Rules, corpus and coverage

Rules are data: a regulator can read every predicate without a programmer. Each rule names its authority layer, its scope, its effective window and the provisions it cites. Loading fails closed if any citation is missing from the corpus. Judgment layers (precedent, doctrine) are advisory and can only add findings.

Coverage map (rules in force today, by state in the book and lifecycle stage)

State	marketing	underwriting	rating	renewal	claims	fraud	utilization review
CO	1	11	10	11	5	1	4
CT	4	8	7	8	4	4	4
NY	1	11	10	11	1	1	1
TX	3	11	10	11	7	4	5

Gap register. Decisions exist in these cells but no black-letter rule (L0–L4) covers them, only advisory doctrine; they pass by absence, and every assessment says how many rules were applied: CO · fraud NY · claims NY · utilization review

Rules (30) · version 2026.10+dbe5ddf6

L0 Federal law

Rule	Scope	Effective	Severity · contribution	Cites	Predicate
Adverse action based on a consumer report with no FCRA notice recorded us.fcra.adverse-action-notice	all states · all lines · underwriting, rating, renewal	1997-09-30	high hold	us-fcra-1681m-aus-fcra-1681a-k-1-b-i	show all: - field: inputs.consumer_report_used eq: true - field: adverse_action.is_adverse eq: true - field: adverse_action.notice_sent_at is_null: true
Consumer report used with no data source reference recorded us.fcra.permissible-purpose-undocumented	all states · all lines · underwriting, rating, renewal	1971-04-25	low flag	us-fcra-1681b-a-3-c	show all: - field: inputs.consumer_report_used eq: true - field: inputs.data_source_refs truthy: false

L1 NAIC model guidance, as adopted by the state

Rule	Scope	Effective	Severity · contribution	Cites	Predicate
Third-party AI system without an attested due-diligence and contract record naic.ais-program.third-party-diligence	states that adopted naic_ai_bulletin · all lines · all stages	2023-12-04	medium flag	naic-ai-bulletin-s3-4-third-partynaic-ai-bulletin-s4-oversight	show all: - field: ai_system.vendor eq: third_party - field: ai_system.high_risk_class ne: none - field: ai_system.governance_attested eq: false
High-risk AI system with no model documentation reference naic.ais-program.documentation	states that adopted naic_ai_bulletin · all lines · all stages	2023-12-04	low flag	naic-ai-bulletin-s4-oversightnaic-ai-bulletin-s3-1-ais-program	show all: - field: ai_system.high_risk_class ne: none - field: ai_system.model_doc_ref is_null: true
Adverse high-risk decision from a system with no adverse-outcome testing on record naic.adverse-outcome-testing	states that adopted naic_ai_bulletin · all lines · all stages	2023-12-04	medium flag	naic-ai-bulletin-s3-1-ais-programnaic-ai-bulletin-s4-oversight	show all: - field: ai_system.high_risk_class ne: none - field: adverse_action.is_adverse eq: true - field: ai_system.testing_report_ref is_null: true

L2 State statute

Rule	Scope	Effective	Severity · contribution	Cites	Predicate
Adverse outcome from an ECDIS-driven model with no unfair-discrimination testing on record co.sb169.ecdis-adverse-untested	CO · all lines · underwriting, rating, renewal, claims	2021-09-07	medium flag	co-crs-10-3-1104-9	show all: - field: inputs.ecdis_present eq: true - field: adverse_action.is_adverse eq: true - field: ai_system.testing_report_ref is_null: true
Race, color, religion or national origin used as a decision input tx.544.prohibited-basis	TX · all lines · underwriting, rating, renewal, claims	2005-04-01	critical hold	tx-ins-544-002	show field: inputs.protected_factors_used intersects: - race - color - religion - national_origin
Age, gender, marital status, geography or disability used without recorded actuarial support tx.544.protected-factor-without-actuarial-support	TX · all lines · underwriting, rating, renewal	2005-04-01	high hold	tx-ins-544-002tx-ins-544-003-b	show all: - field: inputs.protected_factors_used intersects: - age - gender - sex - marital_status - geographic_location - disability - field: inputs.actuarial_support_ref is_null: true
Credit-based adverse effect without the § 559.054 notice of reasons tx.559.credit-adverse-effect-notice	TX · auto, home, renters · underwriting, rating, renewal	2005-09-01	high hold	tx-ins-559-054tx-ins-559-001	show all: - field: inputs.credit_used eq: true - field: adverse_action.is_adverse eq: true - any: - field: adverse_action.notice_sent_at is_null: true - field: adverse_action.specific_reasons eq: false
Claim rejected or reduced without stated reasons tx.542.rejection-without-reasons	TX · all lines · claims	2005-04-01	high hold	tx-ins-542-056tx-ins-542-003	show all: - field: output.decision in: - deny - partial_pay - field: adverse_action.reasons_provided eq: false
Algorithmic denial, reduction or fraud hold with no human review tx.542.algorithmic-denial-without-human-review	TX · all lines · claims, fraud	2005-04-01	high flag	tx-ins-542-003tx-ins-542-055	show all: - field: output.decision in: - deny - partial_pay - flag - field: ai_system.high_risk_class in: - claims - fraud - field: human_involvement.reviewed eq: false
Adverse utilization-review determination without a physician's determination tx.4201.adverse-determination-by-automated-system	TX · health · utilization_review	2025-09-01	critical hold	tx-ins-4201-156tx-ins-4201-152tx-ins-4201-206tx-ins-4201-002-1c	show all: - field: output.decision eq: adverse_determination - any: - field: human_involvement.reviewed eq: false - field: human_involvement.reviewer_role ne: physician
Adverse determination without the required notice content tx.4201.adverse-determination-notice	TX · health · utilization_review	2007-04-01	high hold	tx-ins-4201-303	show all: - field: output.decision eq: adverse_determination - field: adverse_action.reasons_provided eq: false
TRAIGA applies alongside the Insurance Code where an AI system uses protected characteristics tx.traiga.ai-discrimination-context	TX · all lines · all stages	2026-01-01	info pass	tx-bcc-552-056tx-bcc-552-002tx-ins-544-002	show field: inputs.protected_factors_used truthy: true

