AI Agent Security for Insurance: NAIC Bulletin Controls and Audit Evidence
Insurance regulators already expect a written program governing every AI system that touches a regulated decision. Agents that read claims, quote policies, and message insureds fall squarely inside it.
Direct answer
AI agent security for insurance means running carrier agents behind runtime controls that limit which policy and claim records each agent can reach, inspect untrusted inputs like submitted claim documents and insured emails for prompt injection, hold coverage and payment decisions for a human, and record every access to an immutable trail. Those controls are also what produces the documentation the NAIC Model Bulletin, New York DFS Circular Letter No. 7, and Colorado Regulation 10-1-1 expect: a model and agent inventory, evidence of testing, third-party oversight, and a record of what each system actually did.
Try it live
Watch Agentshield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The risk
An underwriting or claims agent reads text an outsider wrote. A crafted claim narrative or uploaded document can steer an unguarded agent into approving coverage, disclosing another insured record, or acting outside the rate filing, and nothing in the model itself stops it.
How Agentshield handles it
Agentshield sits on the action path of every carrier agent. Each agent is scoped to the specific policies, claims, and systems its task requires, every ingested document and message is inspected for injection before the model reads it, coverage decisions and payments above your threshold are held for an adjuster or underwriter, and every access and verdict is written to an immutable trail your market conduct examiners can read.
The controls
The controls that secure the AI agents your insurance carrier runs.
Where AI agents create risk in insurance workflows
The risk is not evenly spread. It concentrates wherever an agent reads text a third party wrote and then does something that affects a customer or a dollar amount. That combination, untrusted input plus a consequential action, is where carrier agents actually fail.
| Workflow | What can go wrong | The control that contains it |
|---|---|---|
| Claims intake and triage | A crafted claim narrative or uploaded document instructs the agent to approve, escalate, or reveal another claim | Injection inspection on every ingested document, plus per-claim data scoping |
| Underwriting and quoting | An agent reaches data outside the filed rating variables, or applies logic no one can explain to a regulator | Tool and data permissions, with an immutable record of every input used |
| Policy servicing and endorsements | An agent issues a change, cancellation, or refund that was never authorized | Human approval gates on any action that moves money or changes coverage |
| Insured-facing chat and email | Personal or health information from one insured surfaces in another conversation | Data-loss prevention on outputs, scoped to the requesting policyholder |
| Fraud review and SIU support | An agent acts on a manipulated referral, or its reasoning cannot be reconstructed later | Action monitoring plus an attributed audit trail per decision |
| Vendor and MGA agents | A third-party agent operates on your book with no visibility on your side | Contractual audit rights backed by enforcement you actually run |
Notice how many of these are ordinary business processes rather than exotic attacks. That is the point. A claims agent is supposed to read what claimants send it; the exposure comes free with the job. The horizontal version of this problem is covered on enterprise AI security, but insurance adds a regulator who will ask you to document the controls.
Mapping the NAIC Model Bulletin to agent controls
The NAIC adopted its Model Bulletin on the Use of Algorithms, Predictive Models, and Artificial Intelligence Systems by Insurers on December 4, 2023. Per the NAIC implementation map dated April 1, 2026, 24 states and the District of Columbia have adopted it, with California, Colorado, New York, and Texas regulating AI in insurance through their own separate guidance instead. Whether the NAIC bulletin applies to AI agents specifically is worth settling before you scope your AIS Program.
Read the bulletin honestly before you build to it. It expects insurers to develop, implement, and maintain a written program (an AIS Program) for the responsible use of AI systems that make or support decisions on regulated insurance practices. But it uses the word should, not shall, and it says plainly that its goal is not to prescribe specific practices or documentation. It is an expectations document that tells you what a regulator will ask for, and Section 4 lists exactly that.
| What the bulletin expects | What a regulator asks to see | The runtime control that produces it |
|---|---|---|
| Inventories and descriptions of AI systems in use | A current model and agent inventory, including systems not covered by the program | Every agent registered at the control plane, so the inventory is observed rather than declared |
| Constraints and controls on automation | Documented limits on what the system may do without a person | Per-agent tool permissions plus approval gates on consequential actions |
| Protection of non-public information, including unauthorized access to the models themselves | Access controls and evidence they held | Least-privilege data scoping and egress prevention on outputs |
| Monitoring, auditing, escalation, and reporting protocols | Records showing review actually happened | Real-time action monitoring with exportable, attributed logs |
| Auditability of measurements, including model drift | Validation, testing, and retesting documentation over time | Recurring testing against the same agents you run, logged |
| Third-party due diligence and audit rights | Contracts granting audit rights, plus proof you exercised them | The same enforcement and trail applied to vendor and MGA agents |
| Data and record retention | Retention aligned to your record schedule | Immutable trail with retention you configure |
The bulletin also allows insurers to adopt or rely on the NIST AI Risk Management Framework, which is a useful shortcut: if you already run to NIST AI RMF, you are largely speaking the bulletin language. What NIST will not do for you is generate the evidence. That has to come out of the running system.
What New York and Colorado add on top
Two states go further than the model bulletin, and if you write business in either, they set your real bar.
