Regulators push AI governance

State insurance regulators are moving from cheering artificial intelligence to policing it, with the National Association of Insurance Commissioners making AI model governance a 2026 priority. (naic.org) The National Association of Insurance Commissioners, which represents regulators in the 50 states, Washington, D.C., and five territories, adopted its 2026 priorities on February 18, 2026. The list includes catastrophe modeling, climate disclosures, cyber threats and a plan to pilot an artificial intelligence evaluation tool. (naic.org) That is a step beyond the group’s December 4, 2023 model bulletin, which told insurers that decisions made or supported by artificial intelligence still have to follow insurance law. The bulletin said regulators may ask for documentation on governance, risk management and how insurers test systems for accuracy, bias and legal compliance. (naic.org) States have already started turning that guidance into local rules. A National Association of Insurance Commissioners tracking document dated March 3, 2026 shows 25 jurisdictions had adopted the model bulletin or similar guidance, while Colorado has a binding regulation that took effect in 2023 and was amended effective October 15, 2025. (naic.org) (doi.colorado.gov) In insurance, artificial intelligence can mean software that prices a driver, flags a claim for review or estimates how long a patient should stay in a nursing facility. Regulators are now focusing on the controls around those systems: who approved them, what data trained them, how they are tested and what consumers are told. (naic.org) (nist.gov) The legal pressure is rising at the same time. Bloomberg Law reported on April 8, 2025 that courts were allowing some lawsuits over algorithmic claim denials to move forward, including a March 31, 2025 ruling in a case against Cigna over its PxDx review tool. (news.bloomberglaw.com) A Minnesota federal judge added to that pressure on March 9, 2026 by ordering UnitedHealth Group to turn over broad records in a case over post-acute care denials tied to nH Predict. Optum, UnitedHealth’s health-services arm, told Becker’s that “medical necessity determinations are made by qualified physicians following CMS guidance — not AI” and said nH Predict is a care-support tool, not generative artificial intelligence. (beckerspayer.com) Federal standards are also giving state regulators a template. The National Institute of Standards and Technology released its Artificial Intelligence Risk Management Framework on January 26, 2023 as a voluntary guide for designing, using and evaluating artificial intelligence systems, and insurance regulators are adapting that kind of model to a sector where pricing and claim decisions can directly affect coverage and payouts. (nist.gov) The next fight is less about whether insurers will use artificial intelligence than about how much evidence they will have to show when a model helps decide who gets covered, paid or denied. (naic.org 1) (naic.org 2)