L3 State regulation

Rule	Scope	Effective	Severity · contribution	Cites	Predicate
Life underwriting with ECDIS outside an attested governance and risk management framework (2023 regulation) co.reg-10-1-1.governance-framework	CO · life · underwriting, rating, renewal	2023-11-14 → 2025-10-14	medium flag	co-reg-10-1-1-2023-s5	show all: - field: inputs.ecdis_present eq: true - field: ai_system.governance_attested eq: false
ECDIS used outside an attested governance and risk management framework (amended Regulation 10-1-1) co.reg-10-1-1.governance-framework-amended	CO · life, auto, health · underwriting, rating, renewal, claims, utilization_review	2025-10-15	medium flag	co-reg-10-1-1-s5co-reg-10-1-1-s6	show all: - field: inputs.ecdis_present eq: true - field: ai_system.governance_attested eq: false
Third-party ECDIS model without documentation of purpose, inputs and vendor oversight co.reg-10-1-1.vendor-ecdis-documentation	CO · life, auto, health · underwriting, rating, renewal, claims, utilization_review	2025-10-15	medium flag	co-reg-10-1-1-s5co-reg-10-1-1-s5-b-vendors	show all: - field: inputs.ecdis_present eq: true - field: ai_system.vendor eq: third_party - field: ai_system.model_doc_ref is_null: true
ECDIS model with no documented testing or performance monitoring reference co.reg-10-1-1.monitoring-undocumented	CO · life, auto, health · underwriting, rating, renewal, claims, utilization_review	2025-10-15	low flag	co-reg-10-1-1-s5	show all: - field: inputs.ecdis_present eq: true - field: ai_system.testing_report_ref is_null: true

L4 Bulletin / circular letter

Rule	Scope	Effective	Severity · contribution	Cites	Predicate
Underwriting or pricing AI used without a documented disparate-impact assessment ny.cl7.disparate-impact-assessment	NY · all lines · underwriting, rating, renewal	2024-07-11	high flag	ny-dfs-cl7-2024-II-Bny-dfs-cl7-2024-II-Cny-ins-2606ny-ins-2303	show all: - any: - field: inputs.ecdis_present eq: true - field: ai_system.high_risk_class in: - underwriting - pricing - field: ai_system.testing_report_ref is_null: true
Underwriting or pricing AI outside an attested governance framework ny.cl7.governance-oversight	NY · all lines · underwriting, rating, renewal	2024-07-11	medium flag	ny-dfs-cl7-2024-III-Any-dfs-cl7-2024-III-B	show all: - field: ai_system.high_risk_class in: - underwriting - pricing - field: ai_system.governance_attested eq: false
Underwriting or pricing AI with no inventory documentation reference ny.cl7.inventory-documentation	NY · all lines · underwriting, rating, renewal	2024-07-11	low flag	ny-dfs-cl7-2024-III-B	show all: - field: ai_system.high_risk_class in: - underwriting - pricing - field: ai_system.model_doc_ref is_null: true
Third-party ECDIS or AI vendor without documented standards and audit rights ny.cl7.third-party-accountability	NY · all lines · underwriting, rating, renewal	2024-07-11	medium flag	ny-dfs-cl7-2024-III-Dny-dfs-cl7-2024-II-B	show all: - field: ai_system.vendor eq: third_party - field: ai_system.governance_attested eq: false
Adverse underwriting or pricing decision without specific reasons or disclosure of external data and AI use ny.cl7.adverse-decision-transparency	NY · all lines · underwriting, rating, renewal	2024-07-11	high hold	ny-dfs-cl7-2024-IV	show all: - field: adverse_action.is_adverse eq: true - any: - field: adverse_action.specific_reasons eq: false - all: - field: inputs.ecdis_present eq: true - field: adverse_action.ecdis_disclosed eq: false
Consequential AI-supported decision taken without a person reviewing and agreeing tx.tdi.consequential-decision-without-human-review	TX · all lines · all stages	2026-06-12	high flag	tx-tdi-b-0003-26-human-reviewtx-tdi-b-0003-26-governance	show all: - field: ai_system.high_risk_class ne: none - field: adverse_action.is_adverse eq: true - field: human_involvement.reviewed eq: false
Third-party data used with no source recorded tx.tdi.third-party-data-source-unrecorded	TX · all lines · underwriting, rating, renewal, claims	2020-09-30	low flag	tx-tdi-b-0036-20	show all: - any: - field: ai_system.vendor eq: third_party - field: inputs.consumer_report_used eq: true - field: inputs.data_source_refs truthy: false

L5 Enforcement precedent

Rule	Scope	Effective	Severity · contribution	Cites	Predicate
AI-flagged non-renewal or decline with no notice recorded (pattern of the 2026 Pennsylvania agreement) precedent.ai-flagged-cancellation-without-notice advisory	all states · all lines · underwriting, renewal	2026-05-22	medium flag	precedent-pa-geico-2026	show all: - field: output.decision in: - non_renew - decline - field: adverse_action.is_adverse eq: true - field: adverse_action.notice_sent_at is_null: true - field: ai_system.high_risk_class ne: none

L6 Doctrine (interpretive position)

