Twenty-five Insurance Regulators Have Adopted the NAIC AI Bulletin. None of Them Mentions Your Estimate.

The short version. Twenty-five insurance jurisdictions have adopted the NAIC's model bulletin on insurers' use of artificial intelligence, and 4 more have their own AI regulation or guidance instead. The operative line is Section 3 of the model, and it points at existing law and creates none of its own: decisions subject to regulatory oversight that are made by Insurers using AI Systems must comply with the legal and regulatory standards that apply to those decisions. The model rests partly on the Unfair Claims Settlement Practices Act and names claim administration in the life cycle it covers. What it never mentions, anywhere in nine pages, is estimating, valuation or repair.

By Anthony Braswell for Quorum Industries LLC, The Autobody Directory · Updated 2026-08-23 · How this was written, and what the machine may not do

How this page was produced: Researched, drafted and checked with AI assistance under human direction and signed off by the named author, with the tables on this page built from a register by a script. How this site is written

Colorado's instrument is a regulation, and of the twenty-nine it is the one that reaches an automobile claim. 3 CCR 702-10, Regulation 10-1-1 was amended to cover private passenger automobile insurers effective 15 October 2025, and it catches claims management by definition, without naming it, because C.R.S. 10-3-1104.9(8) defines insurance practice to include claims management. The regulation itself uses the word claim zero times, and a carve-out at C.R.S. 10-3-1104.9(7)(b)(IV) cuts against the finding. The Colorado section sets out both halves.

Every one of the 51 US jurisdictions is named on this page, and every one carries a statute or regulation citation rather than only a bulletin number. Those citations are in the authority tables below.

Every jurisdiction that has adopted it

Status as of 1 April 2026, from the NAIC working group's own reference list.

That is 25 jurisdictions. The count on this page is computed from the table beside it, never typed in by hand, because a compilation whose headline and membership disagree is worth less than no compilation at all.

Wisconsin is the one row without a number, and that is Wisconsin's convention. OCI does not serialise its bulletins: the document's own header runs Date, To, From, Subject, with no number field anywhere on it. So it is cited the way OCI titles it, by date and subject. Read first-party at oci.wi.gov on 19 August 2026. The PDF is served as Bulletin20250318AI.pdf, and a filename is not a citation.

And 4 more that wrote their own

The NAIC lists these separately, under insurance-specific regulation or guidance, a different heading from adoption of the model. They are not counted in the 25 above.

Texas was wrong here until 21 August 2026, and the way it was wrong is worth saying. This row cited Bulletin # B-0036-20 of 30 September 2020. That bulletin is real and still loads, but its subject is "Insurers' use of third-party data" and it does not mention artificial intelligence. Texas's actual AI instrument is Bulletin B-0003-26, "Use of artificial intelligence", issued 12 June 2026, which recognises "the Principles on Artificial Intelligence, adopted by the National Association of Insurance Commissioners in 2020, as an appropriate guide". The category was right and the document was not. Note also that B-0003-26 postdates the NAIC map status this page rests on, so the map does not yet reflect it.

New York's entry deserves a note for anyone searching. Its AI instrument is Insurance Circular Letter No. 7 of 2024. New York's rule requiring hazardous waste disposal to be itemised on a repair estimate is Insurance Circular Letter No. 7 of 1993. Same number, thirty-one years apart, both about motor vehicle claims.

The other 22, named rather than left as a remainder

A compilation that lists only the jurisdictions that did something is not a fifty-state survey. These twenty-two appear in neither section of the NAIC map:

Alabama, Arizona, Florida, Georgia, Idaho, Indiana, Kansas, Louisiana, Maine, Minnesota, Mississippi, Missouri, Montana, New Mexico, North Dakota, Ohio, Oregon, South Carolina, South Dakota, Tennessee, Utah and Wyoming.

Twenty-five adopters, four with their own instrument, twenty-two listed in neither. That is all fifty-one.

What that absence establishes. The NAIC's own map, printed status 1 April 2026, does not list these jurisdictions as having adopted the model bulletin, and does not list them under its separate heading for departments with their own regulation or guidance.

