NAIC AI Risk Evaluation Supplement v7.0: GLMs Stay in Scope

The NAIC's Big Data and Artificial Intelligence (H) Working Group votes on Monday 16 November on adopting version 7.0 of its AI Risk Evaluation Supplement at the Fall National Meeting in Dallas. Version 7.0 keeps generalized linear models in the document and widens the regulator's option to leave them out.

The vote is item 4 on the agenda, with the text as Attachment C. Before it, Coral Manning of the Wisconsin office reports on the pilot process. Interested parties then summarize their written comments. Commissioner Nathan Houdek of Wisconsin chairs the session, which runs from noon to 1 p.m.

Version 7.0 completes the schedule in the group's 31 August minutes: 30 days of comment on version 5.0, verbal comments on 8 October, a version 6.0 with a 14-day comment period, then adoption at the Fall meeting. The site reported the version 5.0 inventory request in September and the six trade-group letters against GLMs in October. Version 6.0 drew 21 submissions in a 160-page compilation, down from 33.

Key Takeaways

Version 7.0 lets regulators exclude "some or all GLMs" and other fixed models from the whole supplement, where version 6.0 limited the carve-out to Exhibits B through D.
GLMs keep their own checkbox in Exhibit A, column 7, across 13 program areas, after the InsurTech Coalition and NAMIC asked for an exclusion covering Exhibit A.
Industry letters produced three deletions: the proxy-testing question 10a, the agentic question 3a, and Exhibit D's reach beyond high-risk models, credited to APCIA, BCBSA and NAMIC.
Coral Manning reports on the pilot before the vote; it ran in 12 states from March to September 2026 with domestic insurers across P&C, life and health.

What changed between version 6.0 and 7.0

The GLM sentence moved. Version 6.0 said regulators "may choose to exclude some or all GLMs for Exhibit B through D related inquiries if appropriate," as NAMIC's letter quotes it. Version 7.0 reads: "Based on existing regulatory oversight provided via rate making, regulators may exclude some or all GLMs and other predictive models such as rule-based systems, deterministic algorithms, and fixed mathematical formulas from the Supplement if appropriate." A staff note in the tracked version credits ACLI, APCIA, AHIP and NAMIC.

ACLI had proposed the list of model types on 30 October. Its draft used "should exclude" and covered models "which receive other regulatory oversight such as from rate filings." The adopted text kept the list and the rate-making reason. The verb stayed at "may." Verisk's phrase, that the supplement asks about models "when utilized within an AI System," went in word for word.

Three other requests produced deletions. Exhibit C question 10a asked whether a company tests inputs, derived variables and outputs "for potential proxy relationships." It is gone, and the staff note names APCIA, BCBSA and NAMIC. NAMIC had written that proxy relationships are "not a standard in insurance law" and had never been piloted. Exhibit D now covers only data used in high-risk models. APCIA had said the draft exhibit "could require extensive information across dozens of data categories." Question 3a, on agentic AI acting without human approval, came out at BCBSA's request.

Exhibit A's inventory instruction reversed. Version 6.0 told a company with an AI inventory to provide it with a completed Exhibit A. ACLI called that inconsistent with the regulator instructions. Version 7.0 says the company "should discuss with the regulator whether that documentation satisfies the regulator's requests."

Two requests did not land. NAMIC asked for the new "Use case" column in Exhibit A to be removed as unpiloted. It stays as column 4. NAMIC and BCBSA asked for the words "in a manner that violates those standards" back in the definition of Adverse Consumer Impact. Version 7.0 keeps the shorter wording, an output "that adversely impacts the consumer."

How the GLM carve-out works

The exclusion belongs to the regulator. The InsurTech Coalition's 22 October letter, signed by Jennifer Crutchfield, asked for "an exclusion throughout the Supplement, including Exhibit A," for GLMs behind filed rates, rating factors, risk classifications and tier placement. It drafted the paragraph. Kaenan Hertz of Insurtech Advisors asked that GLMs in filed rating plans be "presumed out of scope for Exhibits B through D absent specific cause." Version 7.0 took neither route.

Exhibit A still has the GLM checkbox. Column 7 asks, for each of 13 operation and program areas, whether any AI system uses a GLM. Generative AI, agentic AI and other AI/ML models have the columns beside it. Version 6.0 had already replaced version 5.0's separate GLM counts with this check-all-that-apply format, a change BCBSA welcomed. The definitions keep ratemaking and premium determinations inside Direct Consumer Impact. A rating GLM inside an AI system is therefore flagged twice on one page before any exclusion applies.

