Is premium audit AI regulated?
Three sets of rules aim at insurance AI. Only one of them plausibly lands on a premium audit decision.
Answered in short
6 things that decide this
- 01No US insurance AI rule names premium audit, exposure checking or the final premium sum.
- 02New York's Insurance Circular Letter No. 7 of 2024 says it is not meant to address any phase of the insurance lifecycle other than underwriting and pricing.
- 03Colorado's statute defines insurance practice as a closed list of six activities. Premium audit is not one of them.
- 04The NAIC model bulletin is the broad one. It covers decisions affecting consumers that AI makes or supports across the insurance lifecycle. Its list of areas includes rating and pricing, and policy servicing.
- 05That bulletin is a model, not law. It binds only where a state issues it. NAIC's tracker showed 25 adopting jurisdictions as of 1 April 2026.
- 06Commercial lines premium audit usually involves business policyholders, not consumers. That weakens the reach of every consumer-framed rule above.
The bulletin is written by function, not by name
Search the NAIC model bulletin for premium audit and you will not find it. Look instead at what it does cover, and the picture changes.
It says decisions or actions affecting consumers that AI makes or supports must comply with all applicable insurance laws. It asks insurers to run a written programme for AI systems that make or support decisions on regulated insurance practices. And its list of lifecycle areas opens with the words including areas such as. That is not a closed list.
A premium audit sets the final premium a policyholder pays. That is a regulated decision affecting them. The bulletin's wording reaches it without naming it. So plan on it being in scope wherever the bulletin has been adopted.
What each rule actually covers
Checked 11 August 2026 against the NAIC model bulletin and its adoption tracker, NY DFS Circular Letter No. 7 (2024), and Colorado's statute.
| Instrument | Its stated scope | Reaches premium audit? |
|---|---|---|
| NAIC model bulletin, adopted December 2023 | Decisions impacting consumers made or supported by AI, across the lifecycle, in a non-exhaustive list | Plausibly yes, by function, where a state has issued it |
| NY DFS Circular Letter No. 7 (2024) | Underwriting and pricing, and expressly no other lifecycle phase | No |
| Colorado SB21-169 | Six named practices: marketing, underwriting, pricing, utilization management, reimbursement methodologies, claims management | No, and premium audit is absent from the list |
| Colorado Regulation 10-1-1 | Governance framework, extended in October 2025 to private passenger auto and health benefit plans | No, commercial lines sit outside it |
| Colorado automated decision-making law | Consequential decisions, which include insurance | Possibly, though commercial policyholders are not consumers |
The programme the bulletin describes is good engineering anyway
The bulletin asks for governance, risk controls and internal audit. Senior management answers to the board. The effort should match the potential harm. And the programme should cover the whole model lifecycle, including systems built by third parties.
In a build, that is a short list. Know which decisions the model touches. Be able to explain any one of them later. Keep a record of what changed and when. Hold bought components to the same standard as your own.
The bulletin also notes an insurer may rely on the NIST AI Risk Management Framework. It asks for consumer notice that AI is in use. Section 4 sets out what a regulator may expect to see during a market conduct exam. That is where the practical teeth are.
- 01An auditor reviewing every result, with the model preparing rather than deciding, is the strongest position under all three regimes.
- 02Keep the exception path visible: which policies the model could not handle, and what a human did with them.
- Which states?Bulletin adoption differs by jurisdiction.
- Which lines?Commercial sits outside Colorado's rules.
- Consumer or business?Most commercial audit is business to business.
- Decides or supports?A human deciding narrows exposure.
- Can you explain it?Per policy, months later.
- Write it downBefore a market conduct exam asks.
The fourth station is the one you control. A model that prepares a figure for an auditor to approve sits in a materially different position from one that sets the premium itself.
Document-heavy systems under review
Related questions
01Does the NAIC bulletin apply in every state?
No, because it is a model each state chooses to issue. NAIC's tracker listed 25 adopting jurisdictions as of 1 April 2026. California, Colorado, New York and Texas are listed separately, with their own insurance guidance. Where you write business decides which versions you answer to.
02Does using a vendor's AI move the obligation off us?
It does not. The bulletin asks the insurer's programme to cover third-party AI systems as well as in-house ones. So the carrier stays answerable for a model it did not build. In a contract, that becomes a right to documentation and test evidence from the vendor.
03Would a market conduct exam ask about this?
Assume so. The bulletin's fourth section lists what a regulator may expect during an investigation or exam. It hangs off existing market conduct powers rather than creating new ones. That is why documents you can produce matter more than a policy nobody has read.
04Does an audit that raises a premium count as an adverse outcome?
The bulletin defines an adverse consumer outcome as a decision under insurance regulatory standards that hurts the consumer in a way breaking those standards. So a correct increase is not one. An increase from a model nobody can explain is much harder to defend. Being able to explain it is the practical protection.
Related
- Insurance software development →What premium audit actually needs.
- AI evals →How accuracy gets documented for review.
- Human in the loop →The design choice that narrows exposure.
- Is your AI build EU AI Act compliant →The same question under the European regime.
- Reconciliation →Making two records agree, which audit depends on.
