NAIC Proposes Third-Party AI Vendor Registry for Insurers: Supply-Chain Oversight Comes to Insurance AI

The NAIC's Third-Party Data and Models (H) Working Group advanced a draft framework at the Spring 2026 National Meeting in San Diego that would require AI model vendors to register with state insurance departments before carriers can deploy their products in consumer-facing functions.

That is a new regulatory surface rather than a refinement of the 2023 Model Bulletin, which reached insurer conduct only. It runs upstream, into the vendors supplying underwriting, pricing, claims automation and fraud detection to many carriers at once.

Key Takeaways

Six covered functions sit in scope where a third-party model has direct consumer impact: pricing, underwriting, claims, utilization review, marketing and fraud detection. That is close to every production use of vendor AI at a carrier.
Registration, not licensure. Vendors submit entity information and model documentation and file an annual governance attestation. There are no capital requirements, examinations or revocation proceedings in the draft.
A 60-day comment period ran from the December 9, 2025 exposure through February 6, 2026, drawing dozens of letters. The Working Group reviewed them on February 26, 2026 and kept the registration requirement in the draft.
Direct regulator access is the structural change: for the first time regulators would see vendor documentation without the insurer as intermediary.
50 or more separate registrations would face a national vendor absent reciprocity, which several commenters argue would concentrate the vendor market rather than open it.

What the Framework Requires

The draft rests on three components, and the distinction between the first two and existing tools is what makes it new.

Vendors whose products are used in insurer functions with direct consumer impact must register with state departments before carriers deploy them, submitting entity information and model documentation. As Carlton Fields noted, the Working Group sees registration as the way to identify, track and set minimum governance expectations for third-party providers. Registration is a transparency mechanism; licensure, with its examinations and revocation proceedings, is not on the table.

Registered vendors must then maintain a documented governance program and attest annually that they adhere to it. The framework sets minimum expectations for documentation, model testing and data governance without prescribing the program's structure. Third-party filings get the same confidentiality treatment as insurer proprietary information and trade secrets, a provision added after early vendor concern about intellectual property.

Three NAIC initiatives now run in parallel, and they differ mainly in who they reach:

Dimension	Model Bulletin (Dec 2023)	AI Evaluation Tool Pilot (Mar-Sep 2026)	Vendor Registry Framework (Proposed)
Primary target	Insurers	Insurers	Third-party vendors
Regulatory mechanism	Guidance bulletin adopted by states	Examination tool used within existing exam authority	Registration-based framework with governance requirements
Adoption status	~24 states plus D.C. have adopted	12-state pilot running through September 2026	Exposure draft; comments reviewed; refinement ongoing
Third-party visibility	Indirect (through insurer vendor management)	Indirect (Exhibit D asks about data sources)	Direct (vendors register and attest to governance)
Enforcement basis	State regulatory authority over insurers	Existing financial and market conduct exam authority	New registration requirement (authority still debated)

The Second Source Changes What Validation Has to Be

The mechanism worth understanding is not registration itself but the channel it opens, because it gives a regulator two accounts of the same model.

Under the Model Bulletin and the AI Evaluation Tool pilot, the insurer is the intermediary. A regulator asking about a third-party model receives whatever the carrier obtained during procurement. Where a vendor treats architecture, training data composition or validation methodology as proprietary, that documentation can amount to model summaries rather than the technical detail a validation team would need.

The registry gives the regulator a direct account from the vendor. What the vendor tells the department and what it told the carrier become comparable documents, and any gap between them surfaces during an examination of the carrier. A validation function resting on vendor-supplied documentation as a proxy for its own testing is exposed by that comparison, not by any new validation standard.

The consequence reaches rate filings specifically. Where a filing relies on a vendor-supplied loss cost model or classification system, registry information about that vendor's governance program is available to the reviewer, so questions about testing methodology, data composition and validation results become part of routine review rather than something raised only when a filing is contested.

Banking supervision reached this point first and stopped short of the structural step. The Federal Reserve's SR 11-7, issued in April 2011, requires banks to validate vendor models with the same rigour as internal ones, acknowledging that modelling expertise may sit outside the bank and some components may be proprietary. It expects outcomes testing, sensitivity analysis and benchmarking, and it scales validation intensity to model materiality.

The NAIC draft carries none of those: no quantitative validation requirements, no model tiering, and no ongoing monitoring between annual attestations. What it adds instead is the centralized registry, which banking regulation never built, because insurance regulators oversee thousands of carriers across 56 jurisdictions and many state departments could not construct that map alone.

The Registry May Concentrate What It Is Mapping

The strongest objection is not that the registry asks too much of vendors, but that the burden falls unevenly in a direction that works against the framework's own rationale.

The rationale is concentration risk. When one vendor's catastrophe model sits inside dozens of carriers' reinsurance decisions, or one underwriting algorithm drives selection at several companies writing the same lines, the vendor becomes a source of correlated exposure no single-carrier examination detects. The registry is the first attempt to see that.

Yet without reciprocity or portable registration, a national vendor faces 50 or more separate processes with potentially different filing requirements, timelines and governance standards. Large providers with existing compliance infrastructure absorb that as administrative overhead, and registration may function as a credential smaller competitors cannot match. An early-stage company would have to build governance documentation, register across multiple states and maintain annual attestation before a single carrier could put its model into production. Commenters flagged the result directly: a barrier to entry that protects incumbents in a market whose concentration is the stated concern.

The legal foundation is also untested. Insurance regulatory authority derives from state codes written around insurers and their contractual counterparts, and whether it extends to technology vendors supplying analytical tools rather than insurance products is an open question no state has litigated. Framing registration as transparency rather than regulation narrows the exposure without resolving it, and the question is likely to be answered only when a vendor declines to register. Scope compounds that: with "data," "model" and "direct consumer impact" defined broadly in the current draft, a vendor supplying one data feed into a carrier's own pricing model sits alongside one supplying a packaged underwriting decision engine.

NAIC Proposes Third-Party AI Vendor Registry for Insurers: Supply-Chain Oversight Comes to Insurance AI

Key Takeaways

What the Framework Requires

The Second Source Changes What Validation Has to Be

The Registry May Concentrate What It Is Mapping

Further Reading

Sources