AI Governance in Claims: What Insurers Need to Know
The record an examiner will ask for, the four regimes that set the deadline, and what belongs on the claim file before the exam.
13 min read
Twenty-nine US jurisdictions now set AI governance expectations for insurers, and the NAIC’s evaluation instrument for those expectations is already in use inside live market conduct exams in 12 states. The NAIC AI model bulletin is what most of that sits on.
The question it puts to a claims operation is narrower than the headlines suggest. An examiner will ask you to reconstruct a specific decision on a specific claim on a specific date, and show who or what made it, on what basis, under whose authority, and who could have overridden it. That’s a record-keeping question, and most claims operations can’t answer it today, whether or not they use AI.
What you will learn:
- What AI governance in claims covers, and the four things every regime targets
- What the NAIC AI model bulletin asks you to produce in an examination
- The compliance dates that matter, and the one most publishers have wrong
- The six fields a decision record needs to survive an exam
- A readiness checklist to run against a live claim file
Key definitions
These are the terms regulators use, defined the way they use them.
Term | Definition |
|---|---|
AIS Program | The written AI Systems Program the NAIC model bulletin expects every insurer to develop, implement, and maintain, covering governance, risk management controls, and internal audit. |
AI Risk Evaluation Supplement | The current name for the NAIC’s AI Systems Evaluation Tool, the instrument state regulators use to examine an insurer’s AI governance. Version 5.0 is out for public comment. |
Decision record | The claim-file artifact that reconstructs one decision: inputs, actor, model version, authority, and override history. |
What AI governance in insurance claims means
AI governance in insurance claims is the set of controls an insurer puts around any system that influences a claim outcome: who approved its use, what it was tested against, who can override it, and what record survives the decision. Regulators want the controls and the record.
Strip the acronyms out of the bulletins, circulars, regulations, and codes now in force across the US, EU, UK, and Australia, and they converge on four things.
Fair outcomes for policyholders. The governing worry is that a model produces a systematically worse result for some group of claimants, through a proxy variable nobody inspected.
Human oversight that’s real. Someone with the authority and the information to reverse a machine’s output has to exist, and has to be able to act on it. Article 14 of the EU AI Act spells this out down to a stop button.
Documentation and traceability. What the system is, what data trained it, how it was validated, how it drifts, and what it did on a given file on a given day.
Accountability for systems you bought. Every regime treats a vendor’s model as the insurer’s responsibility. Outsourcing the model, or the whole claims process, moves the work and leaves the obligation where it was.
Two factors determine how much these AI rules affect claims teams.
- How broadly the rules are written: Although most insurance AI regulations focus on underwriting and pricing, their broad wording often extends to the full insurance lifecycle, including claims.
- What counts as influencing a decision: The rules may cover not only systems that make final decisions, but also tools used to prioritize claims, summarize documents, or recommend actions to adjusters.
In the US, the anchor document for all of it is the NAIC AI model bulletin.
What the NAIC AI model bulletin actually requires
The NAIC bulletin asks for a written AI Systems Program, documentation and retention of how each AI system was built and used, and vendor contracts that let you produce a third party’s evidence on demand. It does not ask you to justify using AI.
The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on 4 December 2023. It expects insurers to “develop, implement, and maintain a written program (an ‘AIS Program’)” designed “to mitigate the risk that the Insurer’s use of an AI System will result in Adverse Consumer Outcomes.”
Adoption is wider than most claims leaders assume. The NAIC’s status map dated 6 August 2026 lists 25 adopting jurisdictions, 24 states plus DC, with California, Colorado, New York, and Texas running their own insurance-specific AI guidance. 29 jurisdictions with a live expectation. Claims is named in scope: the AIS Program covers “underwriting, rating and pricing, case management, claim administration and payment, and fraud detection.”
Section 4 sets out what a Department may ask you to produce:
- The written AIS Program, with senior management accountable to the board
- An inventory and description of every model and AI system in use
- “Documentation of compliance with all applicable AI Program policies, protocols, and procedures”
- Information about the data used to develop and oversee each model
- “Documentation related to validation, testing, and auditing, including evaluation of Model Drift”
- Vendor contracts with audit rights, and the audits showing those vendors complied
The usual response is to commission an AI policy, which is the cheap half. The expensive half is a four-word heading at Section 3.6: “Data and record retention,” meaning you can walk back to a claim decision years later and produce the evidence behind it.
