# What insurance regulators say about AI, and what it means for AI-assisted COI review

Analyst brief R-16, COI Journal Resource Center. Regulators have spent three years building rules for how insurers use AI. Those rules don't apply to a GC's software. But they're a ready-made checklist for anyone deciding whether to trust an AI review.

Question: How are insurance regulators approaching AI, and what should GCs ask before trusting AI to review COIs?

By The editors, COI Journal. November 13, 2026. Docket COIJ-26-0017. Published by Forsured.

## Key findings

- The NAIC adopted its Model Bulletin on the Use of AI Systems by Insurers on December 4, 2023. As of April 2026, 24 states and D.C. had adopted it.
- The bulletin asks insurers for a written AI program, vendor diligence and ongoing testing, and to be ready to document how they use AI.
- In 2026 the NAIC ran a pilot of an AI System Evaluation Tool with 12 state regulators, from March to September.
- The bulletin governs insurers, not GCs. Its questions about governance, testing and vendors are still the right ones to ask any AI review tool.

## The bulletin

The National Association of Insurance Commissioners adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023, [Mayer Brown reported](https://www.mayerbrown.com/en/insights/publications/2026/04/us-naic-spring-2026-national-meeting-highlights-innovation-cybersecurity-and-technology-h-committee-update). A model bulletin is a template. Each state decides whether to adopt it.

As of April 2026, 24 states and D.C. had adopted the bulletin, and four states had adopted their own insurance-specific AI regulation or guidance, according to the same report.

## What it asks of insurers

According to [Quarles & Brady](https://www.quarles.com/newsroom/publications/nearly-half-of-states-have-now-adopted-naic-model-bulletin-on-insurers-use-of-ai), the bulletin asks insurers to:

- develop, implement and maintain a **written program** for responsible use of AI systems;
- do **vendor diligence** on third-party data and AI systems they acquire and rely on, including audit rights in contracts;
- **validate, test and retest** AI outputs; and
- be ready to answer regulators' questions, including with documents, about how they **develop and use** AI.

## What happened in 2026

The NAIC's Big Data and AI working group ran a pilot of an AI System Evaluation Tool with 12 state regulators from March to September 2026, with an updated tool planned for adoption at the Fall 2026 national meeting, Mayer Brown reported. A separate working group was weighing whether its third-party vendor registry should be voluntary or mandatory, and whether to develop a model law. We found no report of the fall outcome.

The NAIC's own research journal published a review of the AI bulletins and their take-up in May 2026.

## Why it matters for COI review

The bulletin applies to insurers. It doesn't govern a GC's compliance team or the software that team uses. But AI-assisted certificate review is the same kind of task the bulletin worries about: a system making or shaping decisions from documents, at scale.

Its four themes translate directly into buyer questions:

1. **Program.** Who owns the AI's decisions inside the vendor, and inside your team?
2. **Vendors.** What models and data does the tool rely on, and what happens to your documents?
3. **Testing.** How is accuracy measured, how often, and on what kinds of certificates and endorsements?
4. **Documentation.** For each pass or fail, can the tool show its work well enough to defend it to an owner or a carrier?

Our white paper [Can AI review a COI?](https://coijournal.com/reports/can-ai-review-a-coi/) covers what AI does well and where people should stay in charge.

## How we wrote this

Based on law firm reporting by Mayer Brown (April 2026) and Quarles & Brady (April 2025) and the NAIC's Journal of Insurance Regulation abstract (May 2026). We have not read the full bulletin text for this brief, and we found no report on the Fall 2026 NAIC meeting's outcome. COI Journal's publisher sells software that uses AI. General information, not legal advice.

## Sources

- [US NAIC Spring 2026 National Meeting Highlights: Innovation, Cybersecurity and Technology (H) Committee Update](https://www.mayerbrown.com/en/insights/publications/2026/04/us-naic-spring-2026-national-meeting-highlights-innovation-cybersecurity-and-technology-h-committee-update), Mayer Brown, April 2026
- [Nearly Half of States Have Now Adopted NAIC Model Bulletin on Insurers' Use of AI](https://www.quarles.com/newsroom/publications/nearly-half-of-states-have-now-adopted-naic-model-bulletin-on-insurers-use-of-ai), Quarles & Brady, Meghan O'Connor, April 2, 2025
- [Artificial Intelligence and Insurance Regulation](https://content.naic.org/research/jir/artificial-intelligence-and-insurance-regulation), NAIC Journal of Insurance Regulation, Cole, Fier and Marzen, May 5, 2026