How regulators oversee algorithms and AI in car insurance

Most states have no special statute for artificial intelligence in car insurance. Regulators instead apply the laws that already exist: rates must not be excessive, inadequate or unfairly discriminatory; insurers must not engage in unfair trade practices; and claims must be handled under unfair claims settlement rules. The National Association of Insurance Commissioners (NAIC) adopted a model bulletin in December 2023 telling insurers that those laws apply however a decision is made, and spelling out the governance regulators expect and the documents they may ask to see. As of an NAIC map dated November 3, 2026, 27 states, the District of Columbia and Puerto Rico had issued versions of it, and a few states, led by Colorado, have gone further with rules written for insurance.

None of this means a regulator reviews your individual price. The oversight works at the level of the insurer's models and processes, through rate filings, examinations and complaints. This article explains what the rules say, which states act and how, where the gaps are, and what you can ask your own insurer.

What regulators mean by an algorithm

The NAIC's model bulletin defines the terms, and the definitions are broad on purpose. An "algorithm" is a clearly specified mathematical process for computation. A "predictive model" mines historic data using algorithms or machine learning to find patterns and predict outcomes that can be used to make or support decisions. An "AI system" is a machine-based system that can generate outputs such as predictions, recommendations or content that influence decisions. The bulletin treats machine learning as a subset of artificial intelligence.

The bulletin lists where these tools appear: product development, marketing, sales and distribution, underwriting and pricing, policy servicing, claim management and fraud detection. In car insurance that covers a lot of familiar ground:

• A pricing model that combines your rating factors into a premium.
• A scoring model built on telematics data such as braking and speed.
• A insurance score built from credit data, where the state allows it.
• A claims tool that estimates repair costs or flags a claim for review.
• A fraud model that decides which claims go to a special investigations unit.
• A chatbot or automated system that handles first contact.

Our guide How insurers use AI in pricing and claims describes how these tools work. This article is about the rules around them.

The existing laws that already apply

The key point in the NAIC bulletin is that nothing about the technology changes the legal standard. The bulletin identifies the laws it relies on, and each maps to a type of decision:

The bulletin says insurers must adopt practices that ensure AI does not result in unfair trade practices or unfair claims settlement practices, and that decisions "are not inaccurate, arbitrary, capricious, or unfairly discriminatory." States have their own versions of these laws, with their own numbers and quirks, so the model list is a map, not a statute. For the rate side, see how car insurance rate approval works. For claims deadlines that apply no matter who or what makes the decision, see unfair claims practices acts: the deadlines insurers must meet.

The NAIC model bulletin

The bulletin was adopted by the Innovation, Cybersecurity, and Technology (H) Committee on December 1, 2023 and by the NAIC's Executive Committee and Plenary on December 4, 2023. It is a template: each state's insurance department issues it under its own name, filling in citations to its own laws. The bulletin itself is guidance. It says the goal "is not to prescribe specific practices or to prescribe specific documentation requirements," and that insurers may show compliance through other means.

What it asks of insurers

The bulletin expects each insurer to develop, implement and maintain a written program for the responsible use of AI systems that make or support decisions in regulated insurance practices (an "AIS Program"). The program should be proportionate to the risk, and the bulletin lists five factors: the nature of the decisions, the type and degree of potential harm to consumers, how much humans are involved in the final decision, how transparent and explainable outcomes are to the consumer, and how heavily the insurer relies on third parties. It should cover:

1. Governance. Senior management accountable to the board or a board committee, written policies for every stage from design to retirement, and documentation.
2. Risk management and controls. Data practices including currency, quality and bias analysis; inventories and documentation of predictive models; validation and testing, including measuring model drift (a model's performance decaying as the data it sees changes over time).
3. Third parties. Due diligence on vendors and, where available, contract terms giving audit rights and requiring cooperation with regulators.
4. Consumer notice. The program should include processes providing notice to impacted consumers that AI systems are in use and access to appropriate levels of information, depending on the stage of the insurance life cycle.

What regulators may request

The oversight section lists what an insurer should expect in an investigation or market conduct examination, whether or not it has a written program. Requests can include the written AIS Program, the model inventory, documentation of data sources and lineage, validation and testing results, and, for third-party models, due diligence files and vendor contracts. The bulletin says regulators may also ask about any specific model, system or application and its outcomes. The bulletin's governance section adds that proprietary and trade secret information must be protected.

Where it has been adopted

The NAIC's implementation map, with status as of November 3, 2026, lists 29 adopting jurisdictions: 27 states, the District of Columbia and Puerto Rico. Adoption dates run from Alaska's Bulletin B 24-01 on February 1, 2024 to North Dakota's Bulletin 2026-2 on October 5, 2026, so the roster has kept growing. North Carolina, for example, adopted Bulletin 24-B-19 on December 18, 2024. The map says it does not determine whether a state's bulletin contains every element of the model.