The obstacle in claims is architectural: decisions get made across email, a core system, a vendor portal, and an adjuster’s notes, and no one place holds the chain.
AI governance deadlines for insurance claims by jurisdiction
Four regimes set real dates for claims, and one widely published date is wrong. The EU AI Act’s high-risk obligations for Annex III systems apply from 2 December 2027, not 2 August 2026.
Regime | The date that matters | What it means for claims |
|---|---|---|
NAIC AI model bulletin | Live in 29 jurisdictions; Supplement adoption targeted Nov 2026 | Written AIS Program, model inventory, validation and drift evidence, vendor contracts with audit rights |
Colorado | Reg 10-1-1 effective 15 Oct 2025; SB 26-189 effective 1 Jan 2027 | Statutory “insurance practice” includes claims management |
EU AI Act | 2 Dec 2027 for Annex III; Art. 50 and GDPR Art. 22 live today | P&C claims AI sits outside Annex III, inside EIOPA’s Opinion |
UK FCA | Outsourced claims oversight review reporting early 2027 | Delegated authority and outsourced claims under supervisory review |
Australia | Claims handling licensed since 1 Jan 2022 | Third-party handlers carry their own licensed obligation |
NAIC: the AI Risk Evaluation Supplement is already in live exams
The urgency is closer than the headline dates suggest. The NAIC’s evaluation instrument, renamed the AI Risk Evaluation Supplement, is already being used by 12 pilot states “in market conduct exams and reviews, financial analysis, and financial exams,” per the NAIC’s working group materials, with adoption for the full membership targeted for November 2026. The pilot spans 12 states including California, Colorado, Florida, and Pennsylvania, so for most books it’s already live somewhere you operate.
If your book touches any of the 12 states, you should treat these requirements as relevant now, even if they have not been formally adopted there. CCOs may want to consider incorporating compliance work into their 2027 budgets already now.
29
US jurisdictions with AI governance expectations on insurers (NAIC, Aug 2026)
12
states using the AI Risk Evaluation Supplement in live exams (NAIC, Mar 2026)
93%
of Lloyd’s market respondents have or are building AI governance frameworks (LMA, Apr 2026)
EU AI Act: high-risk obligations move to 2 December 2027
A lot of vendor content still carries the old date. The Digital Omnibus on AI, Regulation (EU) 2026/1744, entered into force on 27 July 2026, and the European Commission’s own page now states that high-risk rules “will apply from 2 December 2027.” A vendor telling you that you missed an August 2026 deadline hasn’t read the amendment. Annex III point 5(c) covers only “risk assessment and pricing” for “life and health insurance,” so what binds a P&C claims AI today is Article 50, GDPR Article 22, and EIOPA’s 2025 Opinion, which names claims handling in scope and asks firms to keep records “to enable their reproducibility and traceability.”
Colorado: the insurer carve-out routes you somewhere stricter
Colorado has been widely misreported. SB 24-205 never took effect in its original form: it was repealed and replaced by SB 26-189, signed 14 May 2026, effective 1 January 2027.
Insurers are carved out at C.R.S. § 6-1-1708(1)(a) and routed to § 10-3-1104.9, which is 3 CCR 702-10, Amended Regulation 10-1-1, effective 15 October 2025. The carve-out lands insurers somewhere stricter: Colorado defines “insurance practice” to include “claims management,” the clearest US regime reaching claims decisions by name.
The UK and Australia both put outsourced claims under the spotlight.
The FCA’s Regulatory Priorities: Insurance, 24 February 2026, commits to “expand our review of firms’ oversight of outsourced claims processes, to include different delegated authority models and remuneration arrangements,” reporting early 2027. Its multi-firm review of home and travel claims already found 6 of 23 firms with no documented oversight framework at all: “Firms may outsource elements of their claims handling, but they cannot outsource their regulatory responsibilities.” In
Australia, claims handling has been a licensed financial service since 1 January 2022, pulling TPAs inside the perimeter with obligations of their own (ASIC INFO 253), and ASIC’s REP 798 found nearly half of 23 licensees had no policy covering consumer fairness or bias in AI, with claims handling failures sitting among its 2026 enforcement priorities.
