NAIC's Big Data and Artificial Intelligence Working Group has exposed the AI Risk Evaluation Supplement version 5.0 for comment, with the current comment window closing on 29 September 2026. The Working Group page says the supplement follows the 31 August 2026 meeting and is meant to support written feedback before the next public discussion on 8 October.
This is a governance and compliance story because the insurance AI conversation is moving from principles into examinable evidence. The supplement is not a new law, and it has not been adopted as a final national standard. Its practical signal is narrower and more useful: state insurance regulators are shaping a structured way to ask insurers what AI systems they run, how those systems are governed, and what documents back the answers.
What changed
NAIC frames the work as part of regulator support for AI systems evaluation. The page lists 2026 charges that include monitoring AI regulatory activity, supporting adoption of the Model Bulletin on the Use of AI Systems by Insurers, and developing tools or guidance that help regulators review AI systems used by licensees.
Version 5.0 sits in that operating path. The exposure notice says it is open for written comments and includes a summary of changes from version 4.0. Independent legal analysis from McDermott says the renamed supplement is nearing completion as a practical examination framework and that the 30-day comment period ends on 29 September. That corroborates the timing while preserving the key caveat: the document is still an exposure draft.
Why insurers should care
For insurers, the control burden is not only whether a model is called AI. It is whether the organization can produce a current inventory, explain where AI affects consumers or financial results, identify owners, show governance review, and connect each answer to source documents.
That matters for agentic AI as much as for traditional models. An insurer using AI assistants, underwriting tools, claims automation, fraud detection, call-center copilots or vendor models needs a record of what the system does, which data it uses, how humans oversee it, which policies apply and what evidence proves monitoring is current.
Maetra's AI compliance evidence checklist uses the same operating lens. The useful artifact is not a one-time policy. It is a living control record that links system inventory, owner, framework obligation, evidence item, review date and freshness state.
What remains uncertain
The NAIC page does not say version 5.0 has been adopted. It points to a comment process and an upcoming public meeting. Organizations should not describe it as a binding nationwide AI examination rule.
There is also state variation. A regulator may use NAIC material differently from another state, and insurers still need counsel for the exact jurisdiction, line of business and use case. The supplement should be read as a practical signal about the evidence regulators may ask for, not as a self-executing duty.
Maetra analysis
The important shift is from AI governance language to AI governance proof. A mature insurer should be able to answer four questions quickly: where AI is used, which business process it affects, what risk or consumer impact it can create, and which evidence shows the control is current.
That pushes teams toward AI inventory and continuous compliance. If a model, agent or vendor integration changes, the evidence needs to change too. Static policy binders will age badly when examiners ask for model lists, owner names, test records, vendor oversight, approval history and monitoring results.
For teams outside insurance, NAIC's work is still worth watching. Insurance regulators are showing the direction of travel: AI oversight will increasingly be reviewed as documented operational evidence. Teams that already maintain a live inventory and mapped evidence will be in a stronger position than teams that only have a policy statement.
Sources
Primary source: NAIC Big Data and Artificial Intelligence Working Group.
Corroboration: McDermott AI regulation in insurance update.