What it does not establish. It is not a finding that these states have no artificial-intelligence guidance. The map tracks adoption of one model bulletin, plus the instruments the NAIC separately identified. A department can regulate insurer use of AI by a route this map does not follow, and nothing here says otherwise. There is no AI citation in this section because there is no AI instrument to cite, which is the honest state of the record.

That is not the same as saying these twenty-two are ungoverned, and the next section is where they stop being a remainder. Every one of them has unfair trade practices and unfair claims settlement law on the books, which is what the model bulletin itself rests on. Those provisions are cited below, one per jurisdiction, read on the state's own server.

The statute or regulation behind each instrument

Every instrument on this page is a bulletin, a circular letter, a technical assistance advisory or a guidance document. Not one of them is a law. They are sub-regulatory, which is a real limit and this page says so twice in its refusals.

But the model bulletin they follow has a section headed Legislative Authority, and it is written as a fill-in: it names five NAIC model acts and leaves brackets for the adopting state to insert its own citation. Adopting states fill them in. So the statutes are already inside the instruments this page names, and the table below is what each state wrote into those brackets, read in the instrument itself.

That is 29 jurisdictions, each carrying a statute or a regulation rather than only a bulletin number.

4 of those rows did not give up their own authority list, and they are marked. For those the cell carries the state law the instrument rests on, read separately on a government host, and says so rather than presenting it as a quotation from the bulletin. The reasons differ and are worth naming:

• Alaska publishes its bulletin as an image scan with no text layer.
• Kentucky publishes its bulletin as an image scan with no text layer.
• Pennsylvania sits behind a host that disallows automated reading.
• West Virginia has no Legislative Authority section at all.

West Virginia is the one worth dwelling on, because its blank is a finding rather than an obstacle. It adopted only Section 3 of the model and renumbered it to the top level, dropping Sections 1, 2 and 4 entirely. Section 1 is where the Legislative Authority list lives. So there was never a list in it to read, and no amount of persistence would have produced one.

2 rows were read by a person rather than by us, for the same reason two rows in the spot-check section were: those departments refuse automated readers. Those cells say so. A page that reports a clean number and drops how each row was established has lost the part that lets you check it.

And the law that governs those 22 anyway

A jurisdiction with no AI instrument is not a jurisdiction with no law. The model bulletin rests its expectations on unfair trade practices and unfair claims settlement provisions, and every state has those whether or not it has written anything about artificial intelligence. So these rows carry real law without claiming the state acted.

That is 22, which with the 29 above is all 51 jurisdictions, each with a statute or a regulation.

Mississippi is the one row that needs reading carefully, and it is deliberately not what it looks like. The provision cited for Mississippi is its unfair trade practices section. It is not a claims provision, and nothing here should be read as a Mississippi claims-handling standard, because there is not one. Mississippi has no unfair claims settlement practices statute and no administrative equivalent. That is not a gap in our research, and we did not take it on trust: every one of the 127 regulation PDFs published on the Insurance Department's own index was downloaded and text-extracted, and not one of them is a claims regulation. The NAIC lists Mississippi under its own claims model as no current activity. Insurer claims conduct in Mississippi runs through common-law bad faith. A jurisdiction with no law on a subject has no statute to cite, and we are not going to give it one to make a table look complete.

The Mississippi Code is licensed to LexisNexis and no state host serves its text, which the Secretary of State states outright. The citation above is nonetheless first-party: the Insurance Department publishes its own regulations as PDFs, and eight of them print "Miss. Code Ann. 83-5-35" as their statutory source. That gives the citation from a Mississippi government server without the section text, which is the same footing as Georgia and Tennessee here, and it is labelled Cite only for that reason.

One of these instruments reaches auto claims, and it never says the word

This page argues that these instruments are governance documents that do not reach collision work. That is true of twenty-eight of them. It is not true of Colorado, and it stopped being true on 15 October 2025, which is long enough ago that a page still saying otherwise is not out of date so much as wrong.

Colorado is the only jurisdiction here whose AI instrument is a regulation rather than a bulletin, so unlike every other row it is its own citation. 3 CCR 702-10, Regulation 10-1-1. The version in force is titled Governance and Risk Management Framework Requirements for Life Insurers', Private Passenger Automobile Insurers', and Health Benefit Plan Insurers' Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models. Section 3 says the same thing in the operative text. The original version, effective 14 November 2023, covered life insurers only; the amendment added the automobile line.

