Insurance Underwriting AI: A Governance Framework for Actuaries (2026)

The NAIC adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023, and 24 US states had adopted or proposed versions of it by Q1 2026. Combined with the existing model risk management baseline from Federal Reserve SR 11-7 (2011) and OCC 2011-12 (2011), plus jurisdiction-specific bulletins from Colorado DOI and New York DFS, actuaries now operate under the most prescriptive AI model risk regime in any US-regulated industry. This guide is the practical framework. Source: NAIC Model Bulletin on the Use of AI Systems by Insurers, adopted December 4, 2023. Updated 2026-05-20.

Insurance AI governance does not start with a clean slate. The supervisory framework for insurance models has 50 years of evolution behind it. AI-specific regulation has been layered on top of that existing framework rather than replacing it, which means actuaries must understand at least five overlapping regimes simultaneously. The stack below is what we recommend chief actuaries and model risk managers map their programmes against.

The cleanest way to organise an insurance AI governance programme in 2026 is to start from the SR 11-7 four-pillar model and layer in AI-specific requirements. Each pillar maps to a set of actuarial deliverables that hold up under DOI examination.

This mapping is what insurance examiners are now using. Programmes built without an explicit crosswalk to SR 11-7 tend to receive findings around effective challenge, validator independence, and documentation depth even when the underlying model risk practice is otherwise sound.

The single most common DOI finding in 2024-2025 AI examinations was inadequate model documentation. Actuaries who built models under traditional GLM or credibility-weighted frameworks have decades of documentation practice; the documentation expectation for AI models is comparable in rigor but different in content.

The minimum AI model documentation set we recommend, aligned with NAIC, NY DFS Circular Letter No. 1, and Colorado 3 CCR 702-10:

1. Purpose and scope. The specific business purpose, the decision the model informs, the regulatory frameworks the model is subject to, and the populations affected.
2. Data sources and lineage. All data inputs including External Consumer Data and Information Sources (ECDIS), with vendor agreements, retention periods, refresh cadence, and known limitations. Per Colorado 3 CCR 702-10, ECDIS sources require specific disclosure.
3. Methodology and algorithm. The model class (GLM, tree ensemble, neural network, ensemble), the feature engineering steps, the training procedure, and any human-in-the-loop adjustments.
4. Validation results. Out-of-time and out-of-sample performance, calibration analysis, residual analysis, and benchmarking against challenger models. Independent validation must be performed by a function reporting outside the model development team.
5. Fairness and disparate impact testing. Quantitative tests for disparate impact on protected classes (sex, race, national origin, age where applicable, plus state-specific protected classes), with thresholds and remediation plans for any findings. This is the deliverable that has caused the most examination findings.
6. Adverse action and consumer disclosure. The specific reasons that will be communicated to consumers receiving adverse decisions, including the principal reasons under ECOA and any AI-specific transparency obligations under state law.
7. Monitoring plan. Drift detection thresholds, recalibration triggers, escalation paths, and the cadence of revalidation. Monitoring is a separate deliverable, not an afterthought.
8. Governance log. Approvals, sign-offs, exception decisions, and the audit committee briefing record.

The Areebi audit log captures most of the operational evidence (item 7 and 8) as a byproduct of model use; the analytical deliverables (1-6) remain the actuarial team's primary work product.

Of all AI governance deliverables, fairness testing is the one where actuaries are most likely to fail an examination if they have not planned ahead. The traditional actuarial approach (model is fair because the rating variables are causally justified) does not meet the 2026 disparate impact standard, particularly under Colorado 3 CCR 702-10 and NY DFS Circular Letter No. 1.

The expected test programme. Quantitative fairness tests must be run before deployment and on a defined cadence thereafter (typically quarterly for high-impact models). The test set includes: statistical parity difference, equalised odds, disparate impact ratio, calibration by group, and group-conditional false positive and false negative rates. Each metric must be computed for each protected class and against documented thresholds.

The remediation expectation. When a model fails a fairness threshold, examiners expect: documented analysis of the cause, evaluation of remediation options (data adjustment, feature removal, post-processing, model retraining), a documented decision and rationale, and ongoing monitoring after remediation. The expectation is not zero disparate impact - it is documented effort to identify and address it.

The Colorado-specific overlay. Colorado 3 CCR 702-10 requires life insurers to provide the Division with the quantitative testing methodology and results for ECDIS and algorithms, including testing for unfair discrimination. Insurers operating in Colorado must have a Colorado-specific testing pack ready for examiner request. Per Colorado DOI 2024-2025 examination patterns, fairness testing has been the most common request and the most common finding.

AI models in insurance underwriting and pricing drift faster than traditional rating models because the inputs (consumer behaviour, third-party data sources, market conditions) change faster. The 2026 supervisory expectation is that insurers monitor drift continuously, detect material drift quickly, and recalibrate on a defined cadence.

