AI Systems Evaluation Tool 2.0 - Exhibit B - AI Systems Governance Risk Assessment Framework（Narrative）

Aug 31, 2026

AI Systems Evaluation Tool 2.0 provides optional exhibit questionnaires and frameworks for state regulators to identify, assess, and govern risks related to insurers’ use of artificial intelligence and machine learning. The materials support ongoing risk identification that covers both financial and consumer risks, while emphasizing adequate oversight, effective controls, and compliance with relevant laws. Exhibit B (Narrative) collects the company’s AI governance framework, including risk identification, mitigation, internal controls, third-party reliance, human-in-the-loop supervision, and information integrity for financial reporting.

LanguageEnglish

CategoryForms

FormatDOCX

Pages19

Reading Time7 min

AccessFree to download

Background

Intent

Sections of the Tool

Exhibit B: AI Systems Governance Risk Assessment Framework (Two Options: Narrative or Checklist)

Instructions

Company Instructions

Regulator Instructions

Materiality and Risk Assessment

Confidentiality

Which Exhibit to Use?

Artificial Intelligence Systems Evaluations Optional Supplemental Exhibits for State Regulators Background: The rapid expansion of big data and adoption of Artificial Intelligence and Machine Learning (AI systems) is significantly transforming insurance practices. These technologies can offer substantial benefits to both insurance companies and consumers by facilitating the development of innovative products, improving customer interface and enhancing service, simplifying and automating processes, and promoting efficiency and accuracy. However, without robust governance and effective controls, the use of AI systems may lead to adverse consumer outcomes unintended consumer harm or compromise the financial soundness of an insurance company. Insurers are responsible for managing the risks associated with the development and implementation of AI systems and must demonstrate to regulators that adequate oversight mechanisms are in place and are functioning effectively. Intent: The NAIC’s Innovation, Cybersecurity and Technology (H) Committee charged the Big Data and AI Working Group (BDAIWG) to create tool(s) that would enable regulators to identify and assess AI systems’ related risks on an on-going basis with a scope that considers both financial and consumer risks evolving specifically from company’s use of AI systems to the extent such risks can be parsed from the comprehensive structure. This document and related tools are designed to supplement existing market conduct, product review, form filing, financial analysis, and financial examination review procedures. As this tool supplements existing NAIC resources, regulators should continue to consider existing NAIC resources as authoritative but may consider drawing from this tool to assist in understanding and assessing a company’s use of AI systems. These optional exhibits allow regulators to determine the extent of AI systems usage for a company and whether additional analysis is needed focusing on financial and consumer risk. Sections of the Tool include: Exhibit A: Quantify Regulated Entity’s Use of AI Systems Exhibit B: AI Systems Governance Risk Assessment Framework (Two Options: Narrative or Checklist) Exhibit C: AI Systems High-Risk Model Details Exhibit D: AI Systems Model Data Details Instructions: Information obtained from the Exhibit submission may supplementing guidance and tools used during an existing market conduct, product review, form filing, financial analysis, and financial examination review, may to enhance the regulator’s understanding of the AI systems utilization and assessment of risk across an insurance company in performing the analysis and examination reviews. The pace of innovation will vary, and the insurers’ AI philosophy is to be contemplated when considering the frequency of updates which may vary from an annual to a quarterly basis as risk assessment warrants. Effective assessment requires regulators to maintain a fluent understanding and application of the applicable laws including those pertaining to unfair trade practices, confidentiality, and financial reporting. Regulators using the tool may wish to first use Exhibit A and based on the information provided, determine if further inquiry is necessary. It may be possible that company responses indicate that while the company responding is using AI, its use of AI is so limited or low in inherent risk as to not require further inquiry as contemplated by subsequent exhibits. If information requested through the tool has already been provided to this department or any other state department of insurance, the company’s response should so state and reference when and how the information was provided. The tool responses will be considered by regulators when identifying the inherent risks of the insurer. They should also affect the planned examination or inquiry approach, as well as the nature, timing and extent of any further procedures performed. Materiality and Risk Assessment Exhibit C of this t

FAQs

What is Exhibit B (Narrative) designed to collect from an insurer?

It is designed to obtain the insurer’s AI governance framework, including risk identification, mitigation, management, internal controls, and the process for acquiring, using, or relying on third-party AI systems and data.

How should regulators decide whether additional inquiry is needed after using the tool?

Regulators should begin with Exhibit A and use the information provided to determine whether further inquiry is necessary, especially when company responses indicate low or limited inherent risk.

What governance topics are covered in Exhibit B (Narrative)?

Exhibit B focuses on risk identification and classification, mitigation for adverse consumer outcomes, development of models, human-in-the-loop supervision, and efforts to maintain compliance and the integrity of financial reporting and control integrity.

Aug 31, 2026

Upload by Maya Linwood