And the regulation uses the word claim zero times. It also never says estimate, repair, total loss or body shop. Read on its own it looks like a rating and underwriting rule, which is presumably how it has sat in compilations for months as a date in a table.

The reach is set by the statute, not the regulation. Section 4.G says "Insurance Practice shall have the same meaning as set forth in 10-3-1104.9(8), C.R.S.", and the automobile definition of external consumer data is data used "to supplement or supplant traditional underwriting factors or other insurance practices." Senate Bill 21-169 as signed, section 2, adding C.R.S. 10-3-1104.9(8)(c):

"INSURANCE PRACTICE" MEANS MARKETING, UNDERWRITING, PRICING, UTILIZATION MANAGEMENT, REIMBURSEMENT METHODOLOGIES, AND CLAIMS MANAGEMENT IN THE TRANSACTION OF INSURANCE.

So Colorado reaches artificial intelligence in automobile claims management, by definition rather than by naming it. Searching the twenty-nine instruments for the word "claim" would miss it entirely.

Now the part that cuts against it, which is worth as much as the finding. C.R.S. 10-3-1104.9(7)(b)(IV):

NOTHING IN THIS SECTION ... MAY BE CONSTRUED TO ... PROHIBIT THE USE OF OR REQUIRE THE TESTING OF LONGSTANDING AND WELL-ESTABLISHED COMMON INDUSTRY PRACTICES IN SETTLING CLAIMS OR TRADITIONAL UNDERWRITING PRACTICES UNLESS SUCH PRACTICES OR FACTORS ARE OTHERWISE INCLUDED IN THE TESTING OF AN ALGORITHM OR PREDICTIVE MODEL THAT ALSO USES EXTERNAL CONSUMER DATA AND INFORMATION SOURCES.

The section catches the algorithm, not the practice. A longstanding industry way of settling a claim is untouched unless it is already inside a tested model that uses external consumer data. Section 10-3-1104.9(6) also puts title insurance, surety bonds and most commercial policies outside the section entirely.

One more detail specific to the automobile line: the external-data definition for auto insurers names "consumer-generated Internet of Things data including telematics data". The life and health definitions in the same regulation say Internet of Things data with no telematics clause. The naming is deliberate and it is only in the automobile paragraph.

So two sentences, and they must not be merged. No instrument on this page, Colorado included, mentions estimating, valuation or repair: that gap is exactly where it was. But it is no longer true that no AI instrument reaches auto claims. One does, in one state, bounded by a carve-out. Continuing to say the second because the first is still true would be shaped rather than wrong, which is worse.

What the model bulletin actually requires

It is a governance instrument, and it says so. Insurers are expected to develop, implement and maintain a written AI Systems Program, an "AIS Program", covering AI systems that make or support decisions about regulated insurance practices.

Decisions subject to regulatory oversight that are made by Insurers using AI Systems must comply with the legal and regulatory standards that apply to those decisions

That expectation is Section 3. Section 1, under the heading Legislative Authority, is the part that matters most here: it names five model acts, and one of them is the Unfair Claims Settlement Practices Model Act (#900), which sets standards for the investigation and disposition of claims. So the bulletin reaches claim handling by design, not by accident.

Guideline 1.6 says the programme should cover the whole insurance life cycle, and it lists the stages. The claims words are there:

case management, claim administration and payment, and fraud detection

Guideline 1.9 adds a consumer-facing expectation: the programme should include processes providing notice to impacted consumers that AI systems are in use, with access to appropriate levels of information depending on which phase of the life cycle they are in.

The gap

Read the model bulletin end to end and it never mentions physical damage estimating, photo or virtual estimating, total loss valuation, or repair. Not once. Claims appear as "case management, claim administration and payment" and through the Unfair Claims Settlement Practices Act, and that is the whole of it.

No criticism of the drafting is intended. It is a model bulletin about governance, deliberately written to sit on top of existing law and to leave particular products alone.

But it means something practical for anyone whose car is being valued or estimated by software. The bulletin does not tell an insurer what its estimating model may do. It tells the insurer to have a programme, to be able to explain the model, and to answer for it.

