Governing Evidence
- Under the EU AI Act, AI systems used for risk assessment and pricing in life and health insurance are classified high-risk (Annex III, Area 5(b)); full obligations, including conformity assessments, logging, post-market monitoring, and human oversight, applied to newly placed or materially changed systems starting August 2, 2026.
- The National Association of Insurance Commissioners is running a twelve-state pilot of its AI Systems Evaluation Tool (California, Colorado, Connecticut, Florida, Iowa, Louisiana, Maryland, Pennsylvania, Rhode Island, Vermont, Virginia, and Wisconsin) from March through September 2026.
- The NAIC tool will not be finalized until it is re-exposed for public comment in September and October, with adoption targeted for the NAIC's fall national meeting in November 2026.
- A Fundamental Rights Impact Assessment is mandatory under the EU AI Act for any high-risk deployer in the life and health insurance sector, before that system reaches an EU policyholder.
A carrier writing life or health business in the European Union crossed a hard compliance line on August 2. Its underwriting and pricing models, if they influence what a policyholder pays or whether that policyholder is accepted at all, are now subject to conformity assessment, mandatory logging, post-market monitoring, and documented human oversight. There is no pilot phase for that obligation. It is in force.
The same carrier's domestic board, if it operates in one of the twelve NAIC pilot states, is being asked this year to respond to a different instrument entirely: a governance evaluation tool built around four exhibits, quantifying AI usage, mapping a governance risk framework, detailing high-risk systems, and documenting the data behind them, that will not be finalized until the fall and is not yet a binding requirement anywhere.
Peer Context
The gap is not theoretical for any insurer with EU exposure. Life and health carriers with continental subsidiaries or EU-domiciled underwriting books now report to two regimes that share a subject, artificial intelligence in risk assessment and pricing, and nothing else. One regime has teeth today. The other is still gathering feedback from the regulators who wrote it. Carriers confined to invitation from one of the twelve pilot states are answering the NAIC's monthly coordination calls and completing exhibits that inform a framework still under construction. Carriers with EU books are already producing conformity documentation a regulator can request tomorrow.
Regulatory or Market Pressure
The pressure is not coming from a single source, and that is the point. The EU AI Act sets a statutory floor with an enforcement date already behind it. The NAIC's tool is a state-coordinated pilot, deliberately built through consultation rather than mandate, designed to produce a model that state insurance departments can adopt individually once the fall meeting closes. Neither regime waited for the other. A board that treats domestic AI governance as a project to finish once the NAIC formally adopts something in November has already fallen behind the standard its own EU subsidiary is required to meet today.
Board Governance Implication
This is the Governance Boundary Principle at its sharpest edge: a board that builds AI oversight only where a regulator has already made it mandatory has not built a governance standard. It has built a compliance boundary, and that boundary stops exactly where the mandate stops. The insurer whose EU underwriting models carry full conformity documentation while its US pricing models carry none has not demonstrated governance maturity. It has demonstrated jurisdictional arbitrage, and every state insurance examiner who reads the EU filing will ask why the domestic filing looks different.
The NAIC's four-exhibit structure, quantify usage, assess governance risk, detail high-risk systems, document underlying data, is not a lesser standard because it is still a pilot. It is close to a domestic FRIA in substance. A board that already has EU-grade documentation can produce most of the NAIC exhibits from material it has already built. The board that has not started either has a shorter runway than the November adoption date suggests.
Strategic Options
A board with EU exposure should direct the audit or risk committee to map its existing EU conformity documentation directly onto the NAIC's four exhibits now, not after the tool is finalized. Most of the underlying work, system inventory, risk classification, data lineage, already exists.
A board without EU exposure but operating in a pilot state should treat participation as the floor, not the ceiling. Voluntary response to a state's pilot request is the minimum; assigning a named board-level owner for the AI Systems Evaluation Tool response, before the November adoption date, is the standard that survives the transition from pilot to rule.
A board with neither EU exposure nor a pilot-state footprint should not read the absence of a deadline as the absence of exposure. The NAIC's tool will be adopted state by state after November, and the carriers that treated the pilot period as a dry run will be the ones with documentation ready when their own state moves from invitation to requirement.
The insurer that waits for a domestic mandate to match the one already governing its EU book will not be building governance. It will be catching up to a standard it already knows how to meet.