NAIC Model Bulletin on AI in Insurance: What It Means for Deepfake Detection

On December 4, 2023, the National Association of Insurance Commissioners (NAIC) adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers. As of August 31, 2026, the NAIC’s implementation map shows the bulletin adopted in 25 states and the District of Columbia, with California, Colorado, New York and Texas relying on their own insurance-specific AI rules or guidance. It is the most widely adopted regulatory guidance on AI in the American insurance industry. For insurers deploying deepfake detection, it sets expectations around governance, documentation, third-party oversight and fairness that deserve careful attention.

The pressure to deploy AI-powered detection is real as synthetic media makes fabricated evidence cheaper to produce. But the regulatory framework surrounding that deployment is fragmented and still evolving.

What the NAIC Model Bulletin Expects

The Model Bulletin applies to AI systems that make or support decisions related to regulated insurance practices. It defines AI systems broadly, and it expressly recognizes AI use across the insurance lifecycle — including claim administration and payment, and fraud detection. Deepfake detection used in claims falls within its scope.

Core Principles

1. Insurer Accountability Decisions made or supported by AI must comply with existing insurance law, including unfair trade practices and unfair claims settlement practices laws. If a deepfake detection tool contributes to a legitimate claim being wrongly delayed or denied, the insurer — not the technology vendor — answers to the regulator.

2. A Written AIS Program Insurers are expected to develop, implement and maintain a written program for the responsible use of AI systems (an “AIS Program”), proportionate to the risk. For deepfake detection used in claims, that means governance covering selection, validation, deployment, monitoring and retirement.

3. Risk Management and Internal Controls The AIS Program should address the risk of adverse consumer outcomes. For deepfake detection, this includes assessing:

False positive rates and their impact on legitimate claimants
Whether performance differs across the kinds of media and claimants the insurer serves
Consequences of system failures or adversarial manipulation

4. Third-Party AI Systems and Data Where insurers use third-party AI systems or data, the bulletin expects due diligence on the provider and, where appropriate and available, contract terms that give the insurer audit rights (or qualified audit reports) and require the provider to cooperate with regulatory inquiries. Third-party systems must meet the same legal standards that apply to the insurer itself.

Documentation Regulators May Request

The bulletin notes that regulators may ask about an insurer’s AI systems during investigations and market conduct examinations. Insurers should be ready to produce:

The AIS Program and its governance and risk management documentation
A description of each AI system’s purpose and intended use
Information about data used to develop and operate the system
Testing, validation and ongoing monitoring procedures and results
Due diligence and contracts for third-party systems

For deepfake detection, this translates to keeping records of detection events, the evidence analyzed, the outcome and the human review that followed.

The State-by-State Regulatory Landscape

The Model Bulletin is not a statute. Each state decides whether to adopt it, modify it or rely on other rules.

States With Their Own Insurance AI Rules

Colorado — SB21-169 (C.R.S. 10-3-1104.9) prohibits unfair discrimination from insurers’ use of external consumer data, algorithms and predictive models across insurance practices, including claims management. Regulation 10-1-1 (3 CCR 702-10) requires governance and risk management frameworks; it took effect for life insurers in November 2023 and was extended to private passenger auto and health benefit plan insurers effective October 15, 2025. Separately, in May 2026 Colorado repealed and reenacted its 2024 AI Act as SB26-189 on automated decision-making technology, with obligations beginning January 1, 2027 for consequential decisions, including in insurance.
New York — The Department of Financial Services’ Insurance Circular Letter No. 7 (July 11, 2024) addresses AI systems and external consumer data in underwriting and pricing. It does not cover claims, but it states that insurers retain responsibility for third-party tools they use.
California — Bulletin 2022-5 (June 30, 2022) warned insurers about unfair discrimination from the use of big data and algorithms across marketing, rating, underwriting and claims practices.
Texas — Bulletin B-0036-20 (2020) is listed by the NAIC as insurance-specific AI guidance.

Examples of Adopting States

Connecticut — Adopted the bulletin as Bulletin MC-25 on February 26, 2024, and requires domestic insurers to file an annual AI certification.
Virginia — Adopted the bulletin through Administrative Letter 2024-01 on July 22, 2024. A separate, broader high-risk AI bill (HB 2094) was vetoed in 2025.
Other adopters include Alaska, Illinois, Maryland, Michigan, New Jersey, Pennsylvania, Washington and Wisconsin; Mississippi was the most recent, in July 2026.

States Without Specific AI Guidance

In states that have not adopted the bulletin, existing unfair trade practices and unfair claims settlement practices laws still apply. An insurer cannot escape responsibility for an unfair claims decision because an AI system was involved.