What examiners look for in monitoring. A documented monitoring plan covering: input data drift (covariate shift on key features), output distribution drift, performance drift (accuracy, calibration, fairness metrics), and concept drift (the underlying relationship between inputs and outcomes). Thresholds must be defined per metric, with escalation paths and decision rights. The monitoring log must show actual triggered events and the responses.

What gets insurers in trouble. Monitoring plans that look comprehensive on paper but show no triggered events over months of operation. Either the model is genuinely stable, in which case the evidence must support that conclusion, or the monitoring is mis-calibrated and material drift is going undetected. Examiners now ask for the alert history and resolution log as a standard examination request.

Our AI agent monitoring guide covers the technical patterns; the Areebi audit log captures the operational evidence.

The majority of insurance AI exposure in 2026 comes through third-party models and External Consumer Data and Information Sources (ECDIS), not internally built models. The NAIC bulletin makes clear that insurers remain responsible for compliance regardless of whether the model or data source is internal or external, which means vendor oversight is now an actuarial concern, not just a procurement concern.

The minimum vendor oversight programme. Each AI vendor and ECDIS source must have: a documented use case scope, a contract that grants the insurer audit rights and includes deletion SLA, an independent validation report or equivalent technical attestation, a fairness testing protocol (either run by the vendor or by the insurer), and named risk owners on both sides. Tier 1 vendors (those providing models or data that drive underwriting or pricing decisions) require additional documentation including model lineage, training data provenance, and refresh cadence.

The Colorado ECDIS-specific expectation. Colorado 3 CCR 702-10 imposes a specific obligation: insurers using ECDIS in life underwriting must conduct quantitative testing, document the methodology and results, and make the documentation available to the Division. The vendor cannot perform this testing in lieu of the insurer; the insurer remains accountable. See the AI vendor list guide for the inventory side of this programme.

Three failure patterns recur across insurance AI examinations.

Pitfall 1: SR 11-7 was for banks, AI is different. Some insurance teams resist applying SR 11-7-style discipline to AI on the grounds that AI is a different paradigm. State DOIs that have adopted the NAIC bulletin almost universally expect SR 11-7-aligned model risk management. Avoid this by mapping the existing actuarial model risk framework to AI explicitly, retaining the same independence, effective challenge, and documentation standards.

Pitfall 2: Fairness testing as a one-off deployment gate. Insurers run a fairness test at deployment, document a passing result, and never re-test. State DOIs expect ongoing testing, particularly when models are retrained, data sources change, or the population in scope shifts. Avoid this by including fairness metrics in the quarterly monitoring pack, with the same thresholds and escalation paths as performance monitoring.

Pitfall 3: Treating AI explainability as a technical artefact rather than a consumer disclosure. The principal reasons for an adverse action must be communicated to the consumer in plain language. Explainability outputs (SHAP values, partial dependence plots) are technical artefacts that do not directly satisfy the consumer disclosure requirement. Avoid this by maintaining a parallel "consumer reason" mapping that translates technical explainability outputs into the language used in adverse action notices, and validating the mapping on examination.

At Areebi, we built the platform's audit and policy layers specifically to produce evidence that maps to all four SR 11-7 pillars plus the NAIC bulletin expectations as a single dataset, which is the integration step most insurance programmes miss.

To complete an insurance AI governance reading set.

• NIST AI RMF compliance hub - the canonical Areebi reference that NAIC and state DOI guidance increasingly aligns with.
• ISO/IEC 42001 certification guide - the management system standard that pairs with the NAIC AI Systems Programme expectation.
• AI agent monitoring and observability - the technical companion on drift, recalibration, and operational evidence.
• AI vendor list for CFOs - the third-party AI inventory that maps to the NAIC vendor oversight requirement.
• DORA and AI for financial institutions - the EU operational resilience overlay that increasingly intersects insurance AI governance.

• NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers - Adopted December 4, 2023. content.naic.org
• Federal Reserve SR 11-7 - Supervisory Guidance on Model Risk Management, April 4, 2011. federalreserve.gov/supervisionreg/srletters/sr1107
• OCC Bulletin 2011-12 - Sound Practices for Model Risk Management. occ.gov/bulletins/2011/2011-12
• Colorado Division of Insurance Regulation 3 CCR 702-10 - Governance and Risk Management Framework Requirements for Life Insurance Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models. doi.colorado.gov
• NY DFS Circular Letter No. 1 (2024) - Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing. dfs.ny.gov/industry_guidance/circular_letters/cl2024_01
• NIST AI Risk Management Framework (AI RMF 1.0) - NIST AI 100-1, January 26, 2023. nvlpubs.nist.gov