Regulators' New AI Exam Tool Heads for a November Vote. What Agencies Should Prepare

By The Professions Cloud Editors Updated October 2026 · 5 sources · 3 min read

Prices and facts checked October 13, 2026. We don't accept payment for rankings.

What happened: the NAIC's AI exam framework, originally the AI Systems Evaluation Tool and now renamed the AI Risk Evaluation Supplement, is in its final stretch. Version 5.0 was exposed on August 31, 2026, a public meeting for verbal comments was set for October 8, a further draft goes out for a 14-day comment period this month, and final adoption is targeted for the NAIC Fall National Meeting in November 2026 (McDermott Will & Schulz).

Why it matters today: once adopted, it's expected to become the standard framework for AI questions in regulatory exams, including for insurers outside the 12 pilot states. Insurers will pass documentation, audit and disclosure requests down to agencies, MGAs and vendors (McDermott).

How we got here

Pilot states: California, Colorado, Connecticut, Florida, Iowa, Louisiana, Maryland, Pennsylvania, Rhode Island, Vermont, Virginia and Wisconsin, testing it on property and casualty, life and health insurers (McDermott; Repairer Driven News).

What the Supplement asks

The NAIC describes it as gathering information on insurers' AI use, governance, high-risk models and data inputs (NAIC). In practice (McDermott):

• Exhibits on how the insurer uses AI, its governance and its high-risk models
• Exhibit B: the insurer's "AI Systems Program" of controls, including oversight of third-party models and AI embedded in third-party products
• Version 5.0 extends scope to machine learning and general language models, separates AI "systems" from "models", tightens materiality and adds third-party oversight questions

The next shoe: a third-party vendor framework

A separate NAIC working group is building a risk-based framework for third-party data and model vendors, with a broad definition covering insurtechs, data aggregators and AI platform providers. It could become a model law in 2026 or 2027 (McDermott; Fenwick).

Why agencies should care

The Supplement examines insurers, but its third-party questions reach anyone whose AI touches the insurer's business:

• MGAs and agencies with delegated authority using AI in underwriting, rating or claims intake
• Agencies using AI to collect application data, compare quotes or service policies
• AI phone agents gathering quote information for carriers

Expect carriers to ask what AI you use, for documentation, and for audit cooperation in contracts. This builds on the AI Model Bulletin, now adopted in 29 jurisdictions (NAIC adoption map; our bulletin guide).

An agency readiness checklist

1. Keep an AI inventory: tool, vendor, purpose, data touched, which carriers it affects.
2. Classify by risk: anything influencing underwriting, rating, coverage or claims is high-risk.
3. Collect vendor documents: security reports, data-use terms, model change notices.
4. Document human review for coverage, binding and claims decisions.
5. Prepare a one-page AI summary you can send carriers on request.
6. Review carrier agreements for new AI clauses at renewal.

Using AI in your management system? See Applied Epic Conductor and agency AI.

FAQ

Is the Supplement a law?

No. It's an examination tool regulators can use. Once adopted, it sets expectations for what insurers should be able to show.

Will my state use it?

Pilot states already do. McDermott expects it to become the standard for AI-related regulatory inquiries generally.

Does it apply directly to agencies?

Not directly. Agencies feel it through carrier requests and contracts, especially MGAs with delegated authority.

Changelog: Oct 13, 2026: first published.