The route that does reach the software is the third-party provision, and it is worth knowing. Section 4.0 of the guidelines requires the AIS Program to address AI systems and data developed by third parties: due diligence on the vendor, contract terms providing audit rights where appropriate and available, and terms requiring the third party to cooperate with regulatory inquiries about the insurer's use of its product.

Photo estimating and total loss valuation are almost never built by the insurer. They are vendor products. Under this bulletin the insurer cannot answer a regulator by pointing at the vendor, and is expected to have contracted for the vendor's cooperation in advance.

All twenty-five, checked against the department that issued them

Every row in the tables above comes from the NAIC's own implementation map. That is the right source for the question "which jurisdictions has the NAIC recorded as adopting the model", and a second-hand source for the question "what is this instrument called and when was it issued." So on 20 August 2026 we took all twenty-five back to the department that issued them.

All twenty-five agree with our table. There were no mismatches anywhere. Not one number and not one date turned out to be wrong, across every jurisdiction on this page, which is a real result about the NAIC list and worth saying plainly.

It was twenty-two that morning, then twenty-three, then twenty-five. Alaska moved when we stopped asking a fetcher for the date and looked at the document. New Hampshire and Virginia moved last, and they moved for a reason worth stating.

The last two were closed by a person, not by us. Twenty-three were read on the issuing department's own server by an automated reader. The remaining two refuse automated readers, so they were read by the site's operator in an ordinary browser and the header blocks supplied verbatim. That is a different provenance and it is labelled as one, because how a fact was established is part of the fact.

Both documents are now readable here, in full, because they are not readable at their source. That part is worth acting on. Each of these bulletins is a public regulatory instrument, published by a state so that insurers will read and comply with it, and each sits behind a host that refuses automated readers. Neither PDF is the problem: both carry ordinary text layers. The consequence is that a search engine, an AI assistant, or any researcher working through a fetcher can reach no part of either document, in a subject area where the questions being asked are increasingly asked by machines. So we transcribed both from the departments' own PDFs and host them:

• New Hampshire Insurance Bulletin INS 24-011-AB, full text
• Virginia Administrative Letter 2024-01, full text

Each transcript carries its provenance, its official location, and a statement that the department's copy governs if the two ever differ. Nothing is summarised. State regulatory instruments are government edicts and carry no copyright, which is what makes republishing them lawful as well as useful, and the only reason this is worth doing is that the departments have made their own copies unreachable to the readers who now most need them.

What we did before giving up, and why it is still on the page. Earlier versions of these two rows said only that the states were walled. That was true and nearly worthless, because a wall is a statement about one host while these were questions about a whole state. So each state's other publishers were enumerated. New Hampshire's General Court serves its Insurance Department index at 200, and in 742KB of it the word Insurance appears 27 times and the word bulletin zero times: the 27 is what makes the zero a finding, and the answer is that the General Court carries the Department's rules, and a bulletin is not a rule. Virginia's Reports to the General Assembly repository, filtered by author to the Commission for 2024, returns all 22 reports it published to the legislature that year, none of them an administrative-letter index.

One of those searches nearly became a false sentence, and the control is the only reason it did not. That same Virginia repository has a search box. It returned zero results for "Administrative Letter 2024-01", and that was about to be written down as a finding about Virginia. Searching it for "Bureau of Insurance", a phrase that must occur somewhere in 36,300 legislative reports, also returned zero. The search is broken for every query. An empty result from an untested instrument is no finding at all. It was a finding about a search box, and it was thirty seconds from being published as a finding about a state.

The walls are still there, and they are still worth naming exactly. Nothing about closing these rows removed either obstacle. scc.virginia.gov disallows automated reading site-wide in its robots.txt, covering both the administrative letters index and the document path. New Hampshire's department returns 403 to an automated reader on every path we tried: the current search-indexed bulletins page, the annual-reports page, and a different document entirely on mm.nh.gov. Those two sentences were true this morning and are true now. A reader who wants to check our work will hit the same two walls, and should know that before they try.

What finally closed them is worth being exact about, because it is not a technique. These documents were never unknowable. They were unknowable to an automated reader, which is what we are. A 403 and a robots disallow govern crawlers, and neither governs a person; both instruments are public regulatory letters published precisely so that insurers will read them. So a person read them and supplied the header blocks. We did not find a clever route in, and we did not take the two routes that were available: the Commission's origin host and a second URL pattern on a New Hampshire server that had already refused us. Those remain declined to us. What changed is who was doing the reading, and that is not a method we can apply at scale, which is the honest limit of it.

