Insurance AI Compliance is a Memory Problem

Insurance is among the most heavily documented businesses in the economy. A policy file, an underwriting file, a claim file and an adverse action notice exist because every decision an insurer makes must be explainable years later, to a policyholder, a court or an examiner. The industry is also regulated state by state, with market conduct examinations, unfair claims practices rules and filing requirements that each department enforces in its own way.

Artificial intelligence is entering that environment faster than the rules governing it. In the National Association of Insurance Commissioners' surveys, 88 percent of auto insurers, 70 percent of home insurers, 58 percent of life insurers and 92 percent of health insurers said they use, plan to use or plan to explore AI or machine learning models (NAIC, 2026). Those figures include intention as well as deployment, and the health and life surveys counted simpler statistical models alongside machine learning (NAIC, 2025). Read cautiously, they still describe an industry where AI is moving into underwriting, pricing, claims handling, fraud detection and customer service, each of which carries its own compliance obligations.

The regulatory response is taking shape, and it points toward a requirement that most insurers have not yet designed for. Insurers will be expected to show not only that they govern their AI, but what it did.

Compliance Has Moved From Policy to Evidence

The NAIC adopted its Model Bulletin on the use of AI by insurers in December 2023. It sets expectations for how insurers govern AI and advises them of the kind of information a department may request in an investigation or examination (NAIC, 2026). Departments adopt it state by state, which means a national carrier faces a patchwork rather than a single standard.

The next step is an examination tool. The Big Data and Artificial Intelligence Working Group has developed an evaluation instrument, since renamed the AI Risk Evaluation Supplement, to help regulators gather information in a market conduct, financial analysis or financial exam about an insurer's use of AI, its governance and risk practices, its potentially high-risk models and the data that feeds them. As of March 2026, twelve states were piloting it, and the NAIC anticipated adoption at its 2026 Fall National Meeting (NAIC, 2026). The tool is not law and its final form may change. What it shows is the direction. A governance document describes intent. An examination asks for evidence.

Third Parties Hold More of the Evidence Than Insurers Assume

The difficulty is that insurers rarely build everything themselves. In the NAIC's 2025 health survey, 55 percent of models were developed internally with third-party components, 15 percent by a third party, 13 percent with a third party and 10 percent internally. Eighty-five percent of insurers said their contracts with third parties contain no conditions limiting disclosure to regulators (NAIC, 2025). The NAIC has also formed a working group to develop a regulatory framework for third-party data and models (NAIC, 2026).

The accountability does not move with the model. An insurer remains responsible for what a vendor's model does to a claim or a rate, and a regulator will ask the insurer, not the vendor. If the record of what the model saw and decided lives in someone else's system, the insurer's ability to answer depends on someone else's cooperation.

Agents Turn the Evidence Problem Into a Memory Problem

A scoring model produces an output that can be logged. An agent works a case, and increasingly it remembers across cases. A claims agent handling a file over several weeks accumulates context about the policyholder, the loss, the documents it has seen, the corrections an adjuster made and what it concluded as a result. That memory is not a log of one decision. It is a running record about a person, used in the course of making decisions about them.

"An agent's memory is both a regulated record and the source of its improvement."

Insurers already answer questions about every other record in the file. Who can open it? Who can correct it if it is wrong? Can it be kept when it must be and deleted when it should be? Can the insurer reproduce why the agent concluded what it did? The NAIC's principles call for decision traceability and for methods of appeal and recourse related to inaccurate data (NAIC, 2025). In the health survey, only 42 percent of insurers said consumers can challenge or correct the non-FCRA data used in claims adjudication (NAIC, 2025). Practice is still catching up with the principle before agent memory has been added to the file.

Waiting for the Final Text Does Not Change the Question

The strongest objection is that the examination tool is a pilot, that adoption is uncertain, and that insurers should wait for the final version before designing anything. That is a sound position on compliance mechanics. It is a poor basis for deciding where a record lives. The questions the tool asks are the ones every examiner, privacy officer and litigator will ask whatever version is adopted. The NAIC itself notes that AI is more likely to support insurance professionals than replace them, and that human oversight remains an important part of decision-making (NAIC, 2026). A record of what the human and the agent each contributed is what makes that oversight demonstrable.

There is also a commercial reason not to wait. The record of what an agent remembered, and of how adjusters and underwriters corrected it, is the material from which the next decision is improved. An insurer that does not hold that record funds the improvement and does not keep it.

What Evidence-Grade Memory Requires

Five properties separate a record that can answer an examiner from a log that cannot. It captures what the agent saw, what it decided and what resulted, at the level of the individual case. It records the human override and the reason for it. It is linked to the claim or underwriting file it relates to. It carries a retention rule and a path for correction and deletion. And it sits inside the insurer's own boundary, in a format the insurer controls, with the custody of the record written into every vendor arrangement and a clear statement of what leaves with the insurer if the relationship ends.

None of this requires an insurer to build its own models. It requires the insurer to hold the record, the governed context the agent works from and the operating knowledge of how its book is handled.

An Insurer Should Hold the Memory Its Agents Build

This is the problem CodeNinja builds for, and the answer is Hyper Engram. Every decision an agent makes becomes part of your own record, and the next decision starts from it. Engram is decision memory that compounds learning and judgment. It records what agents saw, what they decided and what resulted, and that record becomes the governed context the system reasons over.

Agents read from it before acting and write to it after. Each entry is tied to the case it came from, so a claim or underwriting decision can be traced back to what the agent knew at the time and to the adjuster or underwriter who confirmed or overrode it. The decision improves because the history it draws on is scored and shaped by the people who own the outcome. The improvement compounds inside the insurer, where an examiner, a privacy officer or a policyholder's request for correction can reach it.

What transfers at close is specific. The decision records, the governed context, the execution environment, the repositories and the operating knowledge belong to the insurer. The engagement is judged by what the insurer ends up owning, not by the hours spent to build it.

Where to Begin

Insurers working out where their AI records live today can work with CodeNinja to establish who holds what. Own the Intelligence You Build. Start the Conversation