How Deepfake Detection Fits the Framework

A Claims Decision-Support Tool

Deepfake detection is a component of the claims investigation process. When a tool flags evidence as potentially synthetic, it can influence whether a claim is paid, investigated or denied. That matters because:

AI systems that influence claims outcomes attract closer regulatory attention
Unfair claims settlement practices rules apply to any process that could result in denial or delay
Reporting obligations may follow from what an investigation finds

Meaningful Human Review

Regulators and the bulletin emphasize human oversight of AI-supported decisions. For deepfake detection, good practice means:

AI detection results should not automatically trigger claim denial
A trained investigator reviews flagged claims before adverse action
The reviewer has the authority and information to override the AI
Documentation shows that review was substantive, not pro forma

Every detection model produces some false positives, and wrongly accusing a policyholder of fraud has serious consequences for the individual and for the insurer’s legal exposure.

Consumer Transparency

The bulletin expects insurers to consider how they inform consumers about AI use. Colorado’s SB26-189 adds notice and explanation duties for consequential decisions from 2027. For deepfake detection, this creates a tension: disclosing specific detection methods could help fraudsters evade them. Insurers need to balance transparency with operational security — explaining that evidence is reviewed with automated tools, and what a claimant can do if their evidence is questioned, without publishing detection techniques.

Compliance Checklist for AI-Powered Deepfake Detection

Governance and Accountability

Designated AI officer or committee with authority over fraud detection AI
Board-level reporting on AI system performance and incidents
Clear accountability chain from detection output to claims decision
Written AIS Program addressing deepfake detection specifically

Risk Assessment

Initial risk assessment completed for the deepfake detection system
Testing for differential performance across relevant claimant and media groups, using lawfully held data
False positive and false negative impact analysis
Adversarial robustness assessment
Periodic reassessment schedule established

Documentation

System description including purpose, methodology and limitations
Vendor documentation on model data and evaluation obtained and reviewed
Validation testing methodology and results on representative data
Detection event logs with outcomes
Human review records for flagged claims

Third-Party Vendor Management

Vendor due diligence completed (security, performance, fairness testing)
Contract terms for audit rights, regulatory cooperation, data protection and performance
Ongoing monitoring of vendor performance
Contingency plan for vendor failure or contract termination

Consumer Protection

Consumer transparency approach for AI-assisted claims review
Human review before adverse action on AI-flagged claims
Route for consumers to challenge AI-influenced decisions
Adverse action notices that address AI’s role where required

Monitoring and Reporting

Ongoing monitoring of flag rates and confirmed false positives and negatives
Drift detection for model performance degradation
Incident response plan for AI system failures
Process for responding to regulatory inquiries about AI systems

Federal Context

Insurance regulation in the US remains primarily state-based under the McCarran-Ferguson Act, but federal AI policy has shifted:

Executive Order 14110 (October 2023) on Safe, Secure, and Trustworthy AI was revoked on January 20, 2025, and replaced by a policy focused on removing barriers to AI development (Executive Order 14179)
Executive Order 14365 (December 11, 2025), “Ensuring a National Policy Framework for Artificial Intelligence,” set up a Justice Department task force to challenge state AI laws and called for federal preemption legislation. It does not address insurance specifically, and the NAIC has opposed preemption of state insurance regulation
The Treasury Department published a report on AI in financial services in December 2024, with input from the Federal Insurance Office

Insurers should monitor federal developments, but state insurance regulators remain the primary supervisors of AI in claims.

Practical Implications for Multistate Insurers

1. Adopt a common high standard. Rather than maintaining separate programs for each state, implement controls that satisfy the most demanding requirements you face. This is more work up front but simpler to maintain.

2. Build modular compliance. Design deepfake detection workflows with configurable features — consumer notices, documentation levels and human review steps that can be adjusted by jurisdiction.

3. Engage with regulators proactively. Early engagement on AI governance practices demonstrates good faith and helps shape workable expectations.

4. Monitor NAIC developments. The NAIC’s Big Data and Artificial Intelligence (H) Working Group ran a multistate pilot of its AI Systems Evaluation Tool during 2026 and has consulted on a possible AI model law, and a separate working group is developing a framework for third-party data and model vendors. None has yet produced a new model law.

The Cost of Inaction

Some insurers may delay deepfake detection to avoid regulatory complexity. That trades one risk for another. The cost of deepfake fraud is growing, and regulators expect insurers to manage emerging risks within their existing controls.

The NAIC bulletin is a framework for responsible AI use, not a prohibition. Insurers that implement deepfake detection within it protect themselves on two fronts: against fraud losses, and against regulatory criticism of how AI is used.

Conclusion

The NAIC Model Bulletin creates a clear, if demanding, set of expectations for deepfake detection: a written AIS Program, risk management, third-party oversight, documentation and consumer protection. With the bulletin now adopted in 25 states and DC, and several large states running their own regimes, multistate insurers need a single program that satisfies both.

Deepfake detection solutions designed to support regulated review workflows — with audit logs, forensic reports and human-reviewed outputs — can help teams assemble the evidence their own legal and compliance reviewers require. Request a demo to see how deetech™ fits your claims process.

This article is for informational purposes only and does not constitute legal, regulatory, or compliance advice. Insurers should consult qualified legal and compliance professionals for guidance specific to their circumstances and jurisdiction.