Artificial intelligence now sits behind a large share of the pricing, claims, and fraud decisions that insurers make about you, and both state and federal regulators have started building rules that decide how AI affects insurance regulation and liability. The single most important framework so far is the National Association of Insurance Commissioners’ 2023 Model Bulletin, which requires insurers in adopting states to run a written governance program over every AI system that touches a policyholder decision. Federal law adds privacy, credit, and consumer protection obligations on top. And when an algorithm gets a decision wrong, the insurer that deployed it — not the vendor that built it — is where regulators start.
Where AI Shows Up in Your Policy
Insurers use AI in four main places: setting your premium, processing your claim, screening for fraud, and managing risk across their book of business. The Treasury Department’s Federal Insurance Office noted in its 2025 Annual Report that AI is modernizing underwriting, claims processing, fraud detection, and risk management across the sector.1U.S. Department of the Treasury. Annual Report on the Insurance Industry (September 2025) The benefits regulators recognize are speed and better fraud detection. The risks they worry about are hidden discrimination, opaque denials, and errors nobody catches because a machine made them.
Not every use gets the same scrutiny. An AI tool that drafts marketing emails is treated very differently from one that decides whether to deny a health claim. That distinction sits at the center of how the current rules are written.
The NAIC Model Bulletin on AI
The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023, and it remains the most detailed regulatory framework aimed specifically at AI in insurance.2National Association of Insurance Commissioners. Use of Artificial Intelligence Systems by Insurers It builds on the NAIC’s 2020 AI Principles covering fairness, ethical use, accountability, transparency, and security. In states that adopt the bulletin, every licensed insurer must develop, implement, and maintain a written program for the responsible use of AI systems that make or support regulated insurance decisions.
That written program has to be proportional to the risk each AI system creates for consumers. The bulletin lists five factors insurers should weigh: the nature of the decisions the AI supports, the potential harm to consumers, the degree of human involvement in final decisions, how explainable the outcomes are to affected policyholders, and how heavily the insurer relies on third-party data or models.2National Association of Insurance Commissioners. Use of Artificial Intelligence Systems by Insurers
Third-party AI gets specific attention. If an insurer buys an algorithm from a vendor or feeds outside data into its models, its written program must address how it evaluates and monitors those outside systems. Regulators can ask about any specific AI system’s development, deployment, and outcomes during investigations or market conduct exams.2National Association of Insurance Commissioners. Use of Artificial Intelligence Systems by Insurers “Our vendor built it” is not a defense.
The NAIC’s Big Data and Artificial Intelligence Working Group is now developing an AI Systems Evaluation Tool for ongoing regulatory review and has opened a request for information on a potential NAIC Model Law on AI in insurance, which would carry more formal weight than a bulletin.3National Association of Insurance Commissioners. Big Data and Artificial Intelligence (H) Working Group
Federal Action Around AI in Insurance
Insurance is primarily regulated at the state level, but federal attention is real. Executive Order 14110, issued in October 2023, directed the Secretary of the Treasury to publish a report on best practices for financial institutions managing AI-specific cybersecurity risks, and encouraged independent regulatory agencies to use their full authorities to protect consumers from AI-driven fraud, discrimination, and privacy threats.4Federal Register. Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence The order specifically called out the responsibility of regulated entities to conduct due diligence on third-party AI services.
The Federal Insurance Office’s 2025 Annual Report acknowledged the NAIC’s ongoing work on both the AI Model Bulletin and the potential AI Model Law, and stated the office will continue monitoring AI developments in the sector.1U.S. Department of the Treasury. Annual Report on the Insurance Industry (September 2025) Federal engagement raises the odds of coordinated pressure even though the binding rules will still come from state departments.
Underwriting, Pricing, and Algorithmic Bias
AI-driven underwriting still has to comply with the longstanding prohibition on unfair discrimination. What AI changes is how discrimination can happen: a model trained on historical data that reflects past biases can systematically charge higher premiums to members of protected classes even when the model never uses race, gender, or disability status as an input.
