State regulators supervise US insurance; the NAIC coordinates them. Its model guidance on insurers' use of AI, which states can adopt, expects a written programme for responsible AI use with governance, risk controls and oversight of vendors. Existing state laws on unfair discrimination, rates and claims settlement apply to AI agents in full.
What do state regulators and the NAIC expect?
Three layers apply, in substance.
Existing insurance law. Every state prohibits unfair trade practices and unfair claims settlement practices, and requires rates that are not excessive, inadequate or unfairly discriminatory. These apply whether a decision is made by an underwriter, a model or an agent. A claim denied by an agent without proper investigation is an unfair claims practice like any other.
NAIC principles and model guidance. The NAIC has adopted principles for AI in insurance: fair and ethical use, accountability, compliance with law, transparency, and safe, secure and reliable systems. It has also adopted model guidance on insurers' use of AI systems that states may issue as their own. That guidance expects insurers to maintain a written programme for the responsible use of AI systems, covering governance, risk management and internal controls across the AI life cycle, with attention to decisions affecting consumers and oversight of third-party systems. It also signals that regulators may request information about AI systems during examinations.
State-specific rules. Some states go further. NYDFS has issued guidance to insurers on using external data and AI in underwriting and pricing. Colorado has passed an AI act aimed at high-risk systems that make consequential decisions, which can include insurance decisions.
Who does it apply to?
Insurers and, in some states, producers and other licensees. Because each state regulates insurers writing business there, a national insurer faces as many supervisors as states it operates in, with the NAIC helping them align. Vendors are reached through the insurer's oversight duties.
What does this mean when the system is an agent that acts?
Insurance agents (the software kind) tend to work in four places, each with its own exposure.
Claims. An agent that gathers documents, assesses coverage and drafts settlement or denial is inside claims settlement law. Prompt acknowledgement, reasonable investigation and fair settlement are legal duties. Denials should be held for a licensed adjuster or a named person until the agent has proven itself, and some may never be released by an agent alone.
Underwriting and pricing. An agent that gathers external data or recommends a risk class can introduce unfair discrimination through proxies. Testing for this belongs in the AI programme. Life and health pricing is also high-risk in the EU, as covered in EU AI Act Annex III life and health insurance pricing and AI agents.
Customer service. Statements about coverage are representations by the insurer. Misstating cover is a trade practice issue.
Fraud and special investigations. Agents that flag suspected fraud can delay legitimate claims. Flags should trigger investigation, not denial.
How do you meet the expectations?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Written AI programme | Programme document covering agents, approved by senior management | Programme; approval |
| Governance and accountability | Named owner per agent; board reporting on AI use | Owner register; board papers |
| Risk management across the life cycle | Agents assessed, tested and monitored per capability | Risk and test records |
| Unfair discrimination | Outcome testing across groups for underwriting, pricing and claims agents | Testing results |
| Claims settlement standards | Agents meet acknowledgement and investigation timelines; denials held for a person | Claims timelines; hold records |
| Accurate representations | Coverage answers drawn from the policy wording | Source records per answer |
| Third-party oversight | Agent platform and data vendors assessed; audit rights in contracts | Due diligence; contracts |
| Examination readiness | Documentation retrievable on request | Examination file |
Examination readiness matters more than it sounds. Market conduct examiners can request the inventory of AI systems, the programme, testing and specific case files. Our article on how regulators expect AI agents to be audited covers what a good file contains.
What will a state examiner ask?
- Do you have a written AI programme, and does it cover agents?
- Which agents touch claims, underwriting or pricing, and who owns them?
- How do you test for unfair discrimination?
- Show us a claim the agent handled. What did it do and who decided?
- How do you oversee the agent platform and data vendors?
- How are consumers told when AI is used in decisions about them?
What do these expectations not cover?
The NAIC does not regulate insurers directly; states do, and adoption of its model guidance varies. The guidance does not prescribe specific tests or metrics. It does not cover federal rules such as HIPAA or GLBA, which may apply to the same data. Insurers abroad face different regimes; compare AI agents for compliance teams in insurance in India and AI agents for compliance teams in insurance in Nigeria. Financial crime work has its own expectations; see whether regulators accept AI agents in AML work. For the full map, see AI agent regulation, mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
In Pryme, a claims agent's denial can be configured as held: drafted with the policy wording and claim facts it relied on, each stamped with provenance, and released only by a named adjuster. Attest certifies each agent on the insurer's own past claims, and every verdict is filed in an append-only record that an examiner can sample case by case.
Questions people ask
Has every state adopted the NAIC's AI guidance?
No. Adoption varies by state, and some states have issued their own rules. Check each state where you write business.
Can an AI agent deny a claim?
No law prohibits it outright, but claims settlement duties still apply, and denial is where regulators look hardest. Most insurers keep denials with a licensed adjuster or named person.
Are vendors' AI systems the insurer's responsibility?
Yes. Regulators expect insurers to oversee third-party AI systems used in their business and to be able to answer for them.