Four other jurisdictions are listed separately as having insurance-specific regulation or guidance: California (Bulletin 2022-5, June 30, 2022), Colorado (3 CCR 702-10, effective November 13, 2023, with amendments effective October 15, 2025), New York (Insurance Circular Letter No. 7, July 11, 2024) and Texas (Bulletin B-0036-20, September 30, 2020). If your state is not on the list, that does not leave algorithms unregulated, because the underlying rate and trade-practice laws still apply. It means the department has not issued this particular statement of expectations.

Colorado: testing for unfair discrimination

Colorado went further than a bulletin. Its legislature passed Senate Bill 21-169 in 2021. The act:

• Bars insurers from unfairly discriminating, in any insurance practice, on the basis of race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity or gender expression.
• Bars the use of external consumer data and information sources, and of algorithms and predictive models using them, in a way that unfairly discriminates on those grounds.
• Defines "external consumer data and information source" to include credit scores, social media habits, locations, purchasing habits, home ownership, educational attainment, occupation, licensures, civil judgments and court records.
• Defines unfair discrimination to include a use that correlates with a protected class and produces a disproportionately negative outcome for it that exceeds the reasonable correlation to the underlying insurance practice, including losses and costs for underwriting.
• Directs the insurance commissioner to adopt rules after a stakeholder process. Those rules must require insurers to provide information about the data sources they use, explain how they use them, maintain a risk management framework designed to determine whether the use unfairly discriminates, assess the results, and provide an officer's attestation. Information filed under the rules is confidential.
• Allows the commissioner to examine and investigate an insurer's use of such data, algorithms or models.

The rules came in stages. The Division of Insurance's first governance regulation, issued under 3 CCR 702-10, applied to life insurers. According to law-firm summaries of the Division's actions, the Division adopted amendments on August 20, 2025, effective October 15, 2025, extending the governance and risk management requirements to private passenger auto insurers and health benefit plan insurers. Those summaries report that auto insurers owed an interim progress report on December 1, 2025 and had to have their full framework available to the Division by July 1, 2026, with reports annually after that. They also report that the definition of external consumer data for auto includes telematics data such as location, speed and engine performance, and that the amended rule is limited to race even though the statute covers more characteristics. The two summaries I could open (Debevoise and Faegre Drinker, both September 2025) describe the same dates; Debevoise adds that the Division had not yet set the quantitative testing requirements the amended rule refers to. I could not confirm the status of that testing rule as of November 2026, so check the Division of Insurance for current rules.

For a Colorado driver, the practical effect is that the insurer must be able to show the Division how it tested its models. The Division's filings are confidential under the statute, so the public sees the framework requirements and any enforcement, not the test results.

New York and California: reasons, proxies and notice

Two other states show different tools.

New York. The Department of Financial Services' Circular Letter No. 7, issued July 11, 2024, covers AI systems and external consumer data in underwriting and pricing. It says insurers may not rely solely on a third party's claim of non-discrimination. It describes a three-step assessment: look for disproportionate adverse effects; if found, look for a legitimate, lawful and fair explanation; if one exists, look for a less discriminatory alternative. It tells insurers to evaluate whether data acts as a proxy for a protected class, expects notices to applicants that say whether AI or vendor data is used and how to ask what data was behind a decision, and says an insurer cannot hide behind a vendor's proprietary algorithm to give vague reasons for an adverse decision.

California. Bulletin 2022-5, dated June 30, 2022, warns that "purportedly neutral individual characteristics" can serve as a proxy for prohibited ones. It names examples under investigation, including allegations that insurers flag claims from certain ZIP codes for special investigation and that biometric data is used in claims decisions. It states that when insurers use complex algorithms in a declination, limitation or premium increase, the specific reasons must be provided, and it reserves the Department's right to audit marketing, rating, claim and underwriting criteria, programs, algorithms and models. See California and New York for the broader state rules.

How regulators actually check

Three mechanisms matter, and none of them is a public inspection.

• Rate filings. In prior-approval and many file-and-use states, a rating model enters through the filing, where the department can ask for support. How to read a car insurance rate filing on SERFF explains what a filing contains.
• Examinations and market conduct actions. The NAIC bulletin says insurers should expect questions about AI governance and any specific model in an investigation or exam. See market conduct exams and regulatory actions against insurers.
• Complaints. A pattern of consumer complaints can prompt a department to look into an insurer's practices. California's bulletin ties its concern to an increase in complaints about algorithmic unfairness.

The NAIC is also testing an examination tool. According to a Fenwick law-firm summary, its AI Systems Evaluation Tool pilot began March 2, 2026 in 12 states (California, Colorado, Connecticut, Florida, Iowa, Louisiana, Maryland, Pennsylvania, Rhode Island, Vermont, Virginia and Wisconsin) and was set to run through September 2026. It includes four exhibits covering an insurer's AI usage, governance framework, high-risk systems and data. The summary says adoption was expected at the NAIC's fall 2026 meeting; I could not confirm what happened at that meeting.