Regulators are answering that with specific testing requirements. Several state insurance departments now require insurers to run multi-step bias assessments before deploying AI in underwriting or pricing. A typical framework asks the insurer to check whether the AI produces disproportionate adverse effects on any protected class, determine whether a legitimate actuarial explanation accounts for the disparity, and then search for a less discriminatory alternative that still meets the insurer’s business needs. If a less discriminatory alternative exists, the insurer must adopt it. These assessments must run before a model goes into production, after any material update, and on a recurring schedule.
When AI underwriting uses credit data, the Fair Credit Reporting Act applies. The FCRA requires anyone who takes an adverse action against a consumer based on a consumer report to notify the consumer, explain the action, and identify the credit reporting agency that supplied the information.5Federal Trade Commission. Fair Credit Reporting Act If a credit score factored into the decision, the notice must also include the score, the range of possible scores, and the factors that hurt yours. You have the right to dispute inaccurate information, and fixing errors generally means contacting both the credit reporting agency and the company that furnished the data.6Consumer Financial Protection Bureau. How Do I Dispute an Error on My Credit Report These requirements don’t change because an algorithm made the decision.
Non-traditional data adds another layer. Insurers increasingly feed telematics from connected vehicles, wearable health devices, and social media activity into AI models. State regulations govern what non-traditional data insurers can use, and many require specific disclosures to applicants about which data sources influence their premiums. The core concern is that exotic inputs can serve as proxies for protected characteristics. A neighborhood-level data point, for example, can correlate closely enough with race to produce the same discriminatory outcome as using race directly.
Privacy and Data Protection
AI in insurance runs on personal data, and the volume it consumes makes privacy compliance both critical and hard to get right. Two federal laws set the floor.
The Gramm-Leach-Bliley Act requires insurance companies to explain their information-sharing practices to customers, provide opt-out rights when data is shared with certain third parties, and maintain an information security program with administrative, technical, and physical safeguards.7Federal Trade Commission. Gramm-Leach-Bliley Act Every new data pipeline that feeds an algorithm is a potential point of failure for those safeguards.
Health insurers face an additional layer under HIPAA. The Security Rule requires covered entities to protect the confidentiality, integrity, and availability of electronic protected health information and to guard against reasonably anticipated threats.8U.S. Department of Health and Human Services. Summary of the HIPAA Security Rule The Privacy Rule governs how protected health information can be used and disclosed and applies to health plans, dental insurers, vision insurers, prescription drug plans, HMOs, and Medicare supplement insurers, among others.9U.S. Department of Health and Human Services. Summary of the HIPAA Privacy Rule When an AI claims system processes medical records, it must limit access to authorized personnel and comply with HIPAA’s minimum necessary standard.
State laws layer on more, especially around biometric data, real-time location tracking, and breach notification. The NAIC’s Insurance Data Security Model Law requires licensed insurers and agents to investigate cybersecurity events, notify the state insurance commissioner, and oversee third-party service providers handling insurer data.10National Association of Insurance Commissioners. NAIC Insurance Data Security Model Law Brief As of mid-2025, 28 jurisdictions had implemented that model law.
Automated Claims and Your Right to Human Review
AI-powered claims processing has to follow the same rules as human adjusters, including prompt payment statutes and unfair claims settlement practices regulations. Most jurisdictions set deadlines of 30 to 45 days for processing claims, depending on the policy type and the complexity of the loss. An AI system that hits those deadlines technically complies. A system that hits them by systematically undervaluing certain claim categories does not.
The NAIC’s Unfair Claims Settlement Practices Act is the template most states use. Under that model act, an insurer commits an unfair practice if its conduct is either flagrantly in conscious disregard of the rules or committed with enough frequency to indicate a general business practice.11National Association of Insurance Commissioners. Unfair Claims Settlement Practices Act (Model Act 900) Regulators can issue cease-and-desist orders and penalties. The “general business practice” trigger is where AI creates real exposure: a systematic algorithmic flaw that undervalues thousands of claims looks like a general business practice, even if no human ever intended it.
The biggest legislative trend in this area is a move toward mandatory human review of AI-generated denials. Several states have passed or are debating laws that prohibit insurers from using AI as the sole basis for denying a claim, particularly in health insurance. Those laws typically require a licensed physician or other qualified clinician to review the automated decision before it reaches you. Other states have adopted broader reporting requirements on approval and denial patterns when AI tools are involved.
