Insurers · regulatory crosswalk
The NAIC model AI bulletin, provision by provision.
Twenty-plus states have adopted the NAIC's model bulletin on the use of AI systems by insurers — same text, different letterhead. This crosswalk maps the LLM Validation Report to that shared text once: where it provides responsive documentation, where it serves as one input among others, and where the bulletin's expectations stay squarely with your own AIS Program. If your state adopted the model, this mapping is your mapping.
TWELVE STATES PILOT THE NAIC AI EXAM CHECKLIST MAR–SEP 2026 · ADOPTION VOTE NOVEMBER
Scope statement. The Spectralgraph LLM Validation Report is an independent screening measurement of fabrication risk in a designated, insurer-hosted generative AI (large language model) system. It is not an audit, attestation, examination, or opinion, and it does not certify compliance with the NAIC model bulletin, any state's adoption of it, or any law or regulation. This crosswalk identifies, provision by provision, where the Report provides responsive documentation ("Addressed"), where it can serve as one input among others ("Supporting"), and where the provision is outside the Report's scope entirely ("Outside scope"). Provisions marked Outside scope remain the insurer's responsibility through its own AIS Program, and Spectralgraph makes no representation regarding them. Section and item numbers below follow the NAIC model text; adopting states retain the same structure with at most minor renumbering — check your state's instrument.
State adoptions of the model bulletin (verified against the NAIC implementation map, status April 1, 2026)
| State | Instrument | Notes |
|---|---|---|
| Iowa | Iowa Insurance Division Bulletin 24-04 (Nov. 7, 2024) | NAIC exam-pilot state, Mar–Sep 2026. |
| Wisconsin | OCI bulletin on AI systems (Mar. 18, 2025) | NAIC exam-pilot state. |
| Virginia | Administrative Letter 2024-01 (Jul. 2024) | NAIC exam-pilot state. |
| Connecticut | Bulletin MC-25 (Feb. 26, 2024) | NAIC exam-pilot state. Connecticut domestic insurers also file an annual AI certification, due on or before September 1. |
| Pennsylvania | Insurance Notice 2024-04, 54 Pa.B. 1910 (Apr. 6, 2024) | NAIC exam-pilot state. |
| Oklahoma | OID Bulletin No. 2024-11 (Nov. 14, 2024) | Not a pilot state. Oklahoma-specific crosswalk: oid-2024-11-crosswalk. |
| Rhode Island | Insurance Bulletin 2024-03 | NAIC exam-pilot state. |
| Vermont | Insurance Bulletin No. 229 | NAIC exam-pilot state. |
| Maryland | Bulletin 24-11 | NAIC exam-pilot state. |
Honesty note on the pilot: the twelve pilot states are CA, CO, CT, FL, IA, LA, MD, PA, RI, VT, VA, WI — piloting the exam checklist is not the same thing as adopting the model bulletin. Florida and Louisiana pilot without having adopted it; California and Colorado operate their own distinct AI regimes (CA Bulletin 2022-5; CO 3 CCR 702-10), which this crosswalk does not map. More than twenty states have adopted the model in total; the table lists the ones this lab has verified against the NAIC implementation map and works with today. If your state adopted the model and is not listed, the mapping still applies — write us and we will confirm your instrument's numbering.
Section 3 — AIS Program guidelines
| Model bulletin provision (paraphrase) | Status | Where this appears in the Report / basis |
|---|---|---|
| §3 (intro): "verification and testing methods to identify errors and bias in Predictive Models and AI Systems" | Addressed, in part | Error identification for the designated generative AI system: entire Report (per-domain results, findings register SG-NNN, Appendix A full response register). The bias / unfair discrimination portion of this provision is outside scope; see the exclusions section below. |
| §3.4: validating, testing, and retesting to assess generalization of AI System outputs upon implementation, including performance on unseen data | Addressed | Core function of the engagement. Method section documents leave-one-model-out instrument provenance; measurement is performed on the deployed model using the insurer's own question types. Flagged responses are individually verifiable by the insurer's staff, supporting the bulletin's "performance against expert review" pathway. |
| §3.3(c): assessments such as repeatability, reproducibility, traceability, model drift, and auditability of measurements | Addressed, by analogy | Written for Predictive Models; the Report provides the analogous evidence for the designated generative AI system: document control with provenance hashes, machine-readable findings with stable IDs (findings.csv), Validity & Re-measurement section, and a quarterly re-measurement trend record where Continuous Assurance is engaged (drift evidence). |
| §3.7: narrative description of the model's intended goals and how the model is developed and validated | Supporting | Scope & Engagement Basis section plus the insurer's configuration statement (model, adapters, quantization, as attested by the insurer) document the validated system. Development narrative of the model itself remains with the insurer or its vendor. |
| §3.1: oversight and approval process for development, adoption, or acquisition of AI Systems | Supporting | A pre-deployment or post-deployment measurement can serve as an input to the insurer's approval process. The process itself is the insurer's. |