Rule	Scope	Effective	Severity · contribution	Cites	Predicate
Vendor score built on prescription, credit or behavioural data should be treated as ECDIS doctrine.co.vendor-rx-score-is-ecdis advisory	CO · life, health, auto · underwriting, rating, renewal	2025-10-15	medium flag	co-reg-10-1-1-s5co-crs-10-3-1104-9	show all: - field: ai_system.vendor eq: third_party - field: inputs.feature_classes intersects: - rx_history - credit - purchasing_behavior - social_media - field: inputs.ecdis_present eq: false
Vendor score built on prescription, credit or behavioural data should be treated as ECDIS doctrine.ny.vendor-rx-score-is-ecdis advisory	NY · life, health, auto, home · underwriting, rating, renewal	2024-07-11	medium flag	ny-dfs-cl7-2024-II-Bny-dfs-cl7-2024-III-D	show all: - field: ai_system.vendor eq: third_party - field: inputs.feature_classes intersects: - rx_history - credit - purchasing_behavior - social_media - field: inputs.ecdis_present eq: false
Adverse outcome from a high-risk AI system with no human review doctrine.unreviewed-adverse-high-risk advisory	all states · all lines · all stages	2023-12-04	medium flag	naic-ai-bulletin-s3-1-ais-program	show all: - field: ai_system.high_risk_class ne: none - field: adverse_action.is_adverse eq: true - field: human_involvement.reviewed eq: false
Geography and credit used together in an adverse decision (proxy pattern to test at portfolio level) doctrine.zip-credit-interaction-proxy advisory	all states · all lines · underwriting, rating, renewal	2023-12-04	medium flag	naic-ai-bulletin-s3-1-ais-program	show all: - field: inputs.feature_classes contains: geography - field: inputs.feature_classes contains: credit - field: adverse_action.is_adverse eq: true

Corpus (39 provisions, 38 verified) · snapshot 2026-10-30-5f07c521

US

Provision	Layer	In force	Basis	Verification	Excerpt
15 U.S.C. § 1681a(k)(1)(B)(i) — 'adverse action' in connection with insurance us-fcra-1681a-k-1-b-i	L0	1997-09-30 · in force	federal statute (public domain)	verified 2026-10-30 Confirmed at law.cornell.edu.	show "a denial or cancellation of, an increase in any charge for, or a reduction or other adverse or unfavorable change in the terms of coverage or amount of, any insurance, existing or applied for, in connection with the underwriting of insurance."
15 U.S.C. § 1681b(a)(3)(C) — permissible purpose: underwriting of insurance us-fcra-1681b-a-3-c	L0	1971-04-25 · in force	federal statute (public domain)	verified 2026-10-30 Confirmed at law.cornell.edu (subsection (a) lead-in, paragraph (3) lead-in and subparagraph (C)).	show "[A]ny consumer reporting agency may furnish a consumer report under the following circumstances and no other: ... (3) To a person which it has reason to believe ... (C) intends to use the information in connection with the underwriting of insurance involving the consumer".
15 U.S.C. § 1681m(a) (FCRA § 615(a)) — duties of users taking adverse actions on the basis of a consumer report us-fcra-1681m-a	L0	1971-04-25 · in force	federal statute (public domain)	verified 2026-10-30 Paragraph structure and wording confirmed at law.cornell.edu (as restructured by Pub. L. 111-203 § 1100F); bracketed text summarises paragraph (2).	show "If any person takes any adverse action with respect to any consumer that is based in whole or in part on any information contained in a consumer report, the person shall (1) provide oral, written, or electronic notice of the adverse action to the consumer; (2) provide to the consumer written or electronic disclosure of a numerical credit score [used in taking the adverse action, with the information required by § 1681g(f)(1)]; (3) provide to the consumer orally, in writing, or electronically (A) the name, address, and telephone number of the consumer reporting agency ... that furnished the report ... and (B) a statement that the consumer reporting agency did not make the decision to take the adverse action and is unable to provide the consumer the specific reasons why the adverse action was taken; and (4) provide ... notice of the consumer's right (A) to obtain ... a free copy of a consumer report ... within 60 days ... and (B) to dispute ... the accuracy or completeness of any information in a consumer report."

NAIC

Provision	Layer	In force	Basis	Verification	Excerpt
NAIC Model Bulletin on the Use of AI Systems by Insurers (adopted 4 Dec 2023), Section 3, 1.0 General Guidelines — the written AIS Program naic-ai-bulletin-s3-1-ais-program	L1	2023-12-04 · in force	NAIC model guidance; binding in a state only as adopted (see adoptions register)	verified 2026-10-30 Confirmed against a text extract of the adopted PDF.	show "all Insurers authorized to do business in this state are expected to develop, implement, and maintain a written program (an 'AIS Program') for the responsible use of AI Systems that make, or support decisions related to regulated insurance practices. The AIS Program should be designed to mitigate the risk of Adverse Consumer Outcomes ... The Department also encourages the development and use of verification and testing methods to identify errors and bias in Predictive Models and AI Systems, as well as the potential for unfair discrimination in the decisions and outcomes resulting from the use of Predictive Models and AI Systems."
NAIC Model Bulletin (2023), Section 3, 4.0 Third-Party AI Systems and Data naic-ai-bulletin-s3-4-third-party	L1	2023-12-04 · in force	NAIC model guidance; binding in a state only as adopted (see adoptions register)	verified 2026-10-30 Confirmed against a text extract of the adopted PDF; 4.2(b) wording confirmed from the same extract.	show "Each AIS Program should address the Insurer's process for acquiring, using, or relying on (i) third-party data to develop AI Systems; and (ii) AI Systems developed by a third party, which may include, as appropriate, the establishment of standards, policies, procedures, and protocols relating to ... 4.1 Due diligence and the methods employed by the Insurer to assess the third party and its data or AI Systems ... to ensure that decisions made or supported from such AI Systems that could lead to Adverse Consumer Outcomes will meet the legal standards imposed on the Insurer itself. 4.2 Where appropriate and available, the inclusion of terms in contracts with third parties that: a) Provide audit rights and/or entitle the Insurer to receive audit reports ... b) Require the third party to cooperate with the Insurer with regard to regulatory inquiries and investigations ..."
NAIC Model Bulletin (2023), Section 4 — Regulatory Oversight and Examination Considerations naic-ai-bulletin-s4-oversight	L1	2023-12-04 · in force	NAIC model guidance; binding in a state only as adopted (see adoptions register)	verified 2026-10-30 Confirmed against a text extract of the adopted PDF.	show "in the context of an investigation or market conduct action, an Insurer can expect to be asked about its development, deployment, and use of AI Systems ... and its outcomes (including Adverse Consumer Outcomes)". Requests may cover the written AIS Program, "inventories and descriptions of Predictive Models, and AI Systems used ... to make or support decisions that can result in Adverse Consumer Outcomes", documentation for any specific model including data source, provenance, lineage and bias analysis, and "validation, testing, and auditing, including evaluation of Model Drift"; and for third-party systems, "2.1 Due diligence conducted on third parties ... 2.2 Contracts with third-party AI System, model, or data vendors ... 2.3 Audits and/or confirmation processes performed regarding third-party compliance".

