Most conversations about conversational AI in insurance focus on speed, cost savings, and customer experience. Fewer focus on the regulatory groundwork that has to be in place before any of that matters, and that gap is starting to catch insurers off guard. The NAIC Model Bulletin on the use of AI by insurers has moved from a proposal to active law in a growing number of states, and it changes what “deploying a chatbot” actually requires from a compliance standpoint.

Where Adoption Stands

As of mid-2026, 25 states plus the District of Columbia have formally adopted the NAIC Model Bulletin, with several more states in progress. That’s a meaningful jump from roughly a year earlier, when only 11 jurisdictions had adopted it. The trajectory is clear: this isn’t a niche regulatory experiment confined to a couple of progressive states, it’s becoming the baseline expectation across most of the country.

What the Bulletin Actually Requires

The requirements aren’t abstract principles. They’re specific operational obligations:

A written AI governance program has to exist, not just as a policy document but as something that reflects how the organization actually manages its AI systems day to day.

Decisions made or influenced by AI need documented explainability, meaning the insurer has to be able to show how the AI reached a given outcome, not just that it reached one.

Insurers are accountable for the outputs of third-party AI vendors. There’s no “the vendor’s black box did it” defense available. If a purchased chatbot platform gives a policyholder wrong information about coverage, the insurer owns that outcome from a regulatory standpoint, not the vendor.

Audit trails need to be detailed enough that a state examiner can reconstruct how a specific decision was made, after the fact, without relying on the AI vendor’s cooperation.

And for decisions that matter, meaning anything with real financial or coverage consequences for the policyholder, there needs to be a human in the loop, not full automation running unsupervised.

Why This Changes the Vendor Conversation

This has a direct, practical effect on how insurers should be evaluating conversational AI vendors. A slick demo showing a chatbot answering questions naturally is not the same as a system built with governance and audit logging from the ground up. An insurer that adopts an off-the-shelf conversational AI platform without confirming it can produce the explainability and audit trail documentation a state examiner might request is taking on regulatory risk it may not fully understand until the examiner actually asks.

The practical implication here is worth repeating because it’s easy to underweight until it becomes an actual problem: it’s considerably cheaper to build compliance into a conversational AI deployment from the design phase than to retrofit it after a state examiner asks for evidence that doesn’t exist yet. Audit trails can’t be reconstructed retroactively if the system wasn’t logging the right information from day one.

Autonomous vs. Agent-Assist: Different Regulatory Exposure

This regulatory backdrop is part of why the choice between autonomous and agent-assist conversational AI isn’t purely a technology decision, it’s a risk decision. Autonomous conversational AI interacts directly with policyholders without a human in the loop for routine interactions, which means it carries more direct regulatory exposure and needs a well-documented escalation threshold. Agent-assist conversational AI, which runs alongside a live agent and surfaces compliance prompts and next-best-action guidance while the human retains final decision authority, generally presents a lower regulatory risk profile. That’s a big part of why agent-assist tends to be the faster entry point for insurers still building out their governance processes, since the human decision-maker satisfies the human-in-the-loop requirement more straightforwardly.

The Underlying Reason for the Human-in-the-Loop Rule

It’s worth connecting this regulatory requirement back to what actually happens in practice. Independent research reviewing more than 4,500 customer reviews across app stores, Trustpilot, and the BBB found that the inability to reach a human when something went wrong increased the likelihood of a negative outcome by 29 percentage points. Regulators are essentially formalizing something the customer data already shows: automation without a working human escalation path creates real harm, whether that harm shows up as a bad review or a coverage dispute.

What Insurers Should Be Doing Now

For an insurer building or buying conversational AI, a few things follow directly from the current regulatory landscape. First, confirm what state-by-state adoption status applies to your operating footprint, since the requirements aren’t uniform everywhere yet, though the trend is toward broader adoption. Second, build the audit trail and explainability logging in from the start of any deployment, not as a later addition. Third, treat vendor accountability seriously in contract negotiations, since the insurer, not the vendor, answers to the regulator. And fourth, document escalation thresholds explicitly rather than leaving them as an informal operational practice.

None of this is a reason to avoid conversational AI. The market data shows carriers leading on AI adoption generating roughly 6.1 times the total shareholder return of laggards over five years, according to McKinsey research. But the insurers capturing that advantage are the ones treating regulatory compliance as part of the build, not a separate workstream handled after the fact.

A Compliance Checklist Worth Keeping Close

Given how quickly state adoption has moved, it’s worth insurers keeping a short, living checklist rather than treating this as a one-time review. That checklist should track which states in the company’s operating footprint have adopted the Model Bulletin, whether the current vendor contract explicitly assigns accountability for AI outputs, whether audit logging is actually capturing decision rationale in a usable format, and whether the escalation thresholds written into the system match what’s documented in the governance program. Revisiting that list every quarter is a small effort compared to the cost of discovering a gap during an actual examination.

For a more complete look at how conversational AI works technically, the use cases where it’s already delivering results, and the full regulatory picture, Xicom’s detailed article is a useful resource: https://www.xicom.biz/blog/conversational-ai-in-insurance/