The reason for excluding is in the sentence itself: "existing regulatory oversight provided via rate making." A rating plan has a filing. A claims severity GLM that sets case reserves, a fraud score or a reserving model has none. That is the distinction Houdek drew in July, when he told an actuarial panel that GLMs are also used in operations the current framework had not fully addressed, as the site reported in October.

AHIP argued that model type adds little because risk "depends on how a system is used rather than on the technique behind it." The adopted paragraph ends near that position. It calls model type "one aspect in deciding whether further inquiry is necessary."

What an examiner can ask a pricing team for

The regulator instructions say Exhibit A will be used most often. Exhibits B through D follow only where the responses warrant it. For a company with an inventory, regulators "will look for columns" giving each system or model's name, its use, its operation area and its inherent risk level under the company's own risk assessment. Column 3 asks how many systems went live in the past X months, with X set by the regulator. Hertz suggested 24.

Exhibit	What it asks for	When regulators use it
A: Quantify use of AI systems	Counts across 13 program areas, systems added in the past X months, a use case noting direct consumer or material financial impact, and checkboxes for generative AI, agentic AI, GLMs and other AI/ML; or the company's own inventory	First and "most often"; decides whether B through D follow
B: AIS program	Narrative (8 questions) or checklist (items 1 to 3r), never both: governance and board reporting, materiality threshold, ORSA and ERM integration, vendor and third-party oversight, explainability	After Exhibit A, to inquire about governance
C: High-risk AI models	14 items per model: type, implementation date, vendor, whether the company can modify it, limits, testing before and after deployment, last validation date with results, financial statement effect, regulatory actions	For a subset of uses "where regulators wish to probe further"
D: Data used in high-risk AI models	25 data element types, each marked internal or third-party with the vendor's name, and how the model uses it; data dictionary on request	Same subset as C

Source: NAIC, AI Risk Evaluation Supplement v7.0 (clean), posted 9 November 2026.

Exhibit D then lists 25 data element types. For each one used in training or testing, the company says whether it came from inside or from a named vendor. The list runs from loss experience, telematics and weather to criminal convictions excluding auto-related ones, education level including school aptitude scores, income, and geo-demographics by ZIP or county. Exhibit C item 11 asks for the last validation date "including the results and corrective actions," and item 14 for any regulatory action taken over the model.

Third-party actuarial work is named. Exhibit B's narrative asks for the policy on material AI systems run by third-party providers "including actuarial, claim, MGA, audit, and/or other professional services." Checklist item 3n asks how the company governs, monitors and tests vendor-developed systems. Materiality follows the Financial Condition Examiners Handbook: "the dollar amount above which the examiner's perspective of an insurer's financial position will be influenced." A regulator may accept the company's own threshold if the company explains why it chose it.

Monday's agenda

The exhibits are described as optional. The intent section says the supplement "does not independently create substantive legal duties, standards of conduct, admissions, or expanded regulatory authority." Hertz called that "the most important sentence in version 6.0" and asked for it to be carried forward unchanged. It was.

The agenda went up on 5 November and the 24-page clean text on 9 November. The agenda covers the working group's vote and sets no later step. The intent section says the Innovation, Cybersecurity and Technology (H) Committee charged the group to build the resource. BCBSA asked that the finished supplement go to the D and E committees for implementation through the handbooks, and that companies get at least 30 business days to respond; some pilot states gave under two weeks.

The pilot ran in 12 states from March to September 2026 with domestic insurers in P&C, life and health, according to the Pilot Project Summary. Manning reports on it under item 2 on Monday, before Houdek calls the vote.

NAIC Puts AI Supplement v7.0 to a Vote With GLMs Still in Scope

Key Takeaways

What changed between version 6.0 and 7.0

How the GLM carve-out works

What an examiner can ask a pricing team for

Monday's agenda

Further Reading

Sources

NAIC Puts AI Supplement v7.0 to a Vote With GLMs Still in Scope

Key Takeaways

What changed between version 6.0 and 7.0

How the GLM carve-out works

What an examiner can ask a pricing team for

Monday's agenda

Further Reading

Related guides

Sources