See How It Looks on Your Book.
See how agentic AI handles claims on your own claim types, with the decision trail attached.
What a claim-level decision record has to contain
Six fields, on every claim where software influenced an outcome: what was decided, on which inputs, under which version, with what authority, who could have overridden it, and whether anyone did.
Every regime above converges on one artifact under different vocabulary. The NAIC calls it record retention. EIOPA calls it reproducibility and traceability. Article 12 of the EU AI Act calls it automatic logging sufficient “to ensure a level of traceability of the functioning” of the system. The FCA calls it documented oversight.
Field | What it captures | Why an examiner asks |
|---|---|---|
Decision and timestamp | The specific outcome, on the specific claim, at the specific moment | Establishes what happened and when, before anything else can be assessed |
Inputs available | Which documents, data fields, and third-party sources fed the decision | Separates a wrong decision from a decision made on incomplete information |
Actor | Adjuster, rule, or agent, named, with version and configuration | Answers “who or what decided this,” the first question in every AI inquiry |
Authority | The delegated authority level under which the decision was permitted | Shows the decision sat inside sanctioned limits |
Override path | Who could have reversed it, and how the system surfaced that option | Maps to EU AI Act Article 14 human oversight and to FCA oversight expectations |
Override history | Whether a human intervened, what changed, and the stated reason | The most valuable field. Human corrections are the evidence that oversight actually happens |
The last two are where most operations fall down. A claims system that logs the final state of a claim, and not the sequence of decisions that produced it, can tell an examiner what was paid. It can’t tell them why, or who could have stopped it.
Speed of reconstruction is its own compliance property. At Resorts World Las Vegas, document review that consumed a full working day now runs in 37 seconds, and answering a question about any claim takes about 10 seconds against 30 to 45 minutes. A week of file pulls becomes an afternoon.
The market is moving faster than the regulation. The Lloyd’s Market Association surveyed firms representing over 60% of Lloyd’s stamp capacity in April 2026 and found 93% have or are building formal AI governance frameworks, with over 60% mandating human review of AI outputs. In the European carrier RFIs we’ve seen this year, “full traceability and audit trail of every agent decision” now appears as a stated platform requirement alongside data residency.
A readiness checklist for your next exam
Run these against one real claim file, closed at least 12 months ago, on a line where software touched the outcome. An afternoon of this beats a gap assessment.
| Check | Category |
|---|---|---|
| You can name every AI system and rules engine that touched claims in the last 24 months, with owner and version history | Inventory |
| Your written AIS Program exists, is board-visible, and names a senior accountable owner | Governance |
| You can reconstruct one closed claim decision end to end without asking a person to remember it | Record |
| Model or configuration version at the time of the decision is recoverable, not just the current version | Record |
| Human overrides are captured with a reason code, not silently absorbed into the final claim state | Oversight |
| Vendor contracts carry audit rights and a duty to cooperate with regulatory inquiries | Third party |
| Outsourced and delegated-authority claims produce the same record as in-house claims | Third party |
| Retention periods for AI decision records match your longest claims retention obligation | Retention |
The third row decides the rest. If reconstructing one closed claim takes a week of emails, the AIS Program is still a document and hasn’t become a control.
How this looks when the record is built into the workflow
The record is cheapest to produce when the system writes it while the work happens. Clive AI runs on top of your existing claims system and captures each control below at the moment of the action.
Most operations can’t produce the record because governance was added after the workflow, as a reporting layer over systems that never captured the decision chain. Building it retroactively means reconciling a core system, an email archive, a vendor portal, and adjuster notes never meant to be evidence.
Clive AI runs on top of your existing claims system or natively inside Five Sigma’s CMS and writes the decision trail as the work happens: which agent acted, on which documents, under which configuration, within which authority limit, and what an adjuster changed. Human corrections stay on the file, which is what Article 14 human oversight asks for and what makes the system better over time. The compliance artifact and the operating record are the same object.
- Decision authority. Autonomy attaches to the individual action, driven by cost of error. Action logic holds the thresholds and guardrails per claim stage.
