The NAIC's AI Bulletin Wants Proof Your Team Was Trained, Not Just a Policy

"We have an AI policy, the board approved it, and it is filed with our compliance documents. Isn't that what the NAIC bulletin asks for?" For many insurers and the agencies and vendors that support them, that is where AI governance stopped. Under the NAIC's model bulletin, it is closer to where an examination starts.

The bulletin expects a written program, but it also names "ongoing training and supervision of personnel" as part of that program and lists training materials among the documents a regulator may request. NAIC AI bulletin training is not a soft add-on to the policy. It is one of the few elements an examiner can check against what your people actually know.

What does the NAIC AI bulletin require for training?

The bulletin lists "development and implementation of ongoing training and supervision of personnel" as part of an insurer's written AI Systems (AIS) program, and says regulators may request the program's "policies, procedures, guidance, training materials, and other information." In practice, insurers should expect to show who was trained, on what, and how their AI-assisted work is supervised.

Those quotes come from the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, adopted in December 2023. The training item sits in the section on governance, alongside the expectation that senior management, accountable to the board or a board committee, owns the program's development, implementation, monitoring, and oversight. The documentation list sits in the section on what a department may ask for during an investigation or market conduct action.

Read together, they describe a chain an examiner can follow: the board approved a program, senior management owns it, the program says personnel are trained and supervised, and the training materials show what that training actually covered. A policy without the last two links is the "paper governance" problem we described in our coverage of the AI exam regulators piloted this year.

Where the bulletin applies now

The bulletin is a model, so it carries weight only where a state insurance department adopts it. As of August 6, 2026, the NAIC's adoption map listed 25 jurisdictions, 24 states and the District of Columbia, as having adopted it. California, Colorado, New York, and Texas are listed separately because they rely on their own insurance-specific AI regulation or guidance.

For a carrier licensed in several states, that means the bulletin is the de facto baseline. And because the bulletin's AIS program covers AI systems used in regulated insurance practices whether developed by the insurer or a third-party vendor, its expectations travel down the chain to MGAs, agencies, claims administrators, and technology vendors through insurer diligence and contract terms.

Why training is the hardest part of the bulletin to fake

Here is the view we hold that many compliance teams will resist: the training element is not the easy box on the checklist. It is the one most likely to expose a gap, because it is the only part of the program that has to exist inside people's heads as well as in a document.

A written policy can be drafted in a week. A model inventory can be assembled from vendor contracts. But the bulletin tells insurers they can expect to be asked about their development, deployment, and use of AI systems and about specific models and their outcomes. Those questions get answered by underwriters, claims handlers, actuaries, and operations staff. If the people using an AI-assisted pricing or claims triage tool cannot explain what it does, when they override it, and who reviews their overrides, the training materials on file will not carry much weight.

That is also why generic AI awareness courses fall short here. The bulletin's concern is adverse consumer outcomes in regulated insurance decisions: decisions that are "inaccurate, arbitrary, capricious, or unfairly discriminatory." Training that covers phishing-style AI safety tips but never touches the specific models staff rely on for underwriting, claims, or marketing does not address the risk the program exists to manage.

Examiners are getting a structured way to ask

The bulletin itself has been in place since 2023. What changed in 2026 is that regulators began testing a standard way to examine it. According to Fenwick's summary of the pilot, 12 states began piloting the NAIC's AI Systems Evaluation Tool on March 2, 2026, meeting monthly through September.

On August 31, the NAIC's Big Data and Artificial Intelligence (H) Working Group released version 5.0, renamed the AI Risk Evaluation Supplement, with a new exhibit centered on the carrier's formal AIS program and explicit coverage of agentic AI, as McGinnis Lochridge's insurance AI briefing reports. The pilot concluded at the end of September, and the NAIC's artificial intelligence topic page indicates adoption was anticipated at the 2026 Fall National Meeting, scheduled for November 14 to 17 in Dallas. Whatever final form it takes, the direction is clear: examiners will arrive with structured questions about the program, and training is part of the program.

What a training record that holds up looks like

A defensible record ties training to specific systems and roles, rather than to a date on an HR calendar. The table below shows how that looks for common insurance functions.

The supervisor row matters most. The bulletin pairs training with supervision, and the human review step is only as good as the person doing it. We looked at how often that step becomes a formality in whether human-in-the-loop is actually working, and the answer usually comes down to whether reviewers were trained to disagree with the system.

Does training extend to third-party AI vendors?

Indirectly, yes. The bulletin expects insurers to perform due diligence on third-party AI systems and data and, where appropriate, to include contract terms that provide audit rights and require vendors to cooperate with regulatory inquiries. An insurer that cannot explain a vendor's model to an examiner has both a training gap and a contract gap.

That has two practical consequences. Internal staff need training on vendor systems, not just in-house models, since most AI in a mid-sized carrier or agency arrives inside purchased platforms. And vendor agreements should give the insurer enough information to train people properly. Our breakdown of the AI vendor contract clause that decides whether you can prove compliance covers the terms to look for.

Colorado adds a related pressure for anyone operating there. Its replacement AI law, which Skadden notes takes effect January 1, 2027 if rulemaking is complete, covers consequential decisions in insurance and requires deployers to designate and train an individual who can review and override adverse decisions. The NAIC bulletin and Colorado arrive at the same place: a named, trained person with authority over the AI-assisted decision.

How to close the gap before an examiner finds it

Most of the work is connecting pieces that already exist rather than building new ones. A practical sequence for insurers, agencies, and their service providers:

1. Start from the AI system inventory, including vendor tools and AI features embedded in policy administration, claims, and CRM platforms.
2. Map each system to the roles that use it or review its output.
3. Build or source training specific to each system and role, with supervisors trained separately.
4. Store training materials and completion records with the AIS program documentation, not in a separate HR system.
5. Set a refresh trigger tied to model changes, vendor updates, and new AI features.

This is the same discipline insurers already expect from policyholders on the cyber side, where underwriters want proof of controls rather than statements of intent, as we outline in what cyber underwriters actually require in 2026. It also depends on visible leadership: people treat training as real when their managers check for it, a point we make in leadership's role in building cyber awareness. And it is much harder to do well without someone watching the environment the tools run in, which is why DIY AI carries hidden risks for regulated firms.

How Securafy helps insurance teams prove it

For insurers, agencies, and the firms that serve them, we start by building an accurate AI inventory from the environment itself: licensed platforms, enabled AI features, and the integrations moving consumer data between them. That inventory becomes the backbone of the AIS program documentation and the map for role-based training.

From there we help clients build training tied to the specific systems each role uses, set up supervisor review practices, and keep training records alongside the program documents so they can be produced on request. Because we also manage the security controls around those systems, the training reflects how the tools are actually configured, which is what an examiner's follow-up questions will test.

Where To Go From Here

Pull your AIS program document and ask one question: could the people named in it explain the AI systems they use to a regulator today? If the answer is uncertain, training and supervision are the gap to close first.

If your team is moving faster with AI than your guardrails are, start with structured training rather than another tool. AI University gives your people role-based AI training with security built into the material, not bolted on afterward.

If you would rather talk through your specific environment first, book a strategy call with Securafy and we will walk your current AI usage, exposure, and the fastest path to safe adoption.