By mid-2026 the regulatory map for insurance AI has shifted from "comply with the NAIC Model Bulletin" to a stacked, multi-jurisdictional pipeline: Colorado Reg 10-1-1 with the Oct 15, 2025 ECDIS expansion and July 1, 2026 first compliance report; NY DFS Circular Letter 2024-7; Connecticut Bulletin MC-25-8; Nevada Bulletin 24-006; pending California Department of Insurance algorithm regulations advancing AB 2930 carryover language; the Illinois HB 3773 momentum on automated employment decisions bleeding into agent and adjuster compensation review; the Washington Attorney General's guidance posture on algorithmic discrimination; and the Texas Department of Insurance's HB pipeline on AI used in personal lines. Stacked underneath are federal moves - the OCC and Federal Reserve heightened third-party risk principles applied to bank-affiliated insurers, FTC Section 5 enforcement on AI claims, the HHS Office for Civil Rights bulletin posture on health-plan AI, Treasury Federal Insurance Office data calls - and a quiet but consequential set of reinsurance treaty AI cession clauses appearing in 2026 renewals across Bermuda, Lloyd's, and the U.S. direct market. AM Best, meanwhile, is shifting from a 2026 readiness survey to an embedded AI readiness category in the Performance Assessment, framed not as a new rating methodology but as input to ERM and operational performance evaluation. This lesson walks the Chief Risk Officer, Chief Underwriting Officer, Chief Compliance Officer, and General Counsel through the 2027 wave: the state bulletin pipeline by jurisdiction, the federal posture, the treaty AI clause patterns appearing on slip wordings, the AM Best trajectory framed accurately, and the NAIC Form B holding-company AI disclosure structure that will define annual filings into 2027 and beyond.

The 2027 State Bulletin Pipeline and the Stacked-Jurisdiction Problem

The 2025-2026 wave was led by Colorado, New York, Connecticut, and Nevada with the NAIC Model Bulletin (adopted in 22 states as of mid-2026) serving as the substrate. The 2027 wave is broader, deeper, and structurally different: it layers algorithm-specific disclosure obligations, fairness-testing cadence, consumer-facing AI involvement disclosures, and adverse-action mechanics on top of the §4 governance frame. Carriers operating in five or more states should expect to be subject to five distinct disclosure regimes by Q3 2027, all of which must be reconciled against a single algorithm inventory and a single fairness-testing artifact set.

California. Department of Insurance staff have signaled continuation of AB 2930 carryover principles in regulation. Expected scope: covered automated decision-making in personal auto, homeowners, and life lines; required pre-deployment impact assessments and post-deployment fairness testing; mandatory consumer disclosure when AI materially influences denial, rate increase above threshold, or non-renewal; integration with California Insurance Information and Privacy Protection Act (CIIPPA) and CCPA/CPRA opt-out of automated decision-making. Effective dates being signaled: rolling Q2-Q4 2027 with phased application by line of business. The integration burden on national carriers is material because California's expected algorithm registry format does not align with Colorado's; building once for Colorado, then mapping to California, is the lower-cost pattern.

Texas. The Texas Department of Insurance has signaled an HB-driven framework focused on personal auto and personal property, with explicit attention to credit-based insurance scoring AI and to behavioral-claims AI in workers' compensation. The expected pattern is a Texas-specific data call (paralleling the 2023-2024 NAIC AI Surveys but state-specific), a consumer-facing AI disclosure requirement, and an algorithm inventory for systems materially affecting rate, underwriting, or claim outcomes. Texas's enforcement orientation through TDI's market conduct examinations program is well-developed; AI examinations begin overlaying existing market conduct exam process. Carriers writing meaningful Texas premium should treat the Texas algorithm inventory as a live deliverable for late 2026 or early 2027 even if formal regulation is later.

Florida. The Florida Office of Insurance Regulation's posture through 2026 has been guidance-oriented rather than promulgated regulation, but the underlying signal is identical: consumer-facing AI involvement, fairness testing, and algorithm registry expectations. The Florida hurricane-driven cat exposure layer means that AI-assisted cat modeling, AI-driven Citizens depopulation underwriting, and AI in claims handling on cat events receive specific scrutiny. The 2026 hurricane season cat handling will inform 2027 Florida guidance. Carriers should expect Florida-specific elaborations on AI in claims cycle-time, in subrogation, and in fraud triage - the three areas of historic Florida market-conduct attention.

Illinois. HB 3773 (Illinois Automated Decision-Making) covers covered employers but the agent and adjuster compensation evaluation language is bleeding into producer compensation analytics and adjuster productivity scoring AI. The Illinois Department of Insurance has not promulgated a separate AI bulletin but has signaled coordination with the Illinois Department of Labor on the boundary cases. Carriers using AI in producer or adjuster performance evaluation should treat this as an active 2027 exposure even where no direct insurance regulation has been promulgated.

