The NAIC Model Bulletin on insurer AI use, adopted December 2023, now stands in 24 states and the District of Columbia, with four more layering insurance-specific AI regulation on top.

A GLM rate filing carried coefficient tables, relativity charts and a narrative tying rating variables to loss experience. The compliance report structure presented at the Spring 2026 National Meeting asks for data lineage, feature-to-factor mapping, bias testing evidence and drift monitoring protocols, and ASOP No. 56 predates all of it.

Key Takeaways

  • A ZIP relativity of 1.35 is verifiable against loss ratios; a gradient-boosted model with 200 features produces no coefficients, learns its interactions from data, and makes every single-variable relationship conditional on the others.
  • Every model feature must map to a filed rating factor, showing how it rolls up into, supports or modifies one, with actuarial justification wherever the mapping is not one to one.
  • A SHAP plot is a graph, not a regulatory explanation, and submitting one without the accompanying narrative is the single most common source of deficiency notices on predictive model filings.
  • Colorado's four-fifths rule sets the bar at 80%: a selection rate for any of nine protected classes below 80% of the most favored class's rate is disparate impact.
  • No state has said whether approval attaches to the model architecture, the trained instance, or an output tolerance band, which leaves carriers on retraining schedules setting their own materiality thresholds.

Who Enforces What

The adoption count overstates uniformity, and the practical question for a multi-state filing is which jurisdictions actually return deficiency notices over AI documentation.

Enforcement Tier States Practical Impact on Rate Filings
Active enforcement with supplemental requirements Colorado (SB 21-169 + CAIA), New York (Circular Letter No. 7), Connecticut, Illinois Separate predictive model supplemental filings required; bias testing documentation mandatory; compliance reports due on specific deadlines (Colorado: July 1, 2026 for auto and health); filings returned with deficiency notices when AI documentation is inadequate
Bulletin adopted, examination integration underway California, Maryland, Pennsylvania, Virginia, Wisconsin, Iowa, Florida, Rhode Island, Vermont (evaluation tool pilot states) AI governance questions incorporated into market conduct exams; evaluation tool pilot running March through September 2026; regulators building competency through weekly coordination calls; documentation requests flowing to domestic insurers during exams
Bulletin adopted, enforcement deferred Alaska, Arkansas, Delaware, Hawaii, Kentucky, Massachusetts, Michigan, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, Oklahoma, Washington, West Virginia Bulletin language referenced in regulatory correspondence; no systematic AI-specific examination protocols yet; compliance preparedness varies by carrier size and sophistication

For a carrier writing personal lines nationally the cost-benefit math points one way. Colorado and New York together carry enough premium that their standards have to be met anyway, and documentation built to Colorado's SB 21-169, which mandates bias testing across nine protected classes against four-fifths rule thresholds with annual compliance reports, satisfies the documentation expectations of every other adopting state.

The 12-state evaluation tool pilot is where those expectations are being tested in practice, and the four-tier risk taxonomy presented alongside it puts almost every model that materially influences a filed rate in the high-risk tier, which carries the full compliance report, a model card, bias testing evidence and continuous drift monitoring. There is no abbreviated pathway for AI-augmented pricing.

Above the state layer, the compliance report template presented at the Spring meeting covers seven areas against ASOP No. 56's principles-based requirements to understand the model, document data sources, note peer review and disclose limitations. The gap is widest on bias testing and drift monitoring, neither of which the standard was written to address, because it was written for a world in which the actuary specified the model's structure.

What Replaces the Coefficient Table

The filing problem is not that machine learning models are opaque. It is that the artifact regulators historically read for actuarial justification does not exist in them.

In a GLM the justification is the structure. A ZIP code relativity of 1.35 says that territory produces 35% more losses than base, and the actuary verifies that against actual loss ratios. A gradient-boosted tree with 200 features has no coefficients in that sense, its variable interactions are learned rather than specified, and the effect of any one input depends on the values of all the others.

Feature-to-factor mapping is what substitutes for it, and it is where filings most often stall. Regulators require documentation showing how each model feature rolls "up into, support[s], or modif[ies]" filed factors, with actuarial justification and confirmation of compliance with state rating law wherever the mapping is not one to one.

For a territorial risk score built on 47 features, some map directly to filed factors such as vehicle age, driver age and coverage limits. The engineered ones do not: interaction terms, rolling averages and spatial features derived from geocoded addresses have no analog in the rate manual, and each needs its construction documented, its relationship to loss experience shown, and an explanation of why it is not a proxy for a protected characteristic.

Explainability output does not close that gap by itself. SHAP values decompose an individual prediction into additive feature contributions and partial dependence plots show how predictions move as one feature varies. Both are sound validation tools and neither is a regulatory explanation. A SHAP plot is a graph; what an examiner acts on is a narrative connecting it to filed rating factors, actuarial justification under state rating law, protected class analysis and disparate impact assessment. Filings that submit the summary plot without the narrative sit in deficiency notice cycles.

The proxy question is where the two halves meet. ZIP code interacted with vehicle age, credit score and commute distance can produce discriminatory rate patterns with no single variable showing a concerning correlation in isolation, so testing features individually is necessary and not sufficient. The aggregate output, the rates actually produced, has to be tested against protected class distributions estimated through methods such as Bayesian Improved Surname Geocoding. New York's Circular Letter No. 7 extended the same expectation to all authorized insurers in July 2024.

The Question the Filing Cannot Answer

The complication is that the regulatory frame assumes a model that stops changing, and the models being filed do not.

A GLM filing is a point-in-time document: built, validated, filed, left largely alone until the next revision. A model that retrains on a rolling data window is a different object. Its performance degrades as the underlying distribution shifts with new vehicle types, changed driving patterns, altered claims reporting behavior or emerging perils, and it produces different output from the same architecture on a schedule.

That raises a question nobody has answered. Does regulatory approval attach to the model architecture, to the specific trained instance, or to an output tolerance band? No state has issued definitive guidance. What carriers do in its absence is set their own materiality thresholds, a 2% shift in statewide average premium or a 5% change in any individual territory relativity being typical, and file a new indication when one is breached. That is a self-defined standard sitting underneath a filed rate, and it holds only until an examiner disagrees with the threshold.

Fairness has the same structure and a longer tail. A model that cleared disparate impact testing at filing has to keep clearing it as the book of business and the underlying data evolve, so the disparate impact metrics have to be recomputed on the production portfolio at least annually, or on every retrain, whichever comes first. A remediation that resolved a disparity at filing without materially degrading performance is not evidence that it is still resolved two retrains later.

The validation that would catch it early is out-of-time testing across at least three non-overlapping holdout periods, because gradient-boosted models and neural networks overfit to temporal patterns, a catastrophe season, pandemic-era driving, transient economic conditions, in ways a GLM's simpler structure generally does not. That test is available today. What is not available is the rule saying which version of the model it was performed on.

Further Reading

Sources