AI Adoption Is Outrunning Insurance Governance
AI is already embedded across insurance while governance is still being assembled. Seven questions insurers should answer before regulation catches up.
AI is already embedded across the insurance value chain.
The governance infrastructure around it is still being assembled.
I recently spoke with Gorkem Cetin, CEO of VerifyWise, an open-source AI governance platform. We discussed AI compliance in insurance and the different regulatory paths emerging in the United States and Canada.
The conversation led me back to a basic question: how quickly is insurance adopting AI compared with its ability to govern it?
The latest data provides a clear answer.
AI adoption is no longer experimental
Among insurers responding to the National Association of Insurance Commissioners’ surveys:
- 92% of health insurers reported using, planning to use, or exploring AI
- 88% of auto insurers
- 70% of homeowners insurers
- 58% of life insurers
These figures do not mean that every insurer has deployed AI into production. They combine current use, planned adoption, and active exploration. Even with that qualification, they show how widely AI has entered the industry’s operating agenda.
The use cases also extend well beyond chatbots.
Insurers reported applications across underwriting, pricing, claims, fraud detection, marketing, customer service, and back-office operations. Specific examples include risk scoring, inspection-image analysis, rating-class determination, rate-relativity analysis, automated policy verification, document summarization, telematics, retention modeling, loss-settlement support, and claims damage assessment.
AI is no longer adjacent to insurance decisions. It increasingly participates in the systems that produce them.
That changes the governance question.
It is no longer sufficient to ask whether an insurer has an AI policy. The relevant question is whether the insurer can identify, evaluate, trace, and defend every material AI-assisted decision made across its operations.
The United States is moving through insurance regulation
The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023.
The bulletin does not create a new federal AI regulator. It works through the existing state-based insurance regulatory system. It reminds insurers that decisions made or supported by AI remain subject to existing insurance laws, including requirements concerning unfair discrimination and consumer protection.
It also establishes expectations for a written AI systems program and describes the information a state insurance department may request during an investigation or examination.
As of April 1, 2026, 25 US jurisdictions had adopted the bulletin. Four others had introduced separate insurance-specific regulation or guidance.
The NAIC is also developing an AI Systems Evaluation Tool intended to help regulators examine how insurers use AI, govern it, mitigate its risks, and evaluate higher-risk models.
The direction is becoming clear. Existing insurance laws are being applied to new technical systems, and insurers will increasingly be expected to demonstrate how those systems are governed.
Colorado has gone further.
Senate Bill 24-205 established requirements for developers and deployers of high-risk AI systems involved in consequential decisions. The law addresses areas including risk management, impact assessments, consumer notification, and algorithmic discrimination. Its operative requirements were subsequently moved to June 30, 2026.
For insurers operating across multiple jurisdictions, the challenge will not be understanding one rule. It will be maintaining an AI governance system capable of satisfying overlapping regulatory expectations without recreating the entire process for every state.
Canada is following a different path
Canada’s framework is developing through a combination of federal financial regulation, provincial oversight, employment rules, privacy obligations, and sector-specific guidance.
The Office of the Superintendent of Financial Institutions published its revised Guideline E-23 on model risk management in September 2025. It takes effect on May 1, 2027 and applies to federally regulated financial institutions, including federally regulated life and property-and-casualty insurers.
E-23 is broader than generative AI. It covers enterprise-wide model risk, including traditional actuarial models and AI or machine-learning systems. It expects institutions to maintain a model inventory, assign risk ratings, establish accountable owners, validate models, monitor their performance, and govern the complete model lifecycle.
Quebec’s Autorité des marchés financiers has separately consulted on an AI guideline for financial institutions under its supervision.
Ontario’s rules are narrower. Beginning in January 2026, qualifying employers using AI to screen, assess, or select candidates for publicly advertised jobs must disclose that use in the posting. This is an employment requirement, not a general insurance-AI governance regime, but it shows how AI obligations can emerge from areas outside financial regulation.
At the federal legislative level, the proposed Artificial Intelligence and Data Act formed part of Bill C-27. The bill did not become law before the end of the 44th Parliament.
The absence of one consolidated Canadian AI statute does not mean insurers lack obligations. It means those obligations must be understood across several regulatory layers.
Waiting for a single comprehensive rule is therefore the wrong strategy.
Governance must be built around the actual systems and decisions already in use.
Seven questions every insurer should be able to answer
1. Do you have an AI system registry?
An insurer should be able to produce an accurate inventory of every AI system used across the enterprise.