TX

Provision	Layer	In force	Basis	Verification	Excerpt
Tex. Bus. & Com. Code § 552.002 (TRAIGA) — construction; Department of Insurance retains oversight of the business of insurance tx-bcc-552-002	L2	2026-01-01 · in force	state statute (government edict)	verified 2026-10-30 Confirmed from the enrolled text of H.B. 149 (effective 1 Jan 2026); the chapter number is 552, not 551.	show The chapter may not be construed to authorize any department or agency "other than the Department of Insurance to regulate or oversee the business of insurance" (summary of § 552.002(2), with the quoted phrase verbatim from the enrolled bill).
Tex. Bus. & Com. Code § 552.056 (TRAIGA) — unlawful discrimination; insurance entities addressed by the Insurance Code tx-bcc-552-056	L2	2026-01-01 · in force	state statute (government edict)	verified 2026-10-30 Confirmed from the enrolled text of H.B. 149; summarised rather than quoted because of quotation limits.	show Subsection (b): a person may not develop or deploy an artificial intelligence system with the intent to unlawfully discriminate against a protected class in violation of state or federal law. Subsection (c): a disparate impact is not sufficient by itself to demonstrate an intent to discriminate. Subsection (d): the section does not apply to an insurance entity for purposes of providing insurance services if the entity is subject to applicable statutes regulating unfair discrimination, unfair methods of competition, or unfair or deceptive acts or practices related to the business of insurance; "insurance entity" includes a developer of an AI system used by such an entity (summary of the enrolled text).
Tex. Ins. Code § 4201.002(1-c) — 'automated decision system' (utilization review) tx-ins-4201-002-1c	L2	2025-09-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov; added by S.B. 815, 89th Leg., eff. 1 Sept 2025.	show "(1-b) 'Artificial intelligence system' means any machine learning-based system that, for any explicit or implicit objective, infers from the inputs the system receives how to generate outputs, including content, decisions, predictions, and recommendations, that can influence physical or virtual environments. (1-c) 'Automated decision system' means an algorithm, including an algorithm incorporating an artificial intelligence system, that uses data-based analytics to make, suggest, or recommend certain determinations, decisions, judgments, or conclusions."
Tex. Ins. Code § 4201.152 — utilization review under the direction of a physician tx-ins-4201-152	L2	2007-04-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov; last amended by H.B. 3812 (2025), eff. 1 Sept 2025.	show "A utilization review agent shall conduct utilization review under the direction of a physician licensed to practice medicine in this state. The physician may not hold a license to practice administrative medicine under Section 155.009, Occupations Code."
Tex. Ins. Code § 4201.156 — use of automated decision system for adverse determinations (S.B. 815, 2025) tx-ins-4201-156	L2	2025-09-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov; added by Acts 2025, 89th Leg., ch. 989 (S.B. 815), eff. 1 Sept 2025; the enrolled bill applies the amended chapter to utilization review for plans delivered, issued or renewed on or after 1 Jan 2026.	show "(a) A utilization review agent may not use an automated decision system to make, wholly or partly, an adverse determination. (b) The commissioner may audit and inspect at any time a utilization review agent's use of an automated decision system for utilization review. (c) This section does not prohibit the use of an algorithm, artificial intelligence system, or automated decision system for administrative support or fraud-detection functions."
Tex. Ins. Code § 4201.206 — opportunity to discuss treatment with a physician before an adverse determination tx-ins-4201-206	L2	2007-04-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov.	show "(a) Subject to Subsection (b) and the notice requirements of Subchapter G, before an adverse determination is issued by a utilization review agent who questions the medical necessity, the appropriateness, or the experimental or investigational nature of a health care service, the agent shall provide the health care provider who ordered, requested, provided, or is to provide the service a reasonable opportunity to discuss with a physician licensed to practice medicine in this state the patient's treatment plan and the clinical basis for the agent's determination."
Tex. Ins. Code § 4201.303 — adverse determination: contents of notice tx-ins-4201-303	L2	2007-04-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov; subsection (a)(3) as amended by S.B. 815, eff. 1 Sept 2025.	show "(a) Notice of an adverse determination must include: (1) the principal reasons for the adverse determination; (2) the clinical basis for the adverse determination; (3) a description of and the source of the screening criteria and review procedures used as guidelines in making the adverse determination; and (4) a description of the procedure for the complaint and appeal process, including notice to the enrollee of the enrollee's right to appeal an adverse determination to an independent review organization and of the procedures to obtain that review."
Tex. Ins. Code § 542.003 — unfair claim settlement practices prohibited tx-ins-542-003	L2	2005-04-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov; added by Acts 2003, 78th Leg., ch. 1274, eff. 1 April 2005.	show "(a) An insurer engaging in business in this state may not engage in an unfair claim settlement practice. (b) Any of the following acts by an insurer constitutes unfair claim settlement practices: ... (3) failing to adopt and implement reasonable standards for the prompt investigation of claims arising under the insurer's policies; (4) not attempting in good faith to effect a prompt, fair, and equitable settlement of a claim submitted in which liability has become reasonably clear ..."
Tex. Ins. Code § 542.055 — receipt of notice of claim (15-day acknowledgement) tx-ins-542-055	L2	2005-04-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov.	show "Not later than the 15th day or, if the insurer is an eligible surplus lines insurer, the 30th business day after the date an insurer receives notice of a claim, the insurer shall: (1) acknowledge receipt of the claim; (2) commence any investigation of the claim; and (3) request from the claimant all items, statements, and forms that the insurer reasonably believes, at that time, will be required from the claimant."
Tex. Ins. Code § 542.056 — notice of acceptance or rejection of claim; reasons for rejection tx-ins-542-056	L2	2005-04-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov.	show "(a) Except as provided by Subsection (b) or (d), an insurer shall notify a claimant in writing of the acceptance or rejection of a claim not later than the 15th business day after the date the insurer receives all items, statements, and forms required by the insurer to secure final proof of loss. ... (c) If the insurer rejects the claim, the notice required by Subsection (a) or (b) must state the reasons for the rejection."
