Agentic AI in insurance: roles US insurers need before an agent acts
Before an AI agent is allowed to act on a claim, a policy or a payment, a US insurer needs named owners for AI governance, model risk, agent operations, vendor oversight and audit. The NAIC’s 2023 model bulletin expects a written AI programme, and agents that act rather than draft expose every gap in ownership.
What changes when an AI agent acts instead of drafting?
An assistant drafts and a person decides. An agent decides, and a person finds out later unless someone designed it otherwise.
A generative AI assistant that summarises a medical report for a claims handler produces text; the handler reads it, corrects it and makes the call. An agent that reads the same report, sets a reserve, requests a document and schedules a payment has taken four actions, each of which used to belong to a person with a delegated authority limit.
So the question stops being “is the output accurate?” and becomes “who authorised this action, and who can stop the next one?” More model builders through analytics and AI recruitment are necessary, but on their own they produce agents faster than anyone can govern them.
Is the NAIC AI bulletin law, and which states have adopted it?
The bulletin is not law on its own. The National Association of Insurance Commissioners (NAIC) adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on 4 December 2023, and it carries weight in a state when that state’s insurance department issues it. As of 31 August 2026, the NAIC’s own implementation map showed 25 states and the District of Columbia had adopted it.
California, Colorado, New York and Texas have their own insurance specific AI rules, and a national carrier has to satisfy each. According to published legal summaries, Colorado’s amended Regulation 10-1-1 took effect on 15 October 2025 and extends governance and risk management duties to life, private passenger auto and health benefit plan insurers. A testing duty is a person who designs tests and defends them to an examiner, not a policy document.
Examiners are getting tools too. The NAIC’s AI systems evaluation tool, piloted with 12 states in 2026, was renamed the AI Risk Evaluation Supplement and, according to published legal summaries, was expected to be adopted at the Fall 2026 National Meeting.
The bulletin asks for a written AI systems programme covering governance, risk management controls and internal audit, proportionate to the risk to consumers. Read that as an organisation chart: governance needs an owner, controls need a second line, and internal audit needs people who understand how internal audit should audit AI, which is a different job from auditing a spreadsheet reserving model.
Who owns AI governance in an insurer: actuarial, compliance, data science or IT?
No single function owns it. Hand it to one and the gap opens exactly where the agent crosses a boundary: an agent in a claims workflow touches actuarial models, data science code, IT platforms and compliance rules in one transaction.
What holds up is a small AI governance function in the second line, reporting to the chief risk officer (CRO), with named owners in each business area.
Role | What they own | Why agents make it necessary |
Head of AI governance | The AI inventory, the written programme, board reporting | Nobody can govern agents they do not know are running |
AI model risk actuary | Validation of models behind pricing, reserving and underwriting | Agents act on model output directly, with no human filter |
Agent operations engineer | Permissions, action logs, rollback, the switch off procedure | Actions need limits and a record; drafts never did |
Claims or underwriting process owner | Escalation thresholds and which decisions stay human | Only the business knows which actions can be reversed |
AI compliance manager | Mapping each use case to state rules | Four states have rules beyond the bulletin |
Third party AI risk lead | Due diligence, contract terms and testing of vendor models | A bought agent carries your accountability, not the vendor’s |
AI audit lead | Independent assurance over the programme | The bulletin names internal audit explicitly |
The AI model risk actuary is the hardest seat to fill: a credential that lets you challenge a pricing model, plus enough machine learning literacy to read a validation report without taking the builder’s word for it. It is also why will AI replace actuaries has a more interesting answer than the headlines give.
Second line seats usually come through risk and financial advisory recruitment rather than technology channels, because what you are buying is challenge, not code. Anyone planning specialist recruitment in the USA for these roles should expect a thin pool: plenty of people have governed models, far fewer an agent that could spend money.
What can go wrong when an agent acts, including one you bought?
Cascading errors, unclear accountability and weak human escalation. At the NAIC Spring 2026 National Meeting, according to published legal summaries, regulators discussed exactly those agentic AI risks.
A cascading error is the one that should worry a CRO: an agent misreads one field, sets the wrong reserve and writes to the wrong customer, and every step looks reasonable to the next. Unclear accountability is a design failure: if the claims director thinks data science owns the agent, and data science thinks it built what was asked for, nobody owns the payment it just made.
The Casualty Actuarial Society (CAS) Actuarial Review has described agentic AI as a new actuarial coworker, and on 27 July 2026 the CAS released the second edition of its AI Primer with a new section on agentic AI. Is an agent just an intern you have to supervise? As a starting point, yes, except interns do not work at machine speed through the night. Decide who supervises, how many agents one person can watch, and what that means at 3am.
Vendor models do not move the problem off your desk. State regulators supervise insurers, and the bulletin is addressed to insurers and their use of AI systems, so if the agent came from a vendor the regulator still asks the carrier. The third party AI risk lead must be able to read a vendor’s testing evidence critically and refuse to sign when it is thin.
What does recruitment teach about trusting an agent?
I see the same question in my own work. AI must not replace human judgement in screening. Candidates now write CVs with the same tools recruiters use to read them, so automated matching goes wrong in both directions. Where AI earns its place is on a firm’s own data: its notes, its feedback, its record of past decisions, not an isolated CV. That is my view on hiring, and it is why I would ask any insurer the same thing about an agent: what data is it judging from, and which named person owns the decision it makes?
Frequently asked questions(FAQs)
1. Which states have adopted the NAIC AI model bulletin?
As of 31 August 2026, the NAIC’s implementation map showed 25 states and the District of Columbia had adopted the Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, which the NAIC adopted on 4 December 2023. California, Colorado, New York and Texas also have their own insurance specific AI rules.
2. Who should own AI governance at a US insurer?
A small AI governance function in the second line, usually reporting to the chief risk officer, should own the AI inventory and the written programme. Actuarial, data science, IT and compliance each own their part, with a named business owner for every agent, and internal audit gives independent assurance.
3. What does an AI model risk actuary do?
An AI model risk actuary validates the models behind pricing, reserving and underwriting decisions, including machine learning models that agents act on directly. The role combines an actuarial credential with enough technical depth to challenge data scientists on data, testing and drift, and it sits in the second line so the challenge stays independent.
4. What is the NAIC AI Risk Evaluation Supplement?
It is the renamed NAIC AI systems evaluation tool, piloted with 12 states in 2026. According to published legal summaries, it was expected to be adopted at the NAIC Fall 2026 National Meeting, giving examiners a structured way to ask insurers how their AI systems are governed, tested and monitored.
If you are building an AI governance team and want a specialist view on the brief before you go to market, Start a conversation.
Talk to us about your hiring
Get in touch-
Recruitment
MAS AI risk management guidelines: who Singapore firms should hire now
The Monetary Authority of Singapore has consulted on AI risk management guidelines but, as of September 2026, has…
Read the article -
Recruitment
Insurance and fintech hiring in Cambodia: the hardest specialist roles
The hardest hires are actuaries, AML heads with real investigative depth, risk managers ready for risk based capital,…
Read the article -
Recruitment
Hong Kong RBC in 2026: the actuarial, capital and data team you need
Hong Kong's risk based capital regime has been live since 1 July 2024, and 2026 added public disclosure…
Read the article
