NAIC Model Bulletin: What Insurers Must Prove About AI Data

The NAIC Model Bulletin expects every insurer to maintain a written program that governs its AI systems, and it names data lineage as one of the data practices that program must cover. Regulators can ask for evidence of that program during any investigation or examination. Most insurers can describe their models. Far fewer can show where the data feeding those models originated, how it changed along the way, and what depends on it.

That gap is a compliance exposure. The NAIC adopted the bulletin in December 2023, and a large share of states have since taken it up, so an insurer operating across several jurisdictions faces the same documentation expectation in each. A model validation report answers whether a model performs. It does not answer where the model's inputs came from.

This post covers what the bulletin asks insurers to document, where the evidence usually breaks down, and what it takes to give a defensible answer when a regulator asks for it.

What the NAIC Model Bulletin Requires Insurers to Document

The bulletin sets the expectation that insurers develop, implement, and maintain a written program for their use of AI systems. That program should address governance, risk management controls, and internal audit functions. It also reaches into data practices, listing data currency, lineage, quality, integrity, bias analysis and minimization, and suitability as areas the program should cover.

The bulletin also tells insurers what to expect from regulators. An insurer can expect to be asked about how it develops, deploys, and uses AI systems, and to produce documentation that evidences its program. For a Governance and Compliance Leader, the practical reading is simple: a policy document is not enough. The program has to be demonstrable.

What Is an AIS Program?

An AIS Program is the written governance framework an insurer maintains for its artificial intelligence systems under the NAIC Model Bulletin. It covers who is accountable for AI use, how risk is controlled, how models and their data are validated, and how third-party systems are overseen. In an examination, the AIS Program is the document set a regulator uses to test whether the insurer actually knows how its AI systems work.

Where Insurers Struggle to Prove Their AI Data

The documentation requirement is clear. The evidence behind it is where programs break down. Insurers typically hit four gaps:

• Siloed source systems. Underwriting, claims, and actuarial data live in separate policy administration, claims, and reporting systems, and no single record connects them to the model that consumes them.
• Transformations hidden in code. The logic that reshapes data before it reaches a model sits in application code, stored procedures, and pipelines, not in the warehouse metadata most inventories capture.
• Third-party data and models. The bulletin expects due diligence on vendors and their data, including audit rights, yet an insurer often cannot see what a vendor's system does with the inputs it supplies.
• Change over time. A lineage diagram drawn for last year's audit says little about the model running today after several releases.

These gaps matter beyond one bulletin. As covered in the discussion of Colorado's repeal of its strict AI insurance law, the format of the disclosure regime changes from state to state while the underlying expectation does not. Regulators want proof of how an automated decision was made.

What Good Looks Like: Lineage Produced From the Source

Foundational is the only data and AI governance platform that analyzes source code. It builds deterministic lineage from the code itself, across any code that touches data: application code, ORM layers, transformation scripts and pipelines, notebooks, backend services, established systems including mainframe languages, cloud data platforms, and AI/ML workloads. The result is a live, code-derived map of the data estate, not a point-in-time diagram assembled before an exam.

That map is what turns an AIS Program from a policy into evidence. When a regulator asks where a model input originated, the answer traces back through every transformation to the source system. Lemonade used this approach to significantly accelerate regulatory approval for AI-driven underwriting, because the lineage behind each decision was already documented rather than reconstructed under deadline.

The same foundation also governs what AI systems can safely use. A deterministic data graph gives governance teams and AI agents the same reliable definitions and provenance to work from. For a deeper look at what examiners expect, see what regulators actually require from data lineage.

Frequently Asked Questions

What does the NAIC Model Bulletin require insurers to document about their AI systems?

The bulletin expects a written AIS Program covering governance, risk management controls, and internal audit. It also points to data practices such as currency, lineage, quality, integrity, bias analysis and minimization, and suitability. In an investigation or examination, insurers can expect requests for documentation that evidences the program, including how AI systems are developed, deployed, and used. Treat the data practices as evidence requirements, not aspirations.

Is the NAIC Model Bulletin legally binding?

The NAIC publishes the bulletin as a model, so it takes effect state by state. It carries weight in each state where the insurance department has adopted it, and regulators there can ask insurers to demonstrate compliance during examinations. Insurers operating in several states should check each department's adoption status and any state specific additions before assuming a single program satisfies every jurisdiction.

Does the bulletin apply to AI systems and data supplied by third-party vendors?

Yes. The bulletin expects insurers to perform due diligence on third parties and on the data and AI systems they supply, and to pursue contract terms such as audit rights. An insurer remains accountable for the outcome even when a vendor built the model. That makes visibility into what vendor supplied inputs touch, and where they flow, a practical requirement.

How does data lineage help an insurer answer a regulator's AI questions?

Lineage shows where each model input originated, every transformation applied to it, and what depends on it. Foundational derives that lineage directly from source code, so the evidence is deterministic and current rather than reconstructed from interviews and diagrams. An insurer can answer a regulator's question about an underwriting input by tracing it end to end, with documentation that already exists.

Conclusion

The NAIC Model Bulletin turns AI data lineage from a good practice into something an examiner can ask to see. Insurers that can already trace every model input to its source will answer those requests from evidence on file instead of a scramble. See how Foundational's source code analysis gives insurers that evidence trail on a demo call.