Tex. Ins. Code § 544.002 — unfair discrimination (prohibited bases) tx-ins-544-002	L2	2005-04-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov; added by Acts 2003, eff. 1 April 2005.	show "(a) A person may not refuse to insure or provide coverage to an individual, refuse to continue to insure or provide coverage to an individual, limit the amount, extent, or kind of coverage available for an individual, or charge an individual a rate that is different from the rate charged to other individuals for the same coverage because of the individual's: (1) race, color, religion, or national origin; (2) age, gender, marital status, or geographic location; or (3) disability or partial disability."
Tex. Ins. Code § 544.003(b) — exception: sound underwriting or actuarial principles tx-ins-544-003-b	L2	2005-04-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov.	show "(b) A person does not violate Section 544.002(a)(2) or (3) if the refusal, limitation, or charge is based on sound underwriting or actuarial principles reasonably related to actual or anticipated loss experience."
Tex. Ins. Code § 544.052 — unfair discrimination between individuals of the same class and hazard tx-ins-544-052	L2	2005-04-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov; § 544.053(a) excepts actions based on sound actuarial principles.	show "A person may not in any manner engage in unfair discrimination or permit unfair discrimination between individuals of the same class and of essentially the same hazard, including unfair discrimination in: (1) the amount of premium, policy fees, or rates charged for a policy or contract of insurance; (2) the benefits payable under a policy or contract of insurance; or (3) any of the terms or conditions of a policy or contract of insurance."
Tex. Ins. Code § 559.001(1) — 'adverse effect' (credit information in personal lines) tx-ins-559-001	L2	2005-09-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov; chapter applies to insurers writing personal insurance that use credit information (§ 559.002).	show "'Adverse effect' means an action taken by an insurer in connection with the underwriting of insurance for a consumer that results in the denial of coverage, the cancellation or nonrenewal of coverage, or the offer to and acceptance by a consumer of a policy form, premium rate, or deductible other than the policy form, premium rate, or deductible for which the consumer specifically applied."
Tex. Ins. Code § 559.052 — prohibited uses of credit information tx-ins-559-052	L2	2005-09-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov.	show "(a) An insurer may not: (1) use a credit score that is computed using factors that constitute unfair discrimination; (2) deny, cancel, or nonrenew a policy of personal insurance solely on the basis of credit information without considering any other applicable underwriting factor independent of credit information; or (3) take an action that results in an adverse effect against a consumer because the consumer does not have a credit card account without considering any other applicable factor independent of credit information."
Tex. Ins. Code § 559.054 — notice of action resulting in adverse effect (credit report) tx-ins-559-054	L2	2005-09-01 · in force	state statute (government edict)	verified 2026-10-30 Verbatim from statutes.capitol.texas.gov; amended by Acts 2025, 89th Leg., ch. 848 (S.B. 1644), eff. 1 Sept 2025.	show "(a) If, based in whole or in part on information contained in a credit report, an insurer takes an action resulting in an adverse effect with respect to an applicant for insurance coverage or insured, the insurer shall provide to the applicant or insured within 30 days: (1) written or electronic notice of the action resulting in an adverse effect and the reasons for that action; (2) the name, address, and telephone number of the consumer reporting agency ...; (3) ... notice that the consumer reporting agency did not make the decision ...; (4) ... notice of the applicant's or insured's right to: (A) obtain a free copy of the consumer's credit report ... during the 60-day period after the date of the notice; and (B) dispute ... the accuracy or completeness of any information ... (b) In the notice described by Subsection (a)(1), an insurer shall include a description of not more than four factors that were the primary influences of the action resulting in the adverse effect. (c) The use by an insurer of a generalized term such as 'poor credit history,' 'poor credit rating,' or 'poor credit score' does not constitute sufficient notice under this section ..."
TDI Commissioner's Bulletin B-0003-26 (12 June 2026) — governance, procedures on request, and monitoring tx-tdi-b-0003-26-governance	L4	2026-06-12 · in force	regulatory bulletin addressed to all regulated entities and their agents (government edict)	verified 2026-10-30 Quoted phrases confirmed on tdi.texas.gov.	show "All regulated entities using AI should be able to furnish procedures and protections upon request by TDI." TDI "will monitor the use of AI through examinations and product filings", will investigate consumer complaints about AI, and may inquire into governance frameworks, risk management, data and privacy protections, internal controls and specific uses of AI. Under Insurance Code chapter 4201, utilization review agents may not use AI to make an adverse determination.
TDI Commissioner's Bulletin B-0003-26 (12 June 2026), Use of Artificial Intelligence — human review of consequential decisions tx-tdi-b-0003-26-human-review	L4	2026-06-12 · in force	regulatory bulletin addressed to all regulated entities and their agents (government edict)	verified 2026-10-30 Quoted phrases confirmed on tdi.texas.gov (bulletin dated 12 June 2026; page last updated 16 July 2026).	show "TDI expects a person to review and agree with all decisions before action is taken" on consequential decisions made or supported by AI; decisions must not be "inaccurate, arbitrary, capricious, or unfairly discriminatory"; "These expectations extend to any third party working with a regulated entity." The bulletin cites Insurance Code chapters 541, 542, 544, 560, 751, 401, 831, 4001, 4101 and 4201.
TDI Commissioner's Bulletin B-0036-20 (30 Sept 2020) — insurers' use of third-party data tx-tdi-b-0036-20	L4	2020-09-30 · in force	regulatory bulletin addressed to all regulated entities and their agents (government edict)	verified 2026-10-30 Quoted phrases confirmed on tdi.texas.gov; listed by the NAIC adoption map as Texas's insurance-specific guidance.	show Regulated entities "are responsible for the accuracy of the data used in rating, underwriting, and claims handling", "even if the data is provided by a third party"; "TDI may pursue enforcement action against an insurer if its use of inaccurate data harms policyholders"; "Insurers are encouraged to provide policyholders with a way to review and correct data being used by the insurer." The bulletin states it does not create a new legal duty.

