AI Policy Template for Insurance

Insurance is one of the few industries where regulators have already moved: most states have adopted the NAIC Model Bulletin, which expects insurers — and by extension their distribution partners — to maintain written AI governance programs. Even a small agency benefits from a policy that controls what policyholder data touches AI tools and requires human review of anything resembling a coverage or claims determination.

AI risks specific to insurance agencies

• State regulators have adopted the NAIC model bulletin requiring written AI governance programs
• AI involvement in underwriting or claims decisions can trigger unfair-discrimination scrutiny
• Policyholder data entered into consumer chatbots may violate GLBA and state privacy rules
• AI-drafted coverage explanations that are wrong can create E&O exposure

Compliance requirements your policy must address

What a complete insurance AI policy includes

• Purpose, scope, and who the policy covers (employees, contractors, volunteers)
• Approved AI tools and the process for approving new ones
• Acceptable uses — and the prohibited list, including data that must never enter prompts
• Privacy-law clauses for your jurisdictions (GDPR, EU AI Act, CCPA, PIPEDA) plus State Insurance Regulations and GLBA requirements
• Human review and accountability rules for AI output
• Incident reporting, enforcement, and annual review

Frequently asked questions

Does the NAIC bulletin apply to small agencies?

The bulletin formally addresses insurers, but carriers increasingly push governance expectations down to agencies. A written AI policy is fast becoming a contractual expectation, not just a best practice.

Can we use AI for claims correspondence?

With care. AI can draft, but a licensed human should review anything that communicates a coverage position. The generated policy includes that requirement.

Other industries