Your appeal rights matter here. Many jurisdictions require insurers to offer a clear process for policyholders to request human review of an AI-generated claim decision. Some require insurers to disclose that AI was used and to explain the denial in plain language. If you receive a denial that seems wrong, filing an appeal forces a human to look at the file, and that is often where a miscalibrated algorithm gets overridden.
Fraud Flags Are a Gray Zone
Fraud detection is one of the most established AI uses in insurance, and it does catch organized schemes that human investigators would miss. But fraud-detection algorithms also produce false positives, and that is where honest policyholders get hurt. A legitimate claim flagged as fraudulent can trigger an investigation that delays payment for months, damages your claims history, and sometimes leads to non-renewal. Unlike a credit denial, where the FCRA requires an adverse action notice, no comparable federal rule requires an insurer to tell you that a fraud-detection model flagged your claim.
The claim is not technically denied, just delayed. For a homeowner waiting on repair funds after storm damage or a patient waiting on authorization for a procedure, the practical effect can be the same. The NAIC Model Bulletin’s written-program requirement applies to fraud-detection systems just as it applies to underwriting and claims models.2National Association of Insurance Commissioners. Use of Artificial Intelligence Systems by Insurers
Who’s Liable When the Algorithm Gets It Wrong
When an AI system produces a bad decision, figuring out who pays is messier than with human error. Courts and regulators generally start with the insurer, because the insurer chose to deploy the system and carries the regulatory duty to treat policyholders fairly. Whether the insurer can then recover from a software provider or data vendor depends on the contract.
The NAIC Model Bulletin reinforces that starting point: an insurer’s written AI program must address third-party systems, and regulators will examine the insurer’s oversight regardless of where the technology came from.2National Association of Insurance Commissioners. Use of Artificial Intelligence Systems by Insurers Failing to properly vet an algorithm before deployment is the kind of negligence that regulators and courts are increasingly willing to penalize.
Class action litigation is already emerging. Policyholders have filed suits challenging AI-powered utilization management tools in health insurance, alleging that automated systems systematically deny legitimate claims. Those cases typically assert breach of contract, unfair trade practices, and breach of the implied covenant of good faith and fair dealing. The results will shape how aggressively insurers deploy AI in claims decisions going forward.
One boundary worth flagging: some insurer policies now include clauses attempting to limit liability for AI errors or shift risk to policyholders or vendors. Those provisions face scrutiny under consumer protection laws, which generally require insurers to provide fair justifications for claim decisions regardless of how the decisions were generated. A clause that essentially says “if our algorithm gets it wrong, that’s not our problem” is unlikely to survive regulatory review in most jurisdictions.
What’s Coming Next
The NAIC is actively exploring a formal Model Law that would go beyond the current bulletin’s expectations and impose binding requirements on AI governance, bias testing, and transparency.3National Association of Insurance Commissioners. Big Data and Artificial Intelligence (H) Working Group State legislatures continue to pass laws requiring human review of automated claim denials, and federal agencies from Treasury to the CFPB have signaled that existing consumer protection statutes apply fully to AI-driven decisions.4Federal Register. Safe, Secure, and Trustworthy Development and Use of Artificial Intelligence
The international picture matters for larger carriers. The European Union’s AI Act, which took effect in stages starting in 2024, classifies AI systems used for risk assessment and pricing in life and health insurance as high-risk.12EU AI Act. Annex III – High-Risk AI Systems Referred to in Article 6(2) That triggers requirements for risk management, data governance, technical documentation, record-keeping, transparency, human oversight, and accuracy and cybersecurity standards. U.S. insurers writing policies in the EU or processing EU consumer data have to meet those requirements, which in several respects go further than current U.S. rules. The NAIC’s working group has a standing charge to monitor international AI activity and assess its potential impact on state insurance laws, so the EU framework may influence U.S. regulation over time.3National Association of Insurance Commissioners. Big Data and Artificial Intelligence (H) Working Group
The practical takeaway for policyholders is simple. You have the right to understand why your premium was set where it was, why your claim was denied, and whether AI played a role in either decision. If something looks wrong, exercise your appeal rights. An algorithm that processes a million claims cleanly can still get yours wrong, and the human review that follows an appeal is often where the error gets fixed.