CO

Provision	Layer	In force	Basis	Verification	Excerpt
C.R.S. § 10-3-1104.9 (S.B. 21-169) — unfair discrimination through external consumer data, algorithms and predictive models co-crs-10-3-1104-9	L2	2021-09-07 · in force	state statute (government edict)	verified 2026-10-30 Quoted from FindLaw's reproduction of C.R.S. § 10-3-1104.9 (current to 1 Jan 2025); subsection (1)(b) summarised in brackets. Signed act: leg.colorado.gov bill SB21-169 (signed 6 July 2021, effective 7 Sept 2021). Quote the official C.R.S. text before filing anything with the Division.	show "[A]n insurer shall not, with regard to any insurance practice: (a) Unfairly discriminate based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression; or (b) [use any external consumer data and information source, algorithm or predictive model in a way that unfairly discriminates, as defined by rules adopted by the commissioner]." Subsection (3)(a) directs the commissioner to "adopt rules for specific types of insurance, by insurance practice" establishing means by which an insurer "may demonstrate, to the extent practicable, that it has tested whether its use" of such sources or models unfairly discriminates; subsection (3)(b) requires insurers to "establish and maintain a risk management framework or similar processes or procedures" and to "provide an attestation by one or more officers that the insurer has implemented the risk management framework". Subsection (8) defines an external consumer data and information source as "a data or an information source that is used by an insurer to supplement traditional underwriting" and defines unfair discrimination to include use that "results in a disproportionately negative outcome for such classification or classifications" beyond what is justified.
3 CCR 702-10, Regulation 10-1-1 (as adopted 2023), § 5 — governance and risk management framework for life insurers' use of ECDIS co-reg-10-1-1-2023-s5	L3	2023-11-14 → 2025-10-14 · in force	state regulation (government edict); superseded by the amended regulation effective 15 Oct 2025	pending The 2023 text was superseded; the amended text (below) is verified. The Secretary of State history line confirms "New regulation effective November 14, 2023."	show Life insurers using external consumer data and information sources, or algorithms and predictive models that use them, must establish a risk-based governance and risk management framework with documented governing principles, board oversight, senior management accountability, a cross-functional governance group, documented policies and procedures, an up-to-date inventory with version control, documented testing and ongoing monitoring, and documented vendor selection (summary of the 2023 text).
3 CCR 702-10, Regulation 10-1-1 (amended, effective 15 Oct 2025), § 5.A — governance and risk management framework (life, private passenger auto, health benefit plans) co-reg-10-1-1-s5	L3	2025-10-15 · in force	state regulation (government edict)	verified 2026-10-30 Quoted from the Secretary of State CCR text (rule version 12182); components 1–5 quoted, 6–14 summarised from the same text. History line: "Amended regulation effective October 15, 2025."	show Applies to insurers offering individually issued life insurance, private passenger automobile insurance and health benefit plans. "Insurers ... that use ECDIS, as well as algorithms and predictive models that use ECDIS in any insurance practice, must establish a risk-based governance and risk management framework that facilitates and supports policies, procedures, systems, and controls designed to determine whether the use of such ECDIS, algorithms, and predictive models potentially result in unfair discrimination with respect to race and remediate unfair discrimination, if detected through quantitative testing requirements established by the Division." Required components include documented governing principles (1), board or board-committee oversight (2), senior management accountability with "regular reporting to senior management on the performance and potential risks" (3), a documented cross-functional governance group (4), for health plans a provider "ultimately responsible for the decisions" when ECDIS-based tools inform denials or modifications (5), documented policies and procedures (6), complaint and inquiry processes (7), risk assessment (8), a "documented up-to-date inventory, including version control" (9), explanation of material inventory changes (10), a "documented description of quantitative testing conducted pursuant to requirements established by the Division" (11), ongoing performance monitoring "accounting for model drift" (12), documented vendor selection (13) and annual reviews (14).
3 CCR 702-10, Regulation 10-1-1 (amended), § 5.B — responsibility for vendors and external resources co-reg-10-1-1-s5-b-vendors	L3	2025-10-15 · in force	state regulation (government edict)	verified 2026-10-30 Summarised from the Secretary of State CCR text (rule version 12182).	show The insurer remains responsible for the ECDIS, algorithms and predictive models it obtains from vendors or other external resources, must document its vendor selection and oversight, and vendors may produce documents directly to the Division (summary of § 5.B).
3 CCR 702-10, Regulation 10-1-1 (amended), § 6 — reporting requirements and officer attestation co-reg-10-1-1-s6	L3	2025-10-15 · in force	state regulation (government edict)	verified 2026-10-30 Dates and quoted phrase from the Secretary of State CCR text (rule version 12182).	show Insurers using ECDIS must submit a narrative progress report (life: 1 June 2024; private passenger auto and health: 1 December 2025) and, annually, "a report summarizing compliance with the requirements in Section 5 and the title and qualifications of each individual responsible for ensuring compliance" (life: 1 December 2024 and annually; auto and health: 1 July 2026 and annually), signed by an officer attesting to compliance, filed through SERFF; insurers not using ECDIS file an officer attestation to that effect.

