TL;DR — Five things your compliance team is already worried about
- GLBA Safeguards Rule (16 CFR Part 314): As of May 13, 2024, you must report data breaches affecting 500+ consumers to the FTC within 30 days. The 2023 amendments also added explicit vendor oversight requirements — your AI vendors count. If you're sending claims data or policyholder information through a third-party AI tool without a written agreement and documented due diligence, you're not in compliance.
- NAIC Model Bulletin on AI (December 2023): Adopted by 24+ states as of 2026. It puts the compliance burden on the carrier, not the vendor. You cannot outsource your way out of an NAIC 668 inquiry. Every AI-assisted decision in underwriting, pricing, and claims must be documentable and explainable — and that's your obligation regardless of where the AI came from.
- NY DFS Circular Letter No. 7 (July 2024): The largest state insurance regulator framed AI vendor risk specifically. The "bring your own AI" question isn't hypothetical — DFS is already asking carriers to demonstrate that their data doesn't go somewhere they haven't accounted for. Public LLM exposure is a documented examination concern.
- State DOI examination trends: Market conduct examiners are asking about AI use in underwriting and claims handling. Third-party data sharing — including AI vendor data flows — is a red flag. Carriers that can't produce an AI inventory on request are operating with an unacknowledged compliance gap.
- "Reasonable efforts" in practice: Reasonable doesn't mean perfect. But it means documented. It means you know which AI tools touch which data. It means you have written agreements. It means your board can receive a summary of AI governance annually. The carriers that will have bad days are the ones where AI tool usage is 60–70% outside IT visibility — and they don't even know it yet.
The GLBA Safeguards Rule Applied to AI
The Gramm-Leach-Bliley Act's Safeguards Rule (16 CFR Part 314) has been around since 2003, but the 2023 amendments made it materially more demanding. As of June 9, 2023, covered financial institutions — including insurance carriers — must comply with a set of prescriptive requirements that previously were left to interpretation.
What's changed:
The 2023 update added specific technical requirements: encryption of customer data at rest and in transit, multi-factor authentication for all systems accessing nonpublic personal information (NPI), annual penetration testing, a designated "Qualified Individual" overseeing the information security program, and written incident response plans with FTC breach notification obligations.
The breach notification amendment — effective May 13, 2024 — is the one that tends to focus executive attention. If a notification event (unauthorized acquisition of unencrypted customer information) affects 500 or more consumers, you have to report it to the FTC within 30 days of discovery. Discovery means the first day any employee, officer, or agent knew about it. That clock doesn't start when your IT team confirms the scope.
AI and the WISP
Your Written Information Security Program (WISP) needs to account for AI systems in your vendor and data flow documentation. For each AI system, you should document:
- What policyholder NPI enters the tool
- What the tool does with it, including any inferences generated
- Where the data goes after processing — vendors, subprocessors, cloud providers
- How long data is retained and under what authority
- Which state privacy laws may apply
The GLBA Safeguards Rule does not permit you to transfer your compliance obligations to a third-party AI vendor. The rule requires your institution to conduct due diligence, maintain written agreements requiring vendors to maintain appropriate safeguards, and continuously monitor vendor compliance. If your AI vendor's contract doesn't explicitly address these points, your due diligence documentation is incomplete.
NAIC Model Bulletin on the Use of AI by Insurers (December 2023)
The National Association of Insurance Commissioners adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023. It is not a model law — states adopt it as regulatory guidance, which means it carries examination weight without requiring a legislative cycle.
As of early 2026, 24 states and Washington, D.C. have adopted the bulletin in full or with minimal customization. States include Alaska, Connecticut, Delaware, Hawaii, Illinois, Kentucky, Maryland, Massachusetts, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, Oklahoma, Pennsylvania, Rhode Island, Vermont, Washington, and Wisconsin. Three major states — Colorado, New York, and California — have taken their own more aggressive approaches.
The bulletin applies to all insurers licensed in adopting states. It does not distinguish between small and large carriers — the obligations scale, but the accountability doesn't disappear.
The AIS Program requirement
The core compliance deliverable is a written AI System Program (AIS Program). It must cover:
- Governance: A governance framework for the oversight of AI systems — including board-level or senior management reporting on whether AI use is operating within the insurer's risk appetite and limits
- Risk management: Processes to identify, assess, and mitigate risks of adverse consumer outcomes from AI systems, including unfair discrimination
- Internal controls: Written policies and procedures covering the AI system lifecycle — development, acquisition, deployment, monitoring, and retirement
- Third-party vendor oversight: Due diligence on AI vendors and third-party data providers; audit rights; contractual requirements for AI system validation and testing documentation
- Bias testing: Methods to detect and address errors, performance issues, outliers, or unfair discrimination in AI-assisted decisions
What the examination section actually says
Section 4 of the bulletin makes clear that state insurance departments may request documentation of your AIS Program during investigations or market conduct examinations. They will ask for: your written governance framework; the results of your bias testing and model validation; your third-party AI vendor contracts and the due diligence that preceded them; your model drift monitoring records; and documentation of how AI-assisted decisions are reviewed and documented.
