State insurance regulators got a model rulebook for chatbots

The conversation

The National Association of Insurance Commissioners adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on 4 December 2023, following adoption by its Innovation, Cybersecurity, and Technology Committee three days earlier. The document's own text is written as a template a state insurance department can issue, addressed to ‘All Insurers Licensed to Do Business In’ a jurisdiction the adopting department fills in, reminding them that decisions affecting consumers made or supported by AI systems remain subject to the state's existing insurance laws.

What the documents show

The bulletin's own text calls for each insurer to maintain a written program, labelled an AIS Program, for the responsible use of AI systems affecting regulated decisions, covering governance, risk management and internal audit across the system's life cycle from design to retirement. Guideline 1.9 states the program should ‘include processes and procedures providing notice to impacted consumers that AI Systems are in use,’ tied to the insurance life-cycle phase, whether marketing, underwriting or claims handling. The bulletin also tells insurers that AI-assisted decisions must still satisfy existing standards, naming the Unfair Trade Practices Model Act and the Unfair Claims Settlement Practices Model Act as already imposing those standards regardless of the technology used.

The system boundary

The document is explicit about what it is: a model for state adoption, not a directly binding federal rule. The NAIC's own description of itself, on its organizational homepage, frames the association as a standard-setting and regulatory support body governed by the chief insurance regulators of the states, the District of Columbia and five territories, whose model laws and bulletins become binding only where an individual state's own insurance department adopts or issues them, typically by inserting that state's citations into the bracketed placeholders the model text leaves open.

Where it fails

Because the bulletin is a model rather than self-executing law, its consumer-notice expectation for AI use, including the customer-facing chat tools an insurer might deploy, has legal force in a given state only once that state's regulator issues its own version, and the strength of that force can vary with how closely a state's bulletin tracks the NAIC text. This entry does not identify which states have adopted it, since no state-level adoption document was opened for this entry.

• Has the state where an insurer operates issued its own bulletin or regulation adopting this model, and does that state's version match the NAIC text or modify it?
• Does the insurer's AIS Program include the consumer-notice element the model bulletin describes in guideline 1.9, tied to the relevant stage of the insurance life cycle?
• Are decisions produced with AI assistance being checked against the state's existing unfair trade practices and unfair claims settlement standards, independent of the technology used to reach them?

The bulletin's own governance checklist is a floor the NAIC recommends, not a certification; whether a given insurer's program meets it is a matter for that insurer's own state regulator to assess.