That inventory should identify the system’s owner, purpose, vendor, underlying model, data sources, affected business processes, decisions influenced, risk classification, validation history, and current operational status.
This includes third-party systems.
A vendor relationship does not transfer accountability away from the insurer. If an external model influences pricing, underwriting, coverage, claims, fraud detection, or customer treatment, it belongs in the governance perimeter.
An AI policy without an inventory is a statement of intent without an operating system.
2. Do you have insurance-specific evaluation sets?
General model benchmarks do not establish that a system is safe or reliable for insurance.
An insurer needs evaluation datasets built around its actual products, documents, terminology, jurisdictions, and workflows. These may test pricing bias, submission extraction, coverage interpretation, claims triage, fraud scoring, policy verification, or regulatory-language retrieval.
The evaluation must reflect the consequences of the use case.
A summarization error in an internal meeting note is not equivalent to a factual error in a coverage determination. The acceptable failure rate, review requirement, and escalation path should differ accordingly.
3. Can you measure factual deviation?
Every material AI system should have a baseline.
What is the measured rate at which its output deviates from approved policy wording, product rules, filed rates, claims procedures, or regulatory language?
Without that number, an organization cannot distinguish improvement from deterioration. It cannot determine whether a new model version is safer, whether retrieval quality has declined, or whether a workflow change has introduced a new failure mode.
AI governance becomes meaningful when performance is measured against documented insurance truth.
4. Do you know where API data goes?
An insurer should know what information leaves its environment, which providers receive it, where it is processed, how long it is retained, whether it is used for model training, and when it is deleted.
Some model providers offer zero-data-retention arrangements at the API level. Others provide different controls depending on the product, agreement, or deployment architecture.
These conditions should not remain buried in product documentation. They should be reflected in procurement reviews, service-level agreements, master service agreements, privacy assessments, and technical controls.
The architecture and the contract must describe the same reality.
5. Is every AI-assisted transaction observable?
Material AI-assisted actions should be recorded as traceable events.
That means more than collecting errors. It means retaining the information required to reconstruct what happened: the model and version used, relevant inputs, retrieved sources, system instructions, tools called, outputs produced, human review performed, overrides applied, and final action taken.
Observability creates the evidence required for testing, investigation, customer remediation, regulatory review, and continuous improvement.
If an organization cannot reconstruct a decision, it cannot govern it.
6. How is personal information handled?
Insurance workflows routinely involve sensitive information.
Claims files may contain medical records. Underwriting submissions may contain financial data, addresses, dates of birth, photographs, or information about employees and customers. Conversations that begin as routine service requests can acquire sensitive context quickly.
Organizations should know whether personal information is removed before or after it reaches a model, whether redaction is deterministic or model-driven, who can access interaction logs, and how long those logs are retained.
They should also understand what happens when a workflow unexpectedly captures information outside its intended scope.
Privacy cannot be added after the conversation has already been recorded.
7. How is AI-assisted code governed?
Technology providers serving insurers face another layer of exposure.
They should know how much of their codebase is AI-assisted, where that code enters production, and how it is reviewed for correctness, security, licensing, dependency risk, and unintended behavior.
AI-generated code does not create an exemption from software accountability.
The more rapidly software can be produced, the more important it becomes to preserve review, testing, traceability, and supply-chain controls. Development speed without governance simply allows defects to move faster.
Governance is operational infrastructure
The regulatory frameworks in the United States and Canada differ in timing, scope, and enforcement structure.
The operational requirements are converging.
Know which systems exist. Assign accountable owners. Classify their risks. Test them against real insurance scenarios. Trace their actions. Protect the data moving through them. Validate third-party systems. Preserve evidence.
These are not merely compliance activities. They are the controls required to operate probabilistic systems inside a regulated industry.
The organizations that build them early will not only be better prepared for examinations. They will be able to deploy AI more confidently, identify failures earlier, and expand successful systems faster.
Governance is not what slows AI adoption.
Properly built, it is what allows AI adoption to continue.
Talk to us about building governed AI infrastructure for insurance.
Sources and further reading
- NAIC: Artificial Intelligence and insurer survey results
- NAIC: Implementation of the Model Bulletin on AI
- OSFI: Guideline E-23 — Model Risk Management
- Colorado General Assembly: SB 24-205
- Colorado General Assembly: SB 25B-004
- Quebec AMF: AI guideline consultation
- Ontario: AI disclosure in publicly advertised job postings
- Parliament of Canada: Bill C-27