NAIC Intensifies AI Regulatory Focus: What Health Insurance Payors Need to Know

The National Association of Insurance Commissioners (NAIC) is intensifying its oversight of how insurers use AI — and the pace of regulatory activity shows no signs of slowing. Over the past several months, the NAIC has published a formal Issue Brief staking out its position on federal AI legislation, launched a multistate AI Evaluation Tool pilot aimed at examining insurers’ AI governance programs, and continued to expand adoption of its AI Model Bulletin across state lines. These developments continue a trend towards enhancing regulation; the NAIC adopted AI Principles in 2020 and a Model Bulletin in 2023 clarifying that existing insurance laws apply to AI systems and establishing expectations for governance, documentation, testing, and third-party oversight. That Model Bulletin has now been adopted in approximately 24 states.

Payors should take note: these are not distant or theoretical developments. The regulatory infrastructure needed to scrutinize payors’ AI programs is being built right now. 

Key Developments

The NAIC AI Issue Brief: Supporting State Regulation 

In March 2026, the NAIC published an Issue Brief formally articulating its position on AI regulation. The NAIC supports state-based oversight of insurers’ use of AI and opposes federal preemption that would undermine consumer protections and the McCarran-Ferguson framework, which delegates insurance regulation to the states. This is a direct response to Congressional proposals that would restrict or delay state-level AI oversight. (For context, please refer to our December 2025 client alert on how a White House Executive Order sought to thwart “onerous” AI state regulation.) 

In the NAIC’s view, the progress already made at the state level stands in stark contrast to what a federal override would produce: state regulators have built out a meaningful supervisory infrastructure — including AI-specific principles, interpretive guidance, and examination tools — and preemptive federal legislation would displace that work and leave consumers with diminished protections. The NAIC’s position is firm: “AI is a tool used in underwriting, pricing, claims, fraud detection, and utilization management” – it does not alter insurers’ legal obligations, and “existing state insurance laws apply regardless of whether decisions are made by humans, algorithms, or third-party vendors.” 

The NAIC AI Evaluation Tool Pilot

Perhaps the most consequential near-term development is the NAIC’s launch of a multistate pilot of an AI Evaluation Tool, running from January 2026 through September 2026. Twelve states are participating, including Colorado, Maryland, Louisiana, Virginia, Connecticut, Pennsylvania, Wisconsin, Florida, Rhode Island, Iowa, Vermont, and California. The Tool is designed to give regulators a structured framework for reviewing insurer AI systems during market conduct examinations. Its stated goals include helping insurers clearly explain their AI governance programs to regulators; helping regulators better understand how companies use AI and apply standard governance practices; and informing long-term recommendations for market conduct and financial risk assessment review processes. 

The Tool has received pushback from industry trade groups, who have urged revisions to clarify that references to AI governance and risk assessment frameworks do not create new regulatory requirements. That tension is meaningful — but payors should not interpret it as a reason to wait. Although regulators will not be required to use the Tool, it represents another available cudgel during market conduct exams. The NAIC’s approach is grounded in existing legal authority, empirical oversight, and defined governance expectations — and the Tool is the mechanism through which regulators intend to put that approach into practice.

The Broader NAIC AI Regulatory Trajectory

As AI use in the insurance industry continues to grow, state insurance regulators, who serve as the primary supervisors of insurer market conduct and solvency, are exercising their existing statutory authority to monitor and govern that use. The NAIC has supported this work by coordinating surveys across major insurance lines, building an evidence base around how AI is being deployed and using those findings to shape examination priorities and supervisory strategies. The combination of the Model Bulletin, the Evaluation Tool pilot, and the Issue Brief makes clear that the NAIC views AI governance as a sustained, long-term regulatory priority rather than a one-time guidance exercise.

Risk Mitigation Recommendations for Payors

Given the trajectory of NAIC activity and the likelihood that the Evaluation Tool’s findings will shape market conduct exam standards nationwide, health insurance payors should consider the following steps now: 

• • Establish or mature an AI governance framework. Designate board and senior management accountability for AI oversight and document the policies and procedures governing AI use across all lines of business, including utilization management, claims, and underwriting. 

• • Conduct an AI inventory. Identify all AI systems and decision-making algorithms in use, including those operated by third-party vendors. The NAIC's framework covers not just traditional AI but also algorithms that function similarly to AI in making material decisions about members. 

• • Strengthen vendor diligence and contracts. Review third-party vendor agreements to ensure they include audit rights, cooperation obligations for regulatory inquiries, and appropriate data governance terms. 

• • Perform ongoing risk assessments. Implement a recurring process to assess whether AI systems produce outcomes that comply with applicable anti-discrimination and consumer protection laws. 

• • Prepare for regulatory examination. Regardless of whether your state is participating in the pilot, consider using the NAIC Evaluation Tool framework as a self-assessment guide to evaluate whether your AI governance program can withstand regulatory scrutiny. 

• • Monitor state adoption. Given that half of all U.S. states have adopted the NAIC Model Bulletin, payors operating across multiple states should track the specific requirements in each jurisdiction, as state-specific regulations may impose additional or more stringent obligations. 

The NAIC’s recent activity sends a clear and coordinated message: AI governance is a present regulatory obligation, not a future one. While none of these developments, taken individually, constitute a new law, together they define what regulators expect, how they plan to examine it, and where enforcement attention will focus. Payors that begin building mature AI governance programs now will be better positioned when more prescriptive state regulations arrive with binding compliance deadlines. 

Our team is ready and available to assist health insurance payors navigating the evolving landscape of AI regulation. For further details or clarification on what the NAIC’s recent developments — including the AI Issue Brief, the Evaluation Tool pilot, and continued Model Bulletin adoption — could mean for your organization’s AI governance program, please contact any author of this alert or your preferred Crowell & Moring lawyer.