NY

Provision	Layer	In force	Basis	Verification	Excerpt
NY DFS Insurance Circular Letter No. 7 (11 July 2024), § II.B — unfair and unlawful discrimination ny-dfs-cl7-2024-II-B	L4	2024-07-11 · in force	regulatory guidance interpreting N.Y. Insurance Law (government edict)	verified 2026-10-30 Section lettering and paragraph content confirmed on dfs.ny.gov.	show An insurer should not use ECDIS or AIS for underwriting or pricing unless it has determined that the data source or model does not use or is not based on a protected class and does not result in unfair or unlawful discrimination; the insurer remains responsible when it relies on a vendor and "may not rely solely on a third-party's claim of non-discrimination"; the comprehensive assessment proceeds in three steps: whether the use produces a disproportionate adverse effect on a protected class, whether a legitimate, lawful and fair rationale exists, and whether a less discriminatory alternative is available (summary of paragraphs 13–15).
NY DFS Insurance Circular Letter No. 7 (2024), § II.C — analyzing for unfair or unlawful discrimination (testing before production and on a regular cadence) ny-dfs-cl7-2024-II-C	L4	2024-07-11 · in force	regulatory guidance interpreting N.Y. Insurance Law (government edict)	verified 2026-10-30 Section lettering and paragraph content confirmed on dfs.ny.gov.	show Insurers should document the testing methods and analysis, commensurate with the use, complexity and materiality of the AIS, and make them available to the Department on request; testing should occur before an AIS is put into production, on a regular cadence afterwards and following material changes; acceptable metrics include adverse impact ratios, denial odds ratios, marginal effects, standardized mean differences and the drivers of disparity; the insurer should be able to explain "at all times" how its AIS operates (summary of paragraphs 16–19).
NY DFS Insurance Circular Letter No. 7 (2024), § III.A — board and senior management oversight ny-dfs-cl7-2024-III-A	L4	2024-07-11 · in force	regulatory guidance interpreting N.Y. Insurance Law (government edict)	verified 2026-10-30 Confirmed on dfs.ny.gov.	show The board of directors sets oversight and risk appetite for the use of ECDIS and AIS, may delegate duties and should receive timely and relevant reporting; senior management is responsible for day-to-day implementation, including "overseeing model risk management" (summary of paragraphs 21–24).
NY DFS Insurance Circular Letter No. 7 (2024), § III.B — policies, procedures and documentation (including the AIS inventory) ny-dfs-cl7-2024-III-B	L4	2024-07-11 · in force	regulatory guidance interpreting N.Y. Insurance Law (government edict)	verified 2026-10-30 Confirmed on dfs.ny.gov.	show Written policies should be reviewed at least annually; documentation should cover the AIS inventory (including systems in development or recently retired), how each AIS operates (inputs, sources, purpose, usage, restrictions, risks), change tracking with rationale and approvers, monitoring including policy exceptions, and annual output testing including drift; consumer complaint procedures with records available to the Department (summary of paragraphs 25–30).
NY DFS Insurance Circular Letter No. 7 (2024), § III.D — third-party vendors ny-dfs-cl7-2024-III-D	L4	2024-07-11 · in force	regulatory guidance interpreting N.Y. Insurance Law (government edict)	verified 2026-10-30 Confirmed on dfs.ny.gov.	show Insurers remain responsible for understanding the ECDIS and AIS they obtain from third parties and for ensuring they comply with applicable law; insurers should adopt written standards for acquiring and using vendor ECDIS and AIS, procedures for reporting and correcting bad data, and, where appropriate, contract terms providing audit rights and vendor cooperation with regulatory inquiries (summary of paragraphs 35–37).
NY DFS Insurance Circular Letter No. 7 (2024), § IV — transparency: disclosure and notice of adverse underwriting or pricing decisions ny-dfs-cl7-2024-IV	L4	2024-07-11 · in force	regulatory guidance interpreting N.Y. Insurance Law §§ 3425, 3426 and 4224 (government edict)	verified 2026-10-30 Confirmed on dfs.ny.gov.	show Notices should state whether AIS is used, whether external vendor data is used, and the right to request information about the specific data behind the decision; adverse decision reasons should include details about all information relied on, including its source; an insurer may not cite a vendor's proprietary algorithms to avoid specificity (summary of paragraphs 38–41, which cite Insurance Law §§ 3425, 3426 and 4224(a)(2), (b)(2)).
N.Y. Insurance Law § 2303 — rates shall not be excessive, inadequate or unfairly discriminatory ny-ins-2303	L2	1984-09-01 · in force	state statute (government edict)	verified 2026-10-30 Confirmed at nysenate.gov (Insurance Law Article 23, § 2303).	show "Rates shall not be excessive, inadequate, unfairly discriminatory, destructive of competition or detrimental to the solvency of insurers. In determining whether rates comply with the foregoing standards, the superintendent shall include all income earned by such insurer ... on all its investments of any kind and wherever located. ..."
N.Y. Insurance Law § 2606 — discrimination because of race, color, creed, national origin or disability ny-ins-2606	L2	1984-09-01 · in force	state statute (government edict)	verified 2026-10-30 Confirmed at nysenate.gov (Insurance Law Article 26, § 2606(a)).	show "(a) Except as provided in section one thousand one hundred eight of this chapter, no individual or entity subject to the supervision of the superintendent shall because of race, color, creed, national origin, or disability: (1) Make any distinction or discrimination between persons as to the premiums or rates charged for insurance policies or in any other manner whatever. (2) Demand or require a greater premium from any persons than it requires at that time from others in similar cases. (3) Make or require any rebate, discrimination or discount upon the amount to be paid or the service to be rendered on any policy. ..."

