NAIC AI Principles: What Insurance Teams Should Document
Use the NAIC AI principles to ask practical questions about insurance AI. Keep the principles distinct from the requirements that apply to your organization.
Updated 5 min read
The NAIC AI principles provide a high-level starting point for responsible artificial intelligence in insurance. Applying principles means asking practical questions about a defined use, then identifying the laws and regulatory requirements that actually apply to the insurer. An internal principles checklist cannot establish that an organization has met those requirements.
Tools like fenbs can keep the internal rules people approve, the responsibilities they assign, and the review decisions behind a project. They do not determine regulatory obligations or certify compliance. That distinction matters when a broad principle becomes a practical instruction for staff and their assistants.
How do principles become everyday insurance review questions?
The National Association of Insurance Commissioners, or NAIC, brings together US state insurance regulators. Refer to its original AI principles (opens in a new tab) for the authoritative wording. The worksheet below is an independent way to organize team review work, rather than a reproduction of the official principles or a finished insurance policy.
| Review concern | A practical question | A useful record |
|---|---|---|
| Fair and ethical use | Who could experience an unfair outcome, and how will we examine it? | Evaluation scope, limitations, and follow-up owner. |
| Accountability | Who has authority over the use and responsibility for its consequences? | Named decision owner and escalation route. |
| Compliance | Which applicable obligations has qualified staff identified? | Approved requirements and links to controlled source material. |
| Transparency | What should affected people and reviewers understand? | Intended audience and approved explanation approach. |
| Security, safety, and robustness | What happens when inputs, conditions, or the system change? | Testing responsibilities, permitted boundaries, and response plan. |
These areas overlap. An explanation may expose a data problem; a security restriction may affect who can investigate it. Give someone responsibility for resolving those tradeoffs. A list of principles without a person able to act leaves the next team member guessing which concern takes priority.
How are principles different from applicable requirements?
A principle expresses a broad expectation. A model bulletin gives regulators a common reference they may use in their own supervisory work. Applicable obligations come from the relevant legal and regulatory setting. Do not assume a national association’s document has identical effect in every state or for every insurance activity.
For a concrete jurisdictional source, the New York Department of Financial Services circular on AI in underwriting and pricing (opens in a new tab) sets out that department’s expectations and discusses the NAIC model bulletin. Its scope is specific. It should not be copied into a nationwide checklist as though every sentence applies everywhere.
Ask qualified legal and compliance staff to map the proposed use to the relevant states, insurance lines, activities, and requirements. Record who made that assessment and where its approved version lives. When a requirement changes, review the internal rule it informed instead of assuming an old summary remains adequate.
Which AI uses should the team describe first?
Start with the work the AI influences: underwriting support, pricing, claims handling, marketing, or internal drafting, for example. Describe the input, output, affected person, and next action. “We use AI for efficiency” is too broad to tell a reviewer where an error could alter someone’s treatment.
Say an insurer is considering an assistant that drafts internal underwriting summaries. Specify whether it only summarizes supplied documents or recommends an outcome. Identify who reviews it and whether any output reaches an applicant. A move from summarizing to recommending deserves an explicit review rather than a quiet expansion of the original permission.
- State the purpose and the uses the approval does not cover.
- Name the business owner and the people responsible for technical, legal, and operational review.
- Identify the approved evidence location and the limitations that remain unresolved.
- Define which system or workflow changes require another decision.
Keep those boundaries in Decisions and rules so an assistant working on a later task can read what people actually approved.
What evidence should support an internal review?
Match the evidence to the consequence of the proposed use. Reviewers may need to examine data suitability, performance under expected conditions, relevant unfair-discrimination risks, explanation quality, and the ability to investigate errors. Let qualified specialists choose the methods and acceptance criteria; a general checklist cannot settle technical adequacy.
A supplier’s statement that its product follows responsible AI principles is a starting point for questions. Ask what was evaluated, for which intended use, using which version, and with what unresolved limits. Keep the supplier’s evidence distinct from the insurer’s decision about using the product in its own work.
The NIST AI Risk Management Framework (opens in a new tab) offers a voluntary general framework for AI risk work. It can help organize questions, but it does not replace insurance-specific requirements. A completed worksheet shows that someone completed a worksheet; the supporting evidence and review still matter.
How should approval, exceptions, and changes be recorded?
Separate a proposal from an approved rule. A reviewer can recommend a restricted trial; a person with the necessary authority must decide whether that trial proceeds. Record the permitted scope, rationale, conditions, and unresolved actions. Avoid a one-word “approved” that loses which use and evidence the decision concerned.
An exception should identify its scope and owner rather than silently rewriting the general rule. When someone replaces a decision, preserve the earlier reasoning and state what changed. That makes an attributed work history useful without confusing it with a complete regulatory audit record.
An AI brain helps when it holds this current work context outside private chats. The AI employees guide explores assistant responsibilities; the authority to approve a regulated use remains with the appropriate people.
Keep the rule and its owner beside the work
Use fenbs to record approved internal rules, open review questions, and tasks for missing evidence. People make decisions and sign off; assistants can record those decisions and read the rules before helping. History preserves who changed the work without certifying regulatory compliance.
Create a free accountFree for one person · No credit card · Works with Claude, ChatGPT, Cursor and more
How to do this with fenbs
- Create a free account and add a project for one clearly described insurance AI use.
- Create tasks for evidence requests, review questions, and outstanding approvals. Link to approved evidence locations without copying customer or policyholder data.
- Record the rules people approved in Decisions and rules, including the responsible person, scope, and reason.
- Have a connected assistant read the project context before drafting review materials, then save progress with unresolved work and the next human decision.
fenbs is not the right fit for policyholder records, fairness testing, legal interpretation, or a dedicated insurance compliance system. Keep those functions in approved tools. Use fenbs for shared work instructions and follow-up decisions, subject to your organization’s own approval of the tool and the information entered.
How can you prevent the principles from becoming shelfware?
Review a real decision against the agreed process. Can a colleague identify the approved use, who reviewed it, what evidence supported it, and what happens after a material change? If those answers require searching private conversations, improve the record before adding another policy paragraph.
For a different organization’s approach, see Microsoft responsible AI principles. For everyday work habits, start with how to use AI at work, then explore related review topics in the AI governance hub.