Contact

NAIC AI exams

What regulators will ask about your AI, and where the answers come from.

Last reviewed 2 October 2026

The NAIC has developed a tool regulators can use to examine how an insurer uses AI. It began as the AI Systems Evaluation Tool; version 5.0 renamed it the AI Risk Evaluation Supplement, designed as a supplement to existing examination handbooks. It is owned by the Big Data and Artificial Intelligence (H) Working Group.

The NAIC has said it does not create new requirements. Regulators use it within their existing examination and analysis authority.

Where it stands

  1. Model Bulletin adopted

    The NAIC adopts the Model Bulletin on the Use of AI Systems by Insurers.

  2. 25 states and D.C. adopted

    California, Colorado, New York and Texas have their own insurance-specific AI regulation or guidance.

  3. 12-state pilot

    California, Colorado, Connecticut, Florida, Iowa, Louisiana, Maryland, Pennsylvania, Rhode Island, Vermont, Virginia and Wisconsin.

  4. Comment period closes

    Public comment on version 5.0 ends.

The four exhibits, and where the answers come from

Version 5.0 is organized in four exhibits. Some of what they ask for is documentation only the insurer can write. Some is evidence that should come out of the systems themselves, not be rebuilt from logs when an examiner asks. For an AI workflow built on Gen22:

  1. A

    AI systems and model inventory

    Examiners ask for

    The AI systems and models in use, split by direct consumer impact and material financial impact.

    Recorded by the platform

    A live system map, generated from the code, of what each system does. Every AI call recorded with its model and version.

    Still yours to write

    The inventory itself, materiality judgments, and systems not built on the platform.

  2. B

    AI systems program

    Examiners ask for

    Governance, explainability and third-party oversight, answered as a narrative or a checklist.

    Recorded by the platform

    Evidence the program operates: human review with overrides recorded, every permission check including refusals, every vendor call with its engine, version and ruleset.

    Still yours to write

    The written program: governance, accountability and policies.

  3. C

    Individual model details

    Examiners ask for

    For individual AI models: use case, development method, risks and limitations.

    Recorded by the platform

    For each decision: what the model saw, which model and version answered, what it recommended, what it cost, and what the reviewer decided.

    Still yours to write

    Development method, validation, and risk and limitation analysis.

  4. D

    Data

    Examiners ask for

    The types of data elements used, how each is used, which models use it, and whether it comes from an internal source or a named third-party vendor.

    Recorded by the platform

    Each record tied to the request that caused it and the AI decision that produced it, so you can trace what data a decision used.

    Still yours to write

    The data dictionary and data-set documentation.

The platform does not write the inventory, the program or the model documentation for you. It makes the evidence behind them a query instead of a project. See capability status for exactly what is built.

Become a founding design partner

Sources

This page summarizes public NAIC materials. It is not legal advice.