If you can't produce that package in 30 days, you have a problem. The carriers that have bad examination conversations are the ones where AI tool usage is informal, undocumented, and outside any formal governance framework.
NY DFS Part 500 + Circular Letter No. 7 (2024)
For carriers writing business in New York, the regulatory picture is more specific and more demanding.
Part 500 (23 NYCRR 500) has been in effect since 2017, but the November 2023 amendment added encryption requirements, expanded the 72-hour cybersecurity event notification window, and added governance requirements for AI vendor risk. A DFS industry letter in October 2024 specifically flagged AI as a cybersecurity risk area requiring covered entities to assess the security practices of AI vendors and implement controls commensurate with the risk.
Circular Letter No. 7, issued July 11, 2024, is the sharper instrument. It applies to every insurer authorized in New York that uses AI systems (AIS) or external consumer data and information sources (ECDIS) in underwriting or pricing. The key requirements:
Proxy assessments: Carriers must evaluate whether ECDIS or data fields used in underwriting or pricing correlate as proxies for protected class status that could result in unfair or unlawful discrimination. This is not optional — it is grounded in existing New York Insurance Law and applicable immediately.
Comprehensive assessments before deployment: Carriers must conduct testing — before deploying any AIS or ECDIS for underwriting or pricing — to determine whether it actually produces disparate or discriminatory treatment. If it does, you either remove the treatment or support it with a business justification and ongoing monitoring.
Consumer disclosure: Failure to adequately disclose material elements of an AIS or ECDIS to a consumer may constitute an unfair trade practice under the New York Insurance Law.
DFS explicitly states that carriers are responsible for outcomes of AI use regardless of vendor origin. Due diligence is not optional. The carrier's compliance obligation doesn't shrink because the AI came from a third party.
State DOI Examination Trends
State insurance regulators are not waiting for federal AI legislation to examine AI use. The NAIC's Big Data and Artificial Intelligence Working Group has conducted surveys across auto, homeowners, life, and health insurance lines. The findings: 88% of auto insurers, 70% of homeowners insurers, and 58% of life insurers report current or planned AI usage. The examination infrastructure is catching up to the deployment speed.
What carriers are being asked in market conduct exams
- What AI systems are currently in use, and what data do they access?
- What is the governance framework for AI-assisted decisions in underwriting and claims?
- Are there written policies governing employee use of AI tools — including consumer-grade tools like personal ChatGPT accounts?
- How are third-party AI vendors vetted, and what contractual controls exist?
- How is bias tested, and what are the results?
- What documentation exists for AI-assisted decisions affecting coverage, pricing, or claims outcomes?
The carriers that will be in the most difficulty are not the ones that deployed AI aggressively. They're the ones that deployed AI aggressively and never told anyone about it — no inventory, no governance, no documentation.
Where ChatGPT Enterprise and Microsoft Copilot Fall Short
I want to be honest with you here, because this is the part that costs money to solve and I understand if you want to push back on it.
ChatGPT Enterprise and Microsoft 365 Copilot are legitimate tools. OpenAI's enterprise tier includes a Business Associate Agreement (BAA) for healthcare-adjacent use cases and a committed "no training" policy — your conversations and data are not used to improve the model. Microsoft has developed Copilot for Finance and Copilot for Insurance in its commercial tier. These are real products from real vendors with real legal frameworks.
Here is the honest problem:
The problem is not necessarily OpenAI or Microsoft. The problem is the shared-infrastructure question. Both platforms operate multi-tenant environments where your data — even under an enterprise contract — shares infrastructure components with other customers. This is standard cloud architecture; it is not unique to AI. But regulators are starting to ask specific questions about it, and the honest answer from the vendors is: yes, your data is processed in shared compute environments.
The pattern evidence is real:
Samsung Engineers Leaked Proprietary Code to ChatGPT in 20 Days
Three Samsung semiconductor engineers accidentally leaked proprietary source code, equipment defect detection algorithms, and internal meeting transcripts to ChatGPT within 20 days of the company lifting an internal ban. The employees were trying to work faster — they weren't malicious. The data went into a system where it was retained and used to train future model outputs. Samsung issued a company-wide ban. This was not an isolated case.
OpenAI Redis Bug Exposed Chat History and Payment Data
A bug in the Redis caching library underpinning ChatGPT caused data from approximately 1.2% of ChatGPT Plus subscribers to be exposed to unrelated users — including chat history titles and partial payment card information. OpenAI took ChatGPT offline for 24 hours to patch it. The vulnerability was in a third-party open-source library, not in OpenAI's code directly. Your data's security is only as strong as the weakest component in the system.
