Version 7.0 of the NAIC's AI Risk Evaluation Supplement is up for an adoption vote at the Big Data and Artificial Intelligence (H) Working Group's session at the Fall National Meeting on November 16. On Monday, the document examiners have been piloting since March stops being a draft and starts being the exam.
That pilot is the part worth sitting with. Twelve states ran the supplement in live market conduct exams, financial analysis, and financial exams between March and September of this year. This is not a framework awaiting its first test. It has already been tested — on real carriers, in real exams — and the version going to a vote is the one that survived contact with those exams. The carriers that were in the pilot know what the questions feel like. The carriers that were not are about to find out.
The bulletin behind it is now the baseline in most of the country. As of the NAIC's November 3 implementation map, 29 jurisdictions have adopted the model bulletin on insurers' use of AI — 27 states plus the District of Columbia and Puerto Rico. Mississippi, South Carolina, and North Dakota all signed on in the second half of this year. The four states that run their own insurance-specific AI rules instead — California, Colorado, New York, and Texas — are not easier ground. Colorado's automated decision-making law takes effect January 1, 2027. Texas expects a person to review consequential AI decisions. And the federal escape hatch some carriers were quietly counting on is closed: an executive order is not an act of Congress, and McCarran-Ferguson leaves insurance regulation to the states. Congress has passed no preemption. The state rules stand.
What it means for carriers
First, the exam now starts with an inventory, and the inventory is the exam. Exhibit A asks how many AI systems a carrier uses and where. Regulators decide from those answers whether to go further — into the AIS Program, the high-risk models, and the data behind them. A carrier that cannot produce a current inventory on Monday cannot answer the first exhibit, and everything downstream stalls. The inventory is not compliance paperwork. It is the first question, and it is scored.
Second, the records that matter cannot be created after the fact. Testing and drift records, bias and fairness testing before deployment and on a schedule afterward, vendor diligence and audit rights, a decision audit trail showing which inputs produced which outcome and what a person did with it, board reporting, incident records with detection, timeline, and remediation. None of that can be reconstructed once an examiner asks for it. A carrier that starts building its testing history the week the supplement is adopted is already late — the history the examiner wants is the history of the last six months, and the last six months are gone.
Third, the pilot tells you what the examiners actually cared about. They piloted in three kinds of exams — market conduct, financial analysis, financial — which means the supplement is not a market-conduct curiosity. It travels with the financial exam too. And the states that piloted it now have examiners who have used it. The learning curve is over on their side.
From the operator's chair
One: run the supplement on yourself before Monday, as if the vote had already passed. Answer Exhibit A from your actual inventory, not from a slide deck about it. Every system with no named human owner is not an inventory entry. It is an unsanctioned use waiting for an examiner to find it — and twelve states' examiners have now practiced finding exactly that.
Two: freeze the evidence you already have. Pull the testing records, the drift logs, the vendor diligence files, and the decision trails that exist today and put them somewhere an examiner can be shown them. If a record does not exist, write down that it does not exist and who owns creating it — do not backfill it. A gap you can name is a remediation plan. A gap an examiner discovers is a finding.
Three: put one person in charge of the answer, by name, before the vote. Not a committee — one senior owner who can say, for each high-risk model, what it does, who confirms its output, and where the evidence lives. Monday is when that expectation stops being guidance and starts being the questionnaire in the room.
Two weeks ago this series said the debate about whether AI in insurance needs governing was over, and the only question left was whether your answers were written down. Monday answers the next question: whether your answers were true when the pilot ran — because the examiners who ran it already know what a real answer looks like.
— Krishna