Two dates that were open this morning are closed now, and both closed the same way: by looking at the document instead of at a fetcher's output. Both PDFs are image scans with no text layer, which is why an automated read returned nothing from either and why both were listed as unconfirmed.

Alaska's date is on the last page, not the first. Page 10 of 10, immediately above the signature block, reads "Dated February 1st, 2024" over the signature of Lori Wing-Heier, Director of Insurance. The day is written in by hand into a blank left in the typed line, which explains the two things that made this row look unverifiable: the letterhead carries no date because the date was never typed there, and the Division's index has no date column at all. Our 1 February 2024 was right, and it is now the Division's own document saying so.

Kentucky's date is inside the bulletin after all. Page 1 carries a labelled header block, and the fourth field reads "DATE: April 16, 2024", beside BULLETIN 2024-02 and over the name of Sharon P. Clark, Commissioner. The Department's index table said the same thing, so no figure changed; what changed is that the claim is now sourced to the document itself, where before it was sourced to a table about the document. Kentucky also titles it "The Use of Artificial Intelligence Systems in the Business of Insurance", a wording the NAIC short form drops.

Neither of these needed a wall to come down. Both hosts served the file without complaint the whole time. The obstacle was a missing text layer, and the instrument for a missing text layer is an eye.

Wisconsin, because it is the row that looks wrong and is not. OCI does not number this bulletin. Its header carries four labelled fields, Date, To, From and Subject, and no number field of any kind. Date: 18 March 2025. From: Nathan Houdek, Commissioner of Insurance. Subject: The Use of Artificial Intelligence Systems in Insurance. We cite it by date and subject because that is the whole of what OCI gives it.

Hawaii, and a date we deliberately did not change. Our row says 10 December 2025. Hawaii's own page for the memorandum shows 11 December 2025, but that figure is the web page's publication timestamp, not a date printed on the memorandum. A page timestamp is not an issue date, so we left the row alone instead of "correcting" it to a number that answers a different question. West Virginia is the same trap in reverse: its URL carries ?ver=2024-08-12 while the document says "Issued: August 9, 2024". We use the document.

Four label differences, where the number and date agree. New Jersey writes "Bulletin No. 25-03", not "Insurance Bulletin No."; Rhode Island writes "Insurance Bulletin Number 2024-03"; Iowa files its as a "Commissioner's Bulletin"; Delaware's full style is "Domestic and Foreign Bulletin No. 148".

One citation we changed on the strength of this pass. Pennsylvania's Insurance Department has dropped Notice 2024-04 from its live notices page, which now lists 2024-06, -12, -14, -15 and -16 but not -04. The durable citation is the official publication, 54 Pa.B. 1910, Pennsylvania Bulletin Volume 54, Number 14, Saturday 6 April 2024, published by the Legislative Reference Bureau. That is what the row cites.

One qualification that cuts against us. The District of Columbia and Nebraska instruments both foreground the NAIC's 2020 Principles on Artificial Intelligence rather than reciting the 2023 model bulletin. The NAIC lists both as adopters and we follow the NAIC, which is why we quote the NAIC's own caveat that its map "does not reflect a determination as to whether a jurisdiction's instrument contains all elements of the model."

What this establishes and what it does not. Twenty-five of twenty-five confirmed at source means the reference list we relied on is accurate in every jurisdiction on this page: not one instrument number and not one issue date was wrong. That is a claim about the NAIC's list, and it is a good one. It is not a claim that these instruments do the thing a reader might hope they do. Every one of them governs how an insurer manages its AI systems. None of them tells an estimating model what it may output, and none mentions collision repair. A confirmed citation and a useful one are different things, and this page tries hard to sell you only the first.

What it costs to say twenty-five. Twenty-three were read by an automated reader on the issuing department's own server. Two were read by a person because the departments refuse automated readers, and those two carry a different label for that reason. If a future pass ever reports twenty-five confirmed without that distinction, the distinction was lost rather than resolved, and the number should be trusted less rather than more.

