An insurer’s AI governance program needs to explain how decisions are made across the lifecycle of a system. A policy is useful only when the inventory, approvals, testing and vendor oversight show how it is applied to real work.
Start with the inventory
Identify where AI is used in claims, underwriting, distribution and supporting functions. Include vendor features and embedded capabilities, not only internally built models. Record the owner, data, intended output and how people rely on it. The inventory should help the organization find its exposure and route a use to the appropriate review.
Make the governance route explicit
Define who approves a new use, which functions review it and what evidence they need. The NAIC adopted its AI Model Bulletin in December 2023; state requirements and adoption must be checked for the insurer’s jurisdictions. Use the relevant requirements to shape the program, with proportionate review based on the actual risk. NAIC AI overview.
Connect policy to evidence
For each material use, retain scope, testing, known limitations, source or data information and the release decision. Identify the documents required from a third party and how they will be reviewed. A program should say what happens when evidence is missing, a test fails or an operating issue is discovered.
Make the inventory a decision tool
A useful inventory entry answers more than whether a product contains AI. It identifies the business use, owner, affected users or consumers, material data sources and the role of human review. Include the last review date and the events that require reassessment. This makes the inventory useful to operations, procurement and risk teams.
When a vendor adds an AI feature, route the change through that same process. Determine whether the feature is enabled, what information it receives and whether it changes a decision or only prepares information. A product-level approval should not automatically authorize every capability introduced later. The program needs a practical way to detect and review that change.
Keep the program current
Assign owners for inventory updates, vendor reviews, incidents and changes to a system’s authority. Sample completed records to see whether the process is followed. Reassess a use when staff begin relying on it differently or a vendor adds a consequential capability. Program maintenance should be part of normal operations rather than an exercise before an examination.
Before the next decision
Planning checklist
- Inventory with use, owner and reliance recorded
- Jurisdiction-aware review and approval route
- Testing, vendor and release evidence
- Ongoing change, incident and inventory maintenance
Sources and further reading
Sources checked 5 October 2026. The design recommendations in this guide are AID’s analysis. Sector obligations depend on the use case and jurisdiction.
Apply this to a defined workflow
AID can help connect an AI implementation’s technical records to the insurer’s documented governance process.
