The National Association of Insurance Commissioners (NAIC) sharpened its focus on artificial intelligence (AI), third-party data and models, cybersecurity, and insurance privacy at its Summer National Meeting, held August 11–14, 2026, in Columbus, Ohio.
Across those initiatives, three themes emerged. Regulators are increasingly supplementing principles-based guidance with supervisory tools and examination-readiness efforts, focusing on whether governance controls work in practice, and reinforcing that insurers remain responsible for the technologies, data, and third parties they use.
AI Oversight Moves Toward Examination Readiness
The Big Data and Artificial Intelligence (H) Working Group continued developing the AI Risk Evaluation Supplement, which 12 state insurance departments are piloting to help regulators assess insurer AI governance practices and AI-related risks.
Participating states have used the supplement in different ways, including as part of market conduct or financial examinations and as a standalone questionnaire. The NAIC plans to revise the supplement based on feedback from regulators, participating insurers, and other stakeholders, with the goal of considering it for adoption at the Fall National Meeting.
The pilot shows how regulators are beginning to operationalize existing AI governance expectations through supervisory tools and examinations. Insurers should be prepared not only to describe their AI governance programs, but also to produce evidence showing which AI systems they use, what decisions those systems affect, how the systems were tested, who is accountable for them, and how controls operate in practice.
A presentation during the Summer Meeting emphasized that AI does not necessarily create a separate category of enterprise risk. Instead, AI-related exposures generally flow through familiar enterprise risk management categories, including underwriting, operational, legal, regulatory, cybersecurity, and consumer protection risk.
The central question is whether an insurer’s risk management practices are commensurate with the risk profile created by a particular AI use case.
The presentation identified five considerations for evaluating the risk of an AI use case:
- The importance of the decision being influenced.
- The degree of autonomy given to the system.
- Whether the insurer can reconstruct and explain the system’s outputs or actions.
- How quickly the system’s behavior can change through drift or vendor updates.
- The insurer’s dependence on third parties, including its ability to test, challenge, and override the system.
One of the discussion’s most important insights was that AI risk is often driven by the way a model is implemented and governed within an organization. As a result, organizations should also assess the specific use case and deployment environment before putting the model into operation.
For insurers, this places greater emphasis on operational governance. In evaluating AI programs, regulators may focus on data and model inventories, monitoring practices, human oversight, and how insurers identify, document, and address issues that arise.
Third-Party Data and Model Framework Continues to Evolve
The Third-Party Data and Models (H) Working Group continued refining a regulatory framework for vendors whose data and models are used in property and casualty pricing and underwriting.
The initiative initially contemplated a broader range of insurance functions, including claims handling, marketing, fraud detection, and utilization review. At the Spring National Meeting, however, regulators narrowed the first phase to property and casualty pricing and underwriting, where third-party models are prevalent and states already have experience reviewing vendor-supported filings. Other functions may be addressed in later phases.
The current proposal has three principal components:
- A shared multistate vendor registry hosted by the NAIC.
- Filing requirements for third-party data and models used in pricing and underwriting.
- Annual attestations and notifications of material changes.
At the Summer National Meeting, stakeholders raised concerns about whether the registry is truly voluntary, confidentiality protections for proprietary information, vendor attestation requirements, duplication of existing filing processes, and the scope of covered vendors, data, and models.
The Working Group plans to consider revisions through a smaller drafting group, with the goal of potentially presenting the framework for consideration at the Fall National Meeting.
For insurers, the central point is unchanged: vendor oversight does not transfer accountability to vendors or regulators. Insurers remain responsible for determining whether third-party data and models are appropriate for their use cases, validating and monitoring them, and addressing unfair-discrimination and other compliance risks.
If adopted, the framework is likely to raise expectations for vendor diligence, contractual transparency, model documentation, validation, and regulator access to information.
Cybersecurity Reporting Portal Gets Additional Security Review
The Innovation, Cybersecurity, and Technology (H) Committee also discussed the proposed Cybersecurity Event Notification Portal, which is intended to reduce fragmentation in cyber-event reporting under the Insurance Data Security Model Law (Model #668).
The proposed portal would use a standardized notification form, allow licensees to select the relevant state regulators, permit updates as an investigation progresses, and provide logging and downloadable records.
If implemented, the portal could simplify cybersecurity event reporting in states that have adopted versions of Model #668 by allowing licensees to submit information through a common process rather than navigate multiple state-specific reporting mechanisms.
The portal is not yet operational and has not received final approval. It must undergo an additional security review before advancing to consideration by the NAIC Executive Committee. Following the NAIC's recent cybersecurity incident, regulators requested additional review of the safeguards that would protect information housed in the portal.
Insurance Privacy Modernization Remains Under Review
The Privacy Protections (H) Working Group continues modernizing the Privacy of Consumer Financial and Health Information Regulation (Model #672). The Working Group released a comprehensive draft revision on July 24 for a public comment period ending September 22, 2026.
Comments received through the Summer Meeting focused on consumer rights, consent frameworks, service provider arrangements, antifraud exceptions, Gramm-Leach-Bliley Act (GLBA) alignment, and the operational burden of implementing revised privacy requirements.
After the comment period closes, the Working Group plans to compile and evaluate stakeholder feedback and determine its next steps. Working Group leadership indicated that completing the modernization effort remains a priority, although the timing of future revisions and potential adoption will depend on the comments received.
Insurers should monitor whether the final model would require changes not only to privacy notices, but also to consumer-rights processes, consent practices, service provider arrangements, data governance, and related operational controls.
Key Takeaways for Insurers
- AI governance is becoming examination-ready. Regulators increasingly expect evidence that governance controls operate effectively in practice.
- Deployment matters as much as the model. Regulators are looking closely at how AI systems are deployed, governed, and monitored.
- Insurer accountability remains unchanged. Oversight of model and data vendors does not reduce insurer responsibility for governance, compliance, or consumer outcomes.
- Technology governance is converging. AI, privacy, cybersecurity, and third-party oversight are increasingly interconnected and should not be managed in isolation.
Taken together, the Summer Meeting developments suggest that regulators are increasingly asking whether insurers can understand, govern, monitor, and control their technology environments. That inquiry extends beyond AI to third-party data and models, cybersecurity reporting systems, and privacy compliance programs.
Ransomware Fusion Center
Stay ahead of evolving ransomware threats with Alston & Bird's Ransomware Fusion Center. Our Privacy, Cyber & Data Strategy Team offers comprehensive resources and expert guidance to help your organization prepare for and respond to ransomware incidents. Visit Alston & Bird's Ransomware Fusion Center to learn more and access our tools.
If you have any questions, or would like additional information, please contact one of the attorneys on our Privacy, Cyber & Data Strategy team.
You can subscribe to future advisories and other Alston & Bird publications by completing our publications subscription form.