Limits and open questions

Honest readers should know where the rules are thin.

Proxy discrimination. A model can use only neutral inputs, such as ZIP code, shopping history or device type, and still produce results that fall harder on a protected group. The NAIC bulletin does not use the words "proxy" or "disparate impact." It rests on the existing "unfairly discriminatory" standard, and what that standard reaches is left to each state's law. Colorado's statute addresses the question expressly through its correlation and disproportionate-outcome definition. New York's circular and California's bulletin address proxies in guidance. Elsewhere, you would need to look at the state's law.

Guidance versus law. A bulletin states a department's expectations. It does not by itself give consumers new rights or create a private lawsuit. Enforcement runs through the department using the underlying statutes.

Trade secrets. Models are proprietary. Colorado's statute treats information filed under the rules as confidential, and the NAIC bulletin says governance should protect proprietary and trade secret information. That protects insurers' competitive position and limits what outsiders can verify.

Different lines, different pace. The Colorado rules reached auto in 2025 after starting with life insurance, and the quantitative testing standards were still being developed when the law firms reported. Expect details to change.

Telematics and credit. Two of the biggest data inputs in auto already have their own rules in many states. See which states restrict telematics surcharges or data use and adverse action notices: what an insurer must tell you about a rate.

What you can ask your insurer

You do not need to know whether a tool counts as AI. Ask about the decision. A script that works for a renewal increase, a denial or a claim estimate:

1. "Which of my records or data sources affected this price or decision: credit, claims history, driving record, telematics, a third-party data vendor?"
2. "What were the main reasons, in plain language? Please send them in writing."
3. "Was an automated model or software score used, and did a person review the result?"
4. "How do I correct data I think is wrong, and will you re-rate or re-evaluate once it is fixed?"
5. "If a score came from a vendor, who is the vendor and how do I contact them?"

For a claim, add: "What did the repair estimate or valuation come from, and may I see it?" Insurers often decline to explain proprietary models. A written, specific question still creates a record, which matters if you complain to the department. Our guide how to file a complaint against a car insurance company covers what to include.

A worked example with invented numbers

Say your six-month premium rises from $1,150 to $1,330 after you enroll in a telematics program, and the app showed several "hard braking" events you remember as normal stops. You ask the five questions. The insurer replies that your driving score fell, names braking, late-night driving and mileage as the main factors, and says the score is calculated by a model with no individual review. You can then ask what changes if the events are disputed, whether the rating plan is filed with your state's department, and whether the program allows you to leave without penalty. If the answers are vague, you file a complaint listing the dates and replies. The numbers are hypothetical, but the sequence of specific question, written answer, then complaint is what gives a department something to act on. how regulators review usage-based insurance rating plans explains the filing side.

Common questions

Is it legal for an insurer to use AI to set my price?

Generally yes, as long as the resulting rates comply with the state's rating law and are not unfairly discriminatory, and any required filings are made. The legal question is about the outcome and process, not the label "AI." Some inputs, such as credit, are restricted or banned in some states, regardless of the method.

Can a computer deny my claim without a person?

State claims laws set deadlines and require reasonable investigation and written explanations of denials regardless of who or what drives the decision. The NAIC bulletin covers claims decisions made or supported by AI. Whether a human must review is a question of each state's law and the insurer's practice, and the bulletin treats the extent of human involvement as one factor in how strong its controls should be.

Does the NAIC bulletin apply in my state?

Check the NAIC's implementation map or ask your state department of insurance. Even in a state without the bulletin, the rating, trade-practice and claims laws apply.

Can I see the model?

Almost certainly not. You can ask for the reasons, the data sources and how to correct them. Regulators may request more documentation in an exam, and in Colorado the filed information is confidential.

Where do I complain?

Your state department of insurance. See what your state insurance department does for what each office handles, and consult a licensed attorney for legal claims.

Key takeaways

• No separate AI law governs most car insurance. Regulators apply existing laws on unfair discrimination, rates and claims handling to whatever tool produced the decision.
• The NAIC's December 4, 2023 model bulletin asks insurers for a written AI governance program and lists what regulators may request; as of November 3, 2026, 27 states, D.C. and Puerto Rico had adopted versions.
• Colorado's SB21-169 and later rules, New York's Circular Letter No. 7 and California's Bulletin 2022-5 go further on testing, proxies and reasons, but each has its own scope and date.
• Oversight is indirect: filings, exams and complaints, with models treated as confidential, so consumers see outcomes, not code.
• You can ask for specific reasons, data sources and a correction path in writing, and complain to your department if the answers are vague.