Is premium audit AI regulated?
Three sets of rules aim at insurance AI. Only one of them is likely to land on a premium audit decision.
Answered in short
6 things that decide this
- 01No US insurance AI rule names premium audit, exposure checking or the final premium sum.
- 02New York's Insurance Circular Letter No. 7 of 2024 is narrow. It says it is not meant to reach any phase of the insurance lifecycle other than underwriting and pricing.
- 03Colorado's statute defines insurance practice as a closed list of six activities. Premium audit is not one of them.
- 04The NAIC model bulletin is the broad one. It covers consumer-facing decisions that AI makes or supports, across the insurance lifecycle. Its list of areas includes rating and pricing, and policy servicing.
- 05That bulletin is a model, not law. It binds only where a state issues it. NAIC's tracker showed 25 adopting jurisdictions as of 1 April 2026.
- 06Commercial lines premium audit usually involves business policyholders, not consumers. That weakens the reach of every consumer-framed rule above.
The bulletin is written by function, not by name
Search the NAIC model bulletin for premium audit and you will not find it. Look instead at what it does cover, and the picture changes.
It says decisions or actions affecting consumers that AI makes or supports must follow all applicable insurance laws. It asks insurers to run a written programme for AI systems. That covers any system that makes or supports decisions on regulated insurance practices. And its list of lifecycle areas opens with the words including areas such as. That is not a closed list.
A premium audit sets the final premium a policyholder pays. That is a regulated decision affecting them. The bulletin's wording reaches it without naming it. So plan on it being in scope wherever the bulletin has been adopted.
What each rule actually covers
Checked 10 November 2026. Sources: the NAIC model bulletin and its adoption tracker, NY DFS Circular Letter No. 7 (2024), Colorado's statute, Regulation 10-1-1 and SB 26-189.
| Instrument | Its stated scope | Reaches premium audit? |
|---|---|---|
| NAIC model bulletin, adopted December 2023 | Decisions impacting consumers made or supported by AI, across the lifecycle, in an open list | Plausibly yes, by function, where a state has issued it |
| NY DFS Circular Letter No. 7 (2024) | Underwriting and pricing, and no other lifecycle phase | No |
| Colorado SB21-169 | Six named practices: marketing, underwriting, pricing, utilization management, reimbursement methodologies, claims management | No, and premium audit is absent from the list |
| Colorado Regulation 10-1-1 | Governance rules, extended in October 2025 to private passenger auto and health benefit plans | No, commercial lines sit outside it |
| Colorado SB 26-189 (replaced the 2024 AI Act in May 2026) | Automated decision-making tools used in consequential decisions, insurance included, from 1 January 2027 | Possibly, though commercial policyholders are not consumers |
The programme the bulletin describes is good engineering anyway
The bulletin asks for governance, risk controls and internal audit. Senior management answers to the board. The effort should match the potential harm. And the programme should cover the whole model lifecycle, including systems built by outside vendors.
In a build, that is a short list. Know which decisions the model touches. Be able to explain any one of them later. Keep a record of what changed and when. Hold bought components to the same standard as your own.
The bulletin also notes an insurer may rely on the NIST AI Risk Management Framework. It asks for consumer notice that AI is in use. Section 4 sets out what a regulator may expect to see during a market conduct exam. That is where the practical teeth are.
- 01An auditor reviewing every result is the strongest position under all three regimes. The model prepares; it does not decide.
- 02Keep the exception path visible: which policies the model could not handle, and what a human did with them.
- Which states?Bulletin adoption differs by state.
- Which lines?Commercial sits outside Colorado's rules.
- Consumer or business?Most commercial audit is business to business.
- Decides or supports?A human deciding narrows exposure.
- Can you explain it?Per policy, months later.
- Write it downBefore a market conduct exam asks.
The fourth station is the one you control. A model that prepares a figure for an auditor to approve is one thing. A model that sets the premium itself is another.
Some of the systems we have shipped
Related questions
01Does the NAIC bulletin apply in every state?+
No, because it is a model each state chooses to issue. NAIC's tracker listed 25 adopting jurisdictions as of 1 April 2026. California, Colorado, New York and Texas are listed separately, with their own insurance guidance. Where you write business decides which versions you answer to.
02Does using a vendor's AI move the obligation off us?+
It does not. The bulletin asks the insurer's programme to cover third-party AI systems as well as in-house ones. So the carrier stays answerable for a model it did not build. In a contract, that becomes a right to documents and test evidence from the vendor.
03Would a market conduct exam ask about this?+
Assume so. The bulletin's fourth section lists what a regulator may expect during an investigation or exam. It hangs off existing market conduct powers rather than creating new ones. That is why documents you can produce matter more than a policy nobody has read.
04Does an audit that raises a premium count as an adverse outcome?+
The bulletin defines an adverse consumer outcome. It is a decision under insurance regulatory standards that hurts the consumer in a way those standards forbid. So a correct increase is not one. An increase from a model nobody can explain is much harder to defend. Being able to explain it is the practical protection.
Related
- AI, automation and custom software for insurance agencies →What premium audit actually needs.
- AI, automation and custom software for firms →The wider build across accounting, insurance and staffing.
- AI evals →How accuracy gets documented for review.
- Human in the loop →The design choice that narrows exposure.
- Is your AI build EU AI Act compliant →The same question under the European regime.
- Reconciliation →Making two records agree, which audit depends on.
