NAIC AI Model Governance Consulting for Insurers

The bulletin tells an insurer to have a governance framework proportionate to the risk of its AI use, but it does not specify a bias-testing method, a documentation template, or a validation cadence the way a technical standard would. That is intentional, so it can cover everything from a simple rules-based rating factor to a generative underwriting assistant, but it means two carriers can both be technically compliant with very different levels of actual rigor, and an examiner has real discretion in what they consider adequate.

State-by-state adoption compounds this. A multi-state carrier is tracking which departments have issued the bulletin, whether any have layered on their own examination guidance, and keeping one governance program that satisfies all of them at once rather than rebuilding it per state.

The organizational problem is usually the bigger one. Actuarial and pricing teams, claims operations, marketing, and compliance each run their own models and vendor tools, often without a shared inventory. A model governance program has to reach across all of those groups, assign a single accountable owner, and get third-party and vendor-built models (which insurers frequently cannot fully inspect) into the same inventory and testing regime as models built in-house. Most of the effort in a real engagement goes into that cross-functional coordination, not into the regulatory reading.

In practice this starts with the rating variables themselves. A variable that is facially neutral, such as a credit-based score, zip code proxy, or device or browsing signal, can still correlate with a protected class closely enough to function as an unlawful proxy. Responsible underwriting governance tests for that correlation directly rather than assuming a variable is safe because it does not name a protected class.

It also means the model's reasoning is explainable at the level an adverse-action notice requires: an applicant who is declined or rated up has to be able to learn why in terms tied to their own application, not a model score with no underlying explanation. For any system where the underwriting decision is fully automated, a documented human review or override path has to exist for the higher-risk outcomes, and the governance program has to be able to show, after the fact, that the review actually happened.

The starting deliverable is always the same: a complete inventory of AI systems in production or pilot across underwriting, claims, pricing, and marketing, each one risk-tiered and assigned an accountable owner. From there the engagement builds the governance charter and committee structure, a testing and validation protocol matched to each tier, including fairness and proxy-discrimination testing, and the documentation packet a market conduct exam will actually ask to see.

Because the bulletin's language is principles-based, the highest-value part of the engagement is usually translating it into artifacts a compliance team and an examiner can both use: a plain-language system description, a testing summary, and a change log, rather than a purely legal read of the regulation.

Bring a rough count of the AI and predictive models already in production across underwriting, claims, and marketing, the states the carrier is licensed in, and whether a state department has already asked for governance documentation. That is enough to scope a fixed engagement or a retainer and quote it against the rates above rather than the floor.