ChatGPT macOS App Stored All Conversations in Plaintext
The ChatGPT macOS application stored all conversation history in unencrypted plaintext on disk — readable by any application with file system access on the same computer. Any user who had conversations between June 25 and June 28, 2024 had their data stored in plaintext on disk. OpenAI patched this, but the architecture failure was in production for days before detection.
These aren't attacks. These aren't exploits in the traditional sense. They're architecture failures in tools used by millions of people — including your employees, on their own devices, right now.
What enterprise contracts don't eliminate
- Data leaving your control via shared compute environments
- The "bring your own AI" problem — employees using personal accounts on work data
- The model drift problem — AI systems that change behavior after updates and need continuous monitoring
- The documentation problem — public LLMs cannot produce the audit trail NAIC 668 requires
If your compliance team is asking for a documentation package that shows exactly what data an AI model used and what it returned for each decision, a public LLM can't give you that. Not with an enterprise contract. Not with a BAA.
What "Reasonable" Looks Like — A Checklist
Reasonable doesn't mean perfect. It means documented, governed, and defensible. Here's what that means in practice:
- SOC 2 Type II attestation from every AI vendor — not SOC 2 Type I, not a questionnaire, not a self-attestation. A current SOC 2 Type II report, reviewed by your compliance team, on file.
- Data residency requirements in every vendor contract — where does your data go, who has access, what is retained, and for how long. Specific, not boilerplate.
- Explicit "no training on customer data" clause — in the contract. Not in the privacy policy. In the contract. These are different things.
- Isolated tenancy or on-premise deployment for high-sensitivity workloads — underwriting, claims, anything touching NPI. "Private AI" is the term; isolated compute is the architecture.
- Encryption at rest and in transit — mandatory for any AI system touching customer data. No exceptions for AI.
- Audit logging for every AI query and response — user ID, timestamp, data sources accessed, output. Immutable, exportable. This is your NAIC 668 documentation.
- Breach notification SLA in writing — maximum 72 hours from discovery to notification, with specific content requirements. This aligns with NY DFS Part 500 and matches GLBA's 30-day FTC window.
- AI inventory and governance policy — documented, board-reviewed annually, employee-acknowledged. Includes consumer-grade AI tools, not just enterprise vendors.
- Quarterly board reporting cadence — not just annually. AI tool usage changes faster than annual cycles.
- Examiner-ready documentation package — the ability to produce your AI inventory, vendor contracts, bias testing results, and audit logs within 30 days of a request.
The 90-Day Insurance Carrier AI Governance Path
This is the path we take clients through. Ninety days is aggressive but achievable. Anything longer and you have momentum problems.
Document everything in use, then map it against your obligations
Document every AI tool in use across underwriting, claims, customer service, and marketing — including personal accounts and consumer-grade tools employees are using informally. Map each tool against the data types it touches — NPI, claims data, policy applications, agent commission data. Identify the gap between current state and GLBA Safeguards Rule requirements; identify the gap against NAIC Model Bulletin AIS Program requirements. Assign a named accountable executive — not an IT lead, not a compliance analyst, a C-suite or very close to it.
Focus resources on highest-risk exposure first
Classify AI use by data sensitivity and decision impact: high-risk (underwriting, claims, pricing) / moderate-risk (customer service, agent support) / low-risk (internal operations, documentation). Identify high-risk uses that currently depend on consumer-grade or public LLM infrastructure — these are your immediate exposure points. Identify third-party AI vendors lacking adequate BAAs, SOC 2 Type II attestation, or contractual "no training" clauses. Draft the interim AI Acceptable Use Policy: no customer NPI in consumer AI accounts; employee acknowledgment required.
Replace high-risk public LLM usage; produce the documentation package
For high-sensitivity workloads: scope private AI deployment (isolated tenancy or on-premise) as the replacement for public LLM infrastructure. For moderate-risk uses: establish formal vendor agreements with appropriate controls and documentation. Produce the AIS Program documentation framework — the written governance document, the vendor due diligence package, the bias testing protocol, the audit log architecture. Brief the board on AI governance status and risk posture; establish quarterly reporting cadence.
The regulatory environment is not going to get simpler.
NAIC is drafting a model law on third-party AI oversight expected in 2026; state adoption will follow. The NAIC Market Conduct Regulation Modernization Working Group launched in March 2026 to examine AI in auto insurance pricing specifically — this is a direct signal that examiners are building institutional knowledge faster than most carriers are building compliance programs.
If you're a carrier or MGA with exposure in 10+ states, you are either building governance now or you're building it under examination pressure. The second option is more expensive and more embarrassing.
We offer a $7,500 AI Readiness Assessment for insurance carriers — same format as the Green Mountain Mutual Insurance sample assessment.