Today is the deadline, and most carriers will miss it without ever knowing what they missed. The comment period on version 6.0 of the NAIC's AI Risk Evaluation Supplement ends at close of business on October 30, 2026. The supplement is not a new law — its own intent section says so, in language added with a note naming the American Council of Life Insurers: it does not independently create substantive legal duties or expanded regulatory authority. It is something more practical, and for an operator, more consequential: it is the questionnaire an examiner will bring into your building.
The NAIC's model bulletin on insurers' use of AI, adopted December 4, 2023, has now been issued in 29 jurisdictions as of the NAIC's October 8, 2026 map. The supplement is how that bulletin gets examined. Version 6.0, exposed by the Big Data and Artificial Intelligence (H) Working Group after an October 16 email notice, is designed so regulators will most often use Exhibit A first, then Exhibit B, then Exhibits C and D on a subset of uses they want to probe further. A Webex follows on November 2, a Fall National Meeting session on November 16, and version 7.0 adoption consideration at that meeting. This is not a distant framework. It is a calendar.
What it means for carriers
First, the inventory is no longer optional homework. Under version 5.0, a company could suggest submitting an existing inventory in lieu of Exhibit A. Version 6.0 reverses that: provide the inventory together with Exhibit A. If you cannot produce a current inventory — what each system is, where it runs, what decisions it touches — you cannot answer the first exhibit, and everything downstream stalls.
Second, the questions have moved from models to mandates. Exhibit C asks whether a use case involves agentic AI and, if so, its objectives and authorizations without human approval. Exhibit B asks how a company assures itself that its human review is appropriate — not whether a human is nominally in the loop, but whether the review is real. It adds questions on discovering unsanctioned AI use, keeping nonpublic personal information out of unapproved models, and deciding when a general-purpose tool becomes a high-risk use because of the workflow in which it is deployed. A chatbot is low risk until it drafts a declination letter. The risk lives in the workflow, not the tool.
Third, two quiet changes widen the net. Exhibit C gains a proxy question: whether the company evaluates variables or outputs for proxy effects that may contribute to adverse consumer impacts or unfair discrimination, with the method and any action taken. And "Adverse Consumer Outcome" becomes "Adverse Consumer Impact," with the closing words "in a manner that violates those standards" deleted. On InsureAI Wire's reading, the new definition reaches an adverse decision whether or not it breaks a standard. The direction of travel is from violations to impacts, from what you intended to what the consumer experienced.
Fourth, the old models are not excused, only triaged. Version 6.0 keeps generalized linear models in, despite trade-group requests to exclude them, while letting regulators set GLMs aside for Exhibits B through D where rate-making oversight already applies. The message is proportionate, not permissive.
From the operator's chair
One: build the inventory this quarter, before version 7.0 is adopted. One register: every AI system and model, the decisions it touches, the human who confirms its output, and the evidence the ledger keeps. An item with no named human owner is not an inventory entry. It is an unsanctioned use waiting for an examiner to find it.
Two: answer Exhibit C's agentic question for every agent in production, in writing, before anyone asks. What are its objectives? What is it authorized to do without human approval? What stops it, and what evidence survives when it stops? That document is the verifiable agent mandate this series has argued for since Essay Nº 006 — delegated authority for software, modelled on the binding authority agreements the market has governed for a century. Access is not authority, and now the examiner is asking for the mandate in so many words.
Three: audit the shadow fleet — the enterprise assistants, unapproved models, and workflows where a general-purpose tool quietly became high-risk. "We have a policy against it" is not a discovery method. Logs, data-loss controls, and a named owner are.
The debate about whether AI in insurance needs governing is over. The bulletin is in 29 jurisdictions, the supplement is in version 6.0, and the questions are written down. The only question left is whether your answers are written down too — and whether they are true.
— Krishna