New York DFS Circular Letter No. 7 (July 11, 2024) covers AI systems used in underwriting and pricing, whether or not external consumer data is involved. It expects a three-step discrimination analysis: test for disproportionate adverse effects on protected classes, establish a legitimate and lawful rationale where a disparity appears, and search for a less discriminatory alternative. The cadence matters for engineering: testing before deployment, annually after that, and again on any material change. It also expects an inventory of AI systems including retired ones, change tracking with rationale, a documented data lifecycle from acquisition through destruction, and a clear statement that compliance cannot be delegated to a vendor.
Colorado Regulation 3 CCR 702-10 requires a governance and risk management framework with board oversight and an annual officer-signed report due December 1. It was amended effective October 15, 2025 to extend beyond life insurers to private passenger auto and health benefit plan insurers using external consumer data, with compliance for those lines required by July 1, 2026.
One correction worth making, because vendor pages get it wrong constantly: Colorado's quantitative testing regulation was never adopted. It was drafted in September 2023 and proposed using Bayesian Improved First Name Surname Geocoding to estimate race and ethnicity for testing life underwriting outcomes, actuaries objected to the error rates, and it stalled. The Division waived the quantitative testing description requirement for both the 2024 and 2025 annual reports because no adopted methodology existed. If someone is selling you a product on the basis that Colorado mandates quantitative bias testing today, check the citation.
What all three regimes share is a demand for evidence rather than assurances. The overlap with what we cover for banks and fintechs and for healthcare and HIPAA is substantial, because the underlying control set is the same. Only the reporting artifact changes.
How to deploy an insurance AI agent safely
Carriers that get agents through their own model risk and compliance review tend to follow the same sequence. It works because each step produces a document the reviewer wanted anyway.
- Inventory before you deploy. List every agent, what regulated decision it touches, what data it reads, and who owns it. This is the first artifact any examiner asks for, and it is also the only way to answer the bulletin's question about systems not covered by your program.
- Scope each agent to the minimum book of business it needs. A claims triage agent should reach the claim in front of it, not the claims table. Data scoping is what turns a breach into an incident affecting one file.
- Inspect every untrusted input. Claim documents, insured emails, broker submissions, and third-party reports are all attacker-controllable text. Run injection inspection before the model reads them, not after it acts.
- Gate the consequential actions. Decide your threshold in dollars and in coverage impact, then hold anything above it for a licensed adjuster or underwriter. Reversibility is the right test: an agent can draft an endorsement, a person should issue it.
- Test on the cadence the regulator named. Before deployment, annually, and on material change is the New York rule, and it is a sensible default everywhere. Test the agent you actually run, including its tools, not the model in isolation.
- Export the trail as evidence. When market conduct asks how a decision was made, the answer should be a record showing the inputs, the policy verdicts, and the human who approved, not a description of your intentions.
The pattern generalizes: build the controls so the paperwork falls out of them. Our AI agent audit requirements guide covers what a defensible trail contains, and AI compliance software covers the cross-framework view.
FAQ
Common questions about insurance ai agents.
Can insurance companies use AI agents?
Yes. No US insurance regulator prohibits AI agents, and roughly half the states have issued guidance that assumes insurers use AI in regulated decisions. What regulators expect is a written program governing those systems: an inventory, documented limits on automation, testing before and after deployment, third-party oversight, and records showing what happened. Carriers run into trouble not for using agents but for being unable to document how a specific decision was made.
What does the NAIC AI model bulletin require?
It expects insurers to develop, implement, and maintain a written AIS Program for the responsible use of AI systems affecting regulated insurance practices, scaled to the risk involved. Core themes are senior management accountability, coverage of the full system lifecycle, inventories of models in use, constraints and controls on automation, protection of non-public information, drift monitoring with auditable measurements, and due diligence plus audit rights over third-party AI. It says should rather than shall and does not prescribe specific practices.
How many states have adopted the NAIC AI model bulletin?
Per the NAIC implementation map dated April 1, 2026, 24 states and the District of Columbia have adopted the model bulletin since it was issued in December 2023. Four additional states, California, Colorado, New York, and Texas, regulate insurer use of AI through their own separate bulletins or regulations rather than by adopting the NAIC text, so more than half of US jurisdictions now have insurance-specific AI guidance in force.
Does the NAIC bulletin apply to AI agents that take actions?
It applies to AI systems that make or support decisions related to regulated insurance practices, which covers an agent that triages a claim, prices a quote, or services a policy. Agents raise the stakes on two of its themes in particular: constraints and controls on automation, since an agent acts rather than scores, and third-party oversight, since much agent tooling is vendor supplied. The bulletin was written before agentic AI, but its scope language reaches it.
Who is responsible when a vendor AI agent makes a bad insurance decision?
The insurer. Both the NAIC bulletin and the New York DFS circular are explicit that compliance obligations cannot be delegated to a third party: the insurer must perform due diligence so that decisions meet the legal standards imposed on the insurer itself, secure contractual audit rights, and actually exercise them. Practically that means you need the same enforcement and audit trail over vendor and MGA agents that you run over your own.
More use cases