What we are not saying

We are not saying a bulletin is a law. A bulletin states a department's expectations. Adoption of the model is not enactment of a statute, and the NAIC's own map says it does not reflect a determination as to whether a jurisdiction's instrument contains all elements of the model.

We are not saying these 25 instruments are identical. We read the model bulletin. We did not read all 25 adopting instruments, so this page makes no claim about how any one of them differs from the model or from the others.

We do not claim AI estimating is prohibited anywhere here. Nothing in the model bulletin prohibits a use. It sets governance expectations and tells insurers what a regulator may ask to see.

We are not counting the 4 own-instrument jurisdictions as adopters. The NAIC lists them under a separate heading and so do we.

We are not claiming Colorado regulates collision estimating. Its regulation reaches automobile insurers and, through the statutory definition of insurance practice, their claims management. It says nothing about estimating, repair or total loss valuation, and section 10-3-1104.9(7)(b)(IV) leaves longstanding claim-settling practices alone unless they sit inside a tested algorithm. One state reaching auto claims is not fifty states reaching your estimate.

This page does not say the 22 non-adopters have AI rules. The statutes cited for them are unfair trade practices and unfair claims settlement provisions of general application. They govern an insurer whether it uses artificial intelligence or an adjuster with a clipboard. Citing them is not a claim that any of those states has acted on AI, because none of them has.

Sources

• NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers, adopted by the Executive (EX) Committee and Plenary on 4 December 2023 and by the Innovation, Cybersecurity, and Technology (H) Committee on 1 December 2023. Read in full on 18 August 2026 from content.naic.org.
• Implementation of NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers, the Big Data and Artificial Intelligence (H) Working Group's adoption map and reference list, status as of 1 April 2026. Read in full on 18 August 2026. Every row in the two adoption tables above comes from its page 2 reference list.

The authority tables are sourced separately, and not one of their citations comes from the NAIC. Each was read on the issuing state's own server. The four that could not be read in the instrument say so in the table itself. Some worth naming because getting to them took a specific route:

• Colorado. 3 CCR 702-10 from the Secretary of State's Code of Colorado Regulations, and Senate Bill 21-169 as signed from the General Assembly, both downloaded and text-extracted on 21 August 2026.
• California. Bulletin 2022-5 from the Department of Insurance, 21 August 2026. Its authority is in numbered footnotes, with no authority section.
• Arizona. Title 20, Chapter 6 of the Arizona Administrative Code from the Secretary of State, Supplement 26-1 dated 31 March 2026, R20-6-801 at printed pages 56 to 58. Read on 21 August 2026. The statute it names, A.R.S. 20-461, is behind a bot check at azleg.gov and we cite it without having read it.
• Indiana. IC 27-4-1-4.5 from the General Assembly's 2025 Indiana Code, read in a browser on 21 August 2026. A fetcher gets a 691-byte page shell, and even in a browser the text is inside a shadow root, out of the document.
• Mississippi. Eight Insurance Department regulations that print Miss. Code Ann. 83-5-35 as their source, plus a sweep of all 127 regulation PDFs on the Department's index to establish that no claims regulation exists. 21 August 2026.
• New Hampshire and Virginia. Read by a person, not by us, because both departments refuse automated readers. See the provenance section above.

• AI is grading your auto claim
• New York has required a hazardous waste line on your repair estimate since 1993
• Where to file an insurance complaint in every state
• How to read a repair estimate

General consumer information: not legal, insurance, or financial advice. Requirements, coverage, and practices vary by state, policy, and manufacturer.

Cite this dataset

This dataset is published under Creative Commons Attribution 4.0. You may republish it, including commercially, in whole or in part. The licence asks one thing in return: credit the source and link to it. Copy the line below.

"Which insurance regulators have adopted the NAIC AI model bulletin", The Autobody Directory (Quorum Industries LLC), 2026. Licensed CC BY 4.0. https://theautobodydirectory.com/guides/ai-bulletin-adoption-by-state

• Page to cite and link: https://theautobodydirectory.com/guides/ai-bulletin-adoption-by-state
• Machine-readable copy: https://theautobodydirectory.com/api/register/ai-bulletin-adoption.json
• Questions, corrections, or a figure you want checked before you publish it: see Press. We would rather be corrected than cited wrongly.

More guides