| §2.2: documentation requirements "developed with Section 4 in mind" | Supporting | The Report is constructed as producible documentation: signed Summary Letter, defined severity thresholds, findings register, limitations, independence statement, document control, and machine-readable appendix. |
| §1.1–1.9: written AIS Program, governance accountability, proportionality, consumer notice | Outside scope | The AIS Program is the insurer's own written program. The Report is one exhibit within it, not a substitute for it. |
| §3.2: data practices (lineage, quality, integrity, bias analysis and minimization, suitability, currency) | Outside scope | Insurer data governance is not measured. Note: the engagement itself is designed to require no consumer data (question types and a designated endpoint only). |
| §3.5, §3.6: protection of non-public information; data and record retention | Outside scope | Information security and retention programs are not assessed. |
Section 3, Part 4.0 — Third-party AI systems and data
| Model bulletin provision (paraphrase) | Status | Where this appears in the Report / basis |
|---|---|---|
| §4.1: due diligence methods to assess third-party AI Systems | Supporting | Independent measurement of a vendor-supplied, insurer-hosted model provides diligence evidence the insurer did not generate itself and the vendor did not attest to itself. |
| §4.3: activities to confirm third-party compliance over time | Supporting | Periodic independent re-measurement (Continuous Assurance) provides a recurring, dated record for the third-party file. |
| §4.2: contract terms with third parties (audit rights, regulator cooperation) | Outside scope | Contracting is the insurer's function. |
Section 4 — Examination document requests
| Model bulletin provision (paraphrase) | Status | Where this appears in the Report / basis |
|---|---|---|
| Item 1.3(d): "documentation related to validation, testing, and auditing, including evaluation of Model Drift," reflective of the system's components "whether based on Predictive Models or Generative AI" | Addressed | The Report is this document for the designated generative AI system: dated, signed, reproducible validation and testing documentation. Quarterly re-measurement produces the Model Drift evaluation record over time. This is the provision the engagement is built around. |
| Item 1.3(c)(ii)(3): techniques, measurements, thresholds, and similar controls used | Addressed | Severity taxonomy with thresholds printed in-document; Method section (published method citations, patent application 19/724,790, instrument provenance); findings register with stable IDs. |
| Item 1.3(c)(ii)(2): information about data used in development and oversight of the specific system | Supporting, in part | Question-set provenance is documented (count and domains confirmed with the insurer in writing). Training-data lineage of the underlying model is outside scope. |
| Item 1.2 / 2.1: pre-acquisition and third-party due diligence documentation | Supporting | Where the measurement was performed as part of diligence, the Report and its findings.csv are producible artifacts of that diligence. |
| Item 2.4: validation, testing, and drift documentation for third-party systems | Addressed | Same basis as Item 1.3(d), applied to a vendor-supplied model hosted by the insurer. |
| Items 1.1, 1.3(a), 1.3(b), 2.2, 2.3: AIS Program records, coordinating bodies, data practice records, third-party contracts | Outside scope | Program, organizational, and contractual records are the insurer's own. |
Explicit exclusions (stated so the covered items are credible)
| Area | Position |
|---|---|
| Unfair discrimination / bias testing | Not measured. The Report measures fabrication risk. Demographic-fairness testing of underwriting or pricing outcomes is a distinct discipline and should be sourced separately. |
| Traditional Predictive Models (rating, underwriting scores, actuarial models) | Not measured. The instrument applies to generative language models only. |
| Data governance, information security, record retention | Not assessed. |
| Governance program design, consumer notices, legal compliance determinations | Not provided. The Report supplies measurement evidence; conclusions of law are the insurer's and its counsel's. |
Instrument note. Instrument performance characterization: approximately 0.85 AUC, fabricated-entity discrimination, length-controlled, leave-one-model-out validation across an 18-model benchmark. This figure is provisional and is reported with its estimation conditions in the Report's Method section.
Crosswalk v1.0, published 2026-07-13. Source: NAIC Model Bulletin, Use of Artificial Intelligence Systems by Insurers (adopted December 4, 2023), read in full from content.naic.org; provision wording verified against the model text 2026-07-13; state adoptions verified against the NAIC implementation map (status as of April 1, 2026). This document describes the LLM Validation Report v3 structure and does not modify any engagement's scope; the engagement letter governs.
Want this mapping against your own program?
Reply with your question types and the model you host, and the sample report shows exactly what the evidence looks like before you spend a dime.
Email the labREPLIES SAME DAY · EVERYTHING ANSWERED IN WRITING, ON THE RECORD