls over the data used and the models built, including validation, testing and ongoing monitoring.
- Third-party oversight. Due diligence on AI systems and data obtained from vendors, with contracts that support the insurer's own obligations, such as audit rights and cooperation with regulators.
- Documentation. Records that let the insurer, and the regulator, understand how AI systems are used and how they are controlled.
The bulletin also makes clear that regulators may ask for information about an insurer's AI program and its systems during examinations and investigations.
How it applies to pricing
Pricing and underwriting are among the uses with the most direct effect on consumers, so they are likely to attract attention. In practice, regulators will want to see that an insurer can:
- describe each pricing model, what data it uses and how it reaches a price;
- show the model has been tested and that its results match the filed rates and rules;
- show it has considered whether the model's outcomes could be unfairly discriminatory;
- explain any individual decision if a consumer or regulator asks;
- show who approved the model and each change to it.
Rate and rule filings remain the basis for what an insurer is allowed to charge. An AI system used in pricing still needs to produce results consistent with the approved filing.
What MGAs should prepare
The bulletin is addressed to insurers, but MGAs that price and underwrite on an insurer's behalf will feel its effects through their carrier relationships. Carriers are responsible for oversight of third parties, so they are likely to ask their MGAs for:
- a description of the pricing and underwriting models in use and any AI involved;
- evidence that the models match the filed rates and rules;
- version history and approval records for model changes;
- test results and monitoring reports;
- the ability to explain individual quotes and decisions.
MGAs that can provide this quickly are easier for carriers to work with and better placed when programs are reviewed.
What vendors should prepare
Technology vendors supplying pricing or underwriting systems should expect similar questions from insurers carrying out due diligence. Useful things to have ready include:
- clear documentation of how the system works and where AI is used;
- audit trails for model changes and approvals;
- the ability to reproduce any past decision;
- testing and validation evidence;
- contract terms that support audit and regulatory requests.
Practical controls
Most of these expectations can be met with a small set of controls applied consistently:
- Keep an inventory of AI systems and models, with an owner for each.
- Make model logic readable, so it can be reviewed against the filing.
- Version every change and record who approved it.
- Test every version against known cases, including the filing's own premium examples. Our article on testing pricing models explains how.
- Trace every decision, with the inputs and values used at each step.
- Monitor outcomes for signs of unfair discrimination or drift.
How Ptally supports this
Ptally models are readable JSON with embedded tests. Every version is recorded, and each one moves through draft, approval and publishing, with every status change logged against the person who made it and the time. AI agents can edit drafts, but only people approve and publish. Every quote can return a debug trace showing each input, lookup, formula and rule.
Getting started
If you need pricing models that stand up to carrier and regulator review, send us your rating guide, filing or current model. There is no implementation fee and nothing to pay upfront. Talk to our team.
This article is general information and is not legal advice. Check the version of the bulletin adopted in each state where you write business.