PRECEDENT

Provision	Layer	In force	Basis	Verification	Excerpt
Pennsylvania Attorney General agreement with GEICO (announced May 2026) — AI-enabled underwriting review and cancellation without adequate notice precedent-pa-geico-2026	L5	2026-05-22 · in force	enforcement precedent reported by secondary sources; persuasive only	verified 2026-10-30 Attorney General's release of 22 May 2026 (attorneygeneral.gov/?p=33518, blocked to automated retrieval) as reported by Insurance Journal, 26 May 2026; the agreement text itself was not obtained.	show Announced by Pennsylvania Attorney General Dave Sunday on 22 May 2026: a new policyholder in West Philadelphia was selected by an underwriting-review tool with artificial-intelligence features during the insurer's 60-day review of new policyholders and lost coverage without realising it after believing she had sent the requested residency documents. GEICO agreed to act in line with the Pennsylvania Insurance Department's guidance on insurers' use of AI, to extend the document-submission period for selected new policyholders by one week, to accept one form of residency verification (a current driver's licence suffices when its address matches the policy), and to train customer-service staff on the revised requirements. No admission of wrongdoing; no monetary term reported.

Adoption register

NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers (adopted by the NAIC 4 December 2023)

Adoption dates are those on the NAIC implementation map (status as of 8 October 2026).

State	Instrument	Adopted	Source
AK	Alaska Bulletin B 24-01	2024-02-01	source
AR	Arkansas Bulletin 13-2024	2024-07-31	source
CT	Connecticut Bulletin No. MC-25 (annual AI certification due 1 September)	2024-02-26	source
DC	District of Columbia Bulletin 24-IB-002-05/21	2024-05-21	source
DE	Delaware Domestic and Foreign Bulletin No. 148	2025-02-05	source
HI	Hawaii Insurance Commissioner Memorandum No. 2025-13A	2025-12-10	source
IA	Iowa Insurance Division Bulletin 24-04	2024-11-07	source
IL	Illinois Company Bulletin 2024-08	2024-03-13	source
KY	Kentucky Bulletin No. 2024-02	2024-04-16	source
MA	Massachusetts Bulletin No. 2024-10	2024-12-09	source
MD	Maryland Bulletin No. 24-11	2024-04-22	source
MI	Michigan Bulletin 2024-20-INS	2024-08-07	source
MS	Mississippi Bulletin 2026-9	2026-07-22	source
NC	North Carolina Bulletin No. 24-B-19	2024-12-18	source
ND	North Dakota Bulletin 2026-2	2026-10-05	source
NE	Nebraska Insurance Guidance Document No. IGD-H1	2024-06-11	source
NH	New Hampshire Bulletin Docket INS 24-011-AB	2024-02-20	source
NJ	New Jersey Insurance Bulletin No. 25-03	2025-02-11	source
NV	Nevada Bulletin 24-001	2024-02-23	source
OK	Oklahoma Bulletin No. 2024-11	2024-11-14	source
PA	Pennsylvania Insurance Notice 2024-04, 54 Pa.B. 1910	2024-04-06	source
PR	Puerto Rico CN-2026-382-D	2026-06-11	source
RI	Rhode Island Insurance Bulletin No. 2024-03	2024-03-15	source
SC	South Carolina Bulletin 2026-07	2026-09-24	source
VA	Virginia Administrative Letter 2024-01	2024-07-22	source
VT	Vermont Insurance Bulletin No. 229	2024-03-12	source
WA	Washington Technical Assistance Advisory 2024-02	2024-04-22	source
WI	Wisconsin Insurance Bulletin	2025-03-18	source
WV	West Virginia Insurance Bulletin No. 24-06	2024-08-09	source

State insurance-specific AI regulation or guidance other than the NAIC bulletin (per the NAIC map plus Texas B-0003-26)

Recorded for context; these are modelled as provisions in the corpus, not as bulletin adoptions.

State	Instrument	Adopted	Source
CA	California Bulletin 2022-5	2022-06-30	source
CO	3 CCR 702-10, Regulation 10-1-1 (amended effective 15 Oct 2025)	2023-11-14	source
NY	Insurance Circular Letter No. 7 (2024)	2024-07-11	source
TX	TDI Bulletin B-0003-26 (Use of Artificial Intelligence); earlier B-0036-20 (third-party data, 30 Sept 2020)	2026-06-12	source

NAIC AI Risk Evaluation Supplement pilot (formerly the AI Systems Evaluation Tool), March–September 2026

Pilot participation is not law; it is recorded so exam packs can be shaped to a pilot state's reading of the exhibits. Source: NAIC Pilot Project Summary and Big Data and AI (H) Working Group materials.

State	Instrument	Adopted	Source
CA	pilot state	2026-03-02	source
CO	pilot state	2026-03-02	source
CT	pilot state	2026-03-02	source
FL	pilot state	2026-03-02	source
IA	pilot state	2026-03-02	source
LA	pilot state	2026-03-02	source
MD	pilot state	2026-03-02	source
PA	pilot state	2026-03-02	source
RI	pilot state	2026-03-02	source
VA	pilot state	2026-03-02	source
VT	pilot state	2026-03-02	source
WI	pilot state	2026-03-02	source