INDUSTRIES. INSURANCE.
Your state department, the model law it enacted, and the examination that asks about both.
A carrier sends an agency a security questionnaire. The agency asks its vendors: the management system, the rater, the document service, the servicing partner. Four formats come back, none the one asked for.
Where the AI bulletin stands.
- NAIC map, 31 August 2026
- 24 states and the District of Columbia; California, Colorado, New York and Texas by their own instruments
- Louisiana
- Not adopted; in the twelve department NAIC pilot
Your vendors hold the evidence a carrier asks for.
Under an enacted Model #668, overseeing them is your duty, not the carrier's, and a department examines that evidence.
Who you are changes what you owe.
- A carrier
- Core systems and underwriting data; examined where admitted; sends the questionnaires
- An agency or producer
- Data in systems it did not build; duties by carrier contract; see the exemptions
- A managing general agent
- Binds on delegated authority; its controls join the carrier's answer
- A third party administrator
- Claims, premium or eligibility for others; its incident is theirs
Model #668 binds only where enacted, and its exemption is narrow.
| Limb | Model #668 | Louisiana |
|---|---|---|
| Notice | To the commissioner, no later than 72 hours after determining a cybersecurity event has occurred | To the Commissioner of Insurance, without unreasonable delay and no later than three business days from a determination that a cybersecurity event involving nonpublic information in the licensee's possession has occurred |
| Domicile limb | The state is the licensee's domicile or home state. No further test. | Louisiana is the licensee's state of domicile or home state and the event is reasonably likely to harm Louisiana consumers or the licensee's operations |
| 250 consumer limb | The event involves the nonpublic information of 250 or more of that state's consumers and either notice is required to another government body or material harm is reasonably likely | The licensee reasonably believes the event involves the nonpublic information of 250 or more Louisiana consumers and a further notice or harm test is met |
| Program exemption | Section 9, from the written program only: fewer than 10 employees, including any independent contractors; a HIPAA compliant program; cover under another licensee's program | R.S. 22:2509(A), from the program requirement in R.S. 22:2504: fewer than 25 employees; less than $5 million in gross annual revenue; less than $10 million in year end total assets; a HIPAA compliant program; an affiliate of a depository institution subject to the Interagency Guidelines; among others |
| Exempt still owes | The Section 5 investigation duty and the Section 6 notification duty, including the 72 hour clock | The investigation and notification duties |
NAIC Insurance Data Security Model Law, Model #668, with the Section 9 exemption
The Section 9 exemption reaches Section 4 and nothing else. A small agency is not exempt from Model #668, only from one section of it.
Section 4 is the written program: safeguards built on a risk assessment, board oversight, a responsible individual, service provider oversight, an incident response plan and annual board reporting.
Reaches licensees where a state enacted it, under the enacted text; adoption and exemptions vary. Not a licensee in a state without it. Advisory and vCISO builds the program; the Security Assessment evidences it.
Louisiana. Insurance Data Security Law, La. R.S. 22:2501 and following, Act 283 of 2020
Effective 1 August 2020; the written program requirement from 1 August 2021; third party service provider measures from 1 August 2022. Its limbs, in the statute's words: the table above. The domicile harm test is Louisiana's own; the model has none.
Reaches licensees of the Louisiana Department of Insurance, and no one else.
Your supervisor is a state department, on two tracks.
With no federal regulator, a carrier writing in twelve states answers twelve. The track a question arrives on decides which budget pays.
Market conduct examination and the NAIC Market Regulation Handbook
Financial condition examination reviews solvency. Market conduct examination, guided by the Handbook, reviews treatment of consumers, with its own examiners and evidence; data handling and AI in underwriting and claims increasingly arrive there.
Insurers and, depending on the state, producers and other licensees. No threshold, and frequency and scope are risk based rather than fixed. The Handbook is not a rule and creates no obligation. Preparation: Examination and Evidence Readiness.
The AI expectation arrives as a bulletin, where adopted.
NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers
Adopted by the NAIC in December 2023: an insurer using AI keeps a written, board overseen AI systems program covering governance, controls, and third party AI systems and data, which a department may request in examination or market conduct. It is guidance, binding nobody until a department adopts it, with any variations. Check the NAIC's current map.
Insurers authorized in an adopting state, and no obligation exists in a state that has not adopted it. Whether a state's version, of this or of Model #668, reaches producers, managing general agents or third party administrators is a state question.
The NAIC AI Systems Evaluation Tool pilot, March through September 2026
Twelve departments, Louisiana's among them, from 2 March 2026 through September 2026, concentrated on their domestic insurers and requested information under existing examination authority. The tool tests how clearly an insurer can explain its AI governance: a sign of where supervision is heading, and of what a Louisiana domestic insurer may be asked next.
No obligation arises from it, and no insurer elsewhere was asked anything. An updated tool is expected at the NAIC fall national meeting in November 2026.
Governance and the inventory: the AI Governance Assessment. Third party AI, hardest to evidence because it arrives inside a vendor already on file: the AI Vendor and Third Party Review. Controls over time: the AI Governance Program.
Two states reach further, both conditionally.
NYDFS Cybersecurity Regulation, 23 NYCRR Part 500
Amended requirements took effect 1 November 2025.
- Reaches
- Holders of a DFS license, registration, charter or similar authorization.
- Not
- A firm whose only link is a New York customer.
- Exempt
- Any one of three 500.19(a) tests, set out on Mortgage, removes the sections 500.19(a) lists; never the 72 hour or 24 hour notices in 500.17.
Further exemptions sit at 500.19(b) to (e), including ones for insurance entities holding only corporate parent information and for inactive individual brokers.
Colorado SB 21-169 and 3 CCR 702-10, Regulation 10-1-1
Colorado licensed insurers using external consumer data and information sources, or predictive models built on them, keep a documented governance and risk management framework and attest annually. Amended Regulation 10-1-1, effective 15 October 2025, covers life, private passenger automobile and health benefit plan insurers.
It attaches by line of business and data use rather than size, and an insurer not using such data in a covered line owes nothing.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
What this firm claims here, stated plainly.
This firm has not built its name in insurance the way it has in mortgage. What it claims here is literacy in your rulebook, checkable against the instrument named.
It publishes no client names or anonymized accounts; About says why. It does not decide whether you are exempt.
Done well: duties read from the enacted text, a written AI program the board oversees, vendors documented to the bulletin, answers from a dated record.
Our own vendor answers: Trust and Assurance.