- Human-handoff. Three triggers pass a claim to a person: technical failure, confidence below the configured threshold, or a pre-set intervention rule. The person has three options, each a recorded outcome: approve, edit and apply, or dismiss with a message. Any user can pull a claim back to manual at any point, reversibly.
- Role-based access. Clive operates inside the same permission profile as the person invoking it, respects organization and sub-organization boundaries, and opens no new access path to claim data. Access runs on RBAC with SSO, SAML, and 2FA.
- Audit trail. Prompts, retrieved evidence, and outputs are logged with timestamps and user attribution, inheriting the retention policy of claim logs. Insight history keeps every earlier assessment, so you can show how a read evolved.
- Explainability. Every output carries source citations, evidence-backed reasoning, a thinking thread, and links to the documents and fields behind it. Advisory agents surface a rating with the reasoning exposed, changing nothing on the claim.
- Policy enforcement. Strict grounding, validation passes across agents, and a fallback to “insufficient information” keep an unsupported answer off the file. Unless configured otherwise, recommendations never auto-execute.
- Model governance. The foundation model is Gemini on Vertex AI, used as a stateless inference engine: no customer data trains it, nothing is pooled across tenants. Five Sigma is SOC 2 Type II audited annually by EY, plus GDPR, HIPAA, and CCPA.
- Human corrections stay on the file, which is what Article 14 asks for and what makes the system better over time. The compliance artifact and the operating record become the same object.
Key takeaways
- AI governance in claims targets four things in every regime: fair outcomes, workable human override, documentation and traceability, and accountability for vendor systems.
- The NAIC AI model bulletin is a records obligation before it is an AI obligation, and claim administration and payment are named in scope.
- 29 US jurisdictions set AI governance expectations on insurers, and the NAIC’s evaluation instrument is already in use in live market conduct exams in 12 states.
- The EU AI Act’s Annex III obligations apply from 2 December 2027, not August 2026. P&C claims sits outside Annex III, but Article 50, GDPR Article 22, and EIOPA’s 2025 Opinion apply today.
- Outsourced claims carry the same evidentiary burden as in-house ones. A TPA’s record gap is the carrier’s record gap.
- The record is cheapest to produce when the claims system writes authority, evidence, and override at the moment of the action.
Bring the decision trail into the claim file itself.
See Clive AI on your claim types.
Frequently asked questions
See Clive AI on your claim types?
The controls an insurer puts around any system that influences a claim outcome: approval to use it, testing, human override, and a retained record of what it did. US, EU, UK, and Australian regimes target the same areas.
What does the NAIC AI model bulletin require?
A written AI Systems Program covering governance, risk management controls, and internal audit, proportionate to potential consumer harm. In an examination, a Department may request the program, model inventories, validation and drift documentation, and vendor contracts.
Which states have adopted the NAIC AI bulletin?
24 states plus the District of Columbia, as of the NAIC’s 6 August 2026 status map. Four more, California, Colorado, New York, and Texas, run their own insurance-specific AI guidance, for 29 jurisdictions in total.
Does the EU AI Act apply to insurance claims?
Not as a high-risk system. Annex III point 5(c) covers risk assessment and pricing for life and health insurance only. Claims AI falls under Article 50 disclosure duties, GDPR Article 22, and EIOPA’s August 2025 Opinion on AI governance.
What records do I need to keep for an AI claims decision?
The decision and timestamp, the inputs available at the time, the actor and its version, the authority under which it was permitted, the override path, and any human intervention with its reason. Version history matters as much as the outcome.
Does the NAIC bulletin cover AI my vendor runs?
Yes. It expects due diligence so third-party decisions “meet the legal standards imposed on the Insurer itself,” and contracts that include audit rights and a duty to cooperate with regulatory inquiries.
When will regulators start examining AI governance in claims?
They already are. 12 states have been using the NAIC’s evaluation instrument inside market conduct exams, financial analysis, and financial examinations since March 2026, ahead of formal adoption.
Tirtza Bensoussan
Related resources
- Blog: Why Claims Automation Fails Without Trust and Explainability
- Blog: Agentic AI in Claims: Autonomy Levels and Guardrails
- Blog: AI for Chief Claims Officers: Gaining Control, Not Losing It
- Blog: How to Design an AI-to-Human Handoff That Keeps Every Claim Moving
- Solution overview: Security & Compliance
