Insurers do not get a federal AI statute that turns on one morning. They get a bulletin the National Association of Insurance Commissioners adopted on December 4, 2023, and a map of who has done something with it. The map checked for this briefing is labeled “status as of October 8, 2026.” The NAIC says the map records state action or pending action and does not decide whether a state’s text contains every element of the model, or whether a state meets any accreditation test. That caveat belongs in the footnote of any compliance slide.
The reference list under the map names 29 jurisdictions as adopters. Twenty-seven are states: Alaska, Arkansas, Connecticut, Delaware, Hawaii, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Mississippi, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, North Dakota, Oklahoma, Pennsylvania, Rhode Island, South Carolina, Vermont, Virginia, Washington, West Virginia, and Wisconsin. The District of Columbia and Puerto Rico are on the same list. Four states are filed under “insurance specific regulation/guidance” rather than as adopters of the model bulletin: California (Bulletin 2022-5, June 30, 2022), Colorado (3 CCR 702-10, effective November 13, 2023, with amendments effective October 15, 2025), New York (Insurance Circular Letter No. 7, July 11, 2024), and Texas (Bulletin B-0036-20, September 30, 2020).
The list is still moving in 2026
Several entries are recent. Mississippi’s Bulletin 2026-9 is dated July 22, 2026. Puerto Rico’s notice is dated June 11, 2026. South Carolina’s Bulletin 2026-07 is dated September 24, 2026. North Dakota’s Bulletin 2026-2 is dated October 5, 2026, three days before the map’s status date. A carrier that froze its state grid in January is already behind the document. Hawaii’s memorandum is December 10, 2025. The project is not a 2024 relic with a quiet tail. It is a live adoption process.
The model bulletin itself, in the text the NAIC adopted in December 2023, tells insurers to govern AI systems under existing insurance law: fairness, accountability, compliance, transparency, and a safe and robust system. It is guidance about how current duties apply, which is why a state can “adopt” it with a bulletin rather than a new code. That legal form is also why four large markets can point at their own circulars and regulations and stay off the adopter list. A national writer’s program has to open both files.
What “one AI policy” gets wrong
A single enterprise policy is still worth having. It will not be sufficient as the examination artifact in every state. Colorado’s regulation is a regulation, amended as recently as October 2025. New York’s circular letter is the Department of Financial Services’ instrument. California and Texas are on the map with documents that predate the model bulletin. An examiner in an adopter state will look for the governance program the bulletin describes. An examiner in New York will look for what Circular Letter No. 7 describes. Treating those as one checklist because the word “AI” appears in all of them is how a multi-state insurer fails a market-conduct exam in the state it did not read.
The UK survey of financial firms, including insurers, is a useful contrast rather than a substitute. The Bank of England and FCA found that 93 percent of responding insurers use AI, and that third-party systems and weak post-deployment monitoring are sector-wide issues. A U.S. insurer can have a beautiful state-adoption matrix and still fail the operational test those supervisors describe: knowing what a vendor changed last week. The map gets the company into the right legal folder. Monitoring gets the company through the year inside it. Both are 2026 work, and neither is finished by citing the December 2023 model as if the map had stopped.