Washington. The Washington Office of the Insurance Commissioner has aligned with the Washington Attorney General's guidance on algorithmic discrimination. The expected 2027 pattern: a Washington-specific algorithm inventory, fairness-testing cadence (likely quarterly for Tier-1 systems), and consumer disclosure on AI involvement in underwriting and claims. Washington's small market makes it a lower-priority compliance target individually but a frequent first-mover whose guidance other states cite; carriers should track Washington bulletins as leading indicators.

The stacked-jurisdiction problem: a national personal auto carrier writing in California, Texas, Florida, Illinois, Washington, New York, Colorado, Connecticut, and Nevada faces nine concurrent disclosure regimes with substantive differences. The mature pattern is a single internal algorithm registry that maps each algorithm to applicability flags per jurisdiction, with state-specific notice templates and fairness-testing cadences cross-referenced. The immature pattern is per-state compliance silos producing duplicate documentation and inconsistent posture under multi-state examination.

Federal Activity - OCC, FRB, FTC, HHS OCR, Treasury FIO

Federal regulators have layered substantively on the state work without preempting it. Five federal threads matter to insurance AI compliance in 2027.

OCC and Federal Reserve heightened third-party risk principles. The 2023 Interagency Guidance on Third-Party Relationships (OCC, FRB, FDIC) applies to bank-affiliated insurers and to insurer subsidiaries within bank holding companies. The principles are clear: risk-based third-party management with proportionate diligence, contractual provisions, monitoring, and termination protocols. Applied to AI vendors, the principles operationalize as: SOC 2 Type II covering AI-relevant controls; explicit contractual language on training data, sub-processor disclosure, audit rights, incident notification timing (24-72 hours); ongoing monitoring including SOC report refresh, vendor scorecard, sub-processor change tracking. Bank-affiliated insurers should treat OCC and FRB exam expectations as operationally identical to NAIC §4.3 third-party AI provisions but with sharper documentation expectations and earlier examination integration.

FTC Section 5 enforcement on AI claims and disclosures. The FTC has signaled enforcement posture on deceptive AI claims (overstating AI capabilities, undisclosed AI involvement in consumer-facing decisions, false claims about model fairness). Insurance carriers using AI in marketing or in consumer-facing interactions face Section 5 exposure. The pattern: chatbot disclaimers that overstate or understate AI involvement, AI-generated marketing claims about underwriting fairness without testing support, AI-driven personalization that operates as automated decision-making without disclosure. The 2025 FTC action against several non-insurance AI vendors set the template. Insurance-specific enforcement is expected in 2026-2027 on consumer-facing AI in personal lines.

HHS Office for Civil Rights and health-plan AI. HHS OCR has signaled posture on AI in covered entities under HIPAA - increasingly including health-plan UM, utilization review, and behavioral-claims AI. The 2024 Section 1557 final rule on nondiscrimination in health programs explicitly addressed algorithm use; insurance carriers operating L&H lines with covered-entity status face direct OCR oversight on AI fairness and accessibility. The intersection with MHPAEA NQTL comparative analysis is operationally tight: HHS OCR coordinates with DOL on behavioral-claims AI examinations.

Treasury Federal Insurance Office data calls. Treasury FIO under the Federal Insurance Office Act has authority to collect data from insurers on matters affecting the insurance industry. FIO's 2024-2026 climate data call established the template; an AI-specific data call is anticipated in 2026-2027, focused on systemic AI use, third-party concentration risk, AI in climate-related underwriting, and AI in financial stability. Carriers should treat FIO data calls as likely 2027 inputs requiring algorithm inventory, third-party concentration analysis, and stress-test alignment with Treasury and Federal Reserve frameworks.

CFPB on consumer-financial-product overlap. The CFPB's authority over consumer financial products touches insurance at the boundary - credit insurance, force-placed insurance, GAP, debt protection - and the CFPB's posture on AI in consumer credit (UDAAP, ECOA disparate impact, FCRA) creates derivative exposure for insurance products that overlap. Carriers selling credit-related insurance through bank distribution should expect overlapping CFPB scrutiny in 2027.

Reinsurance Treaty AI Cession Clauses in 2026 Renewals

The reinsurance market in 2026 introduced AI cession clauses across cat XOL, professional liability treaty, cyber treaty, and casualty XOL renewals. The 2027 renewal cycle (Jan 1, 2027 placements being negotiated mid-2026) is materially deeper. Three patterns dominate.

Pattern 1 - AI Representation and Use Clause. The cedant represents that AI use in covered underwriting, claims-handling, and reserve-setting is consistent with the disclosed practices in the slip; that AI models materially affecting reserves or claims outcomes are documented and tested; and that material AI incidents (drift events, fairness violations, vendor outages with downstream cession impact) will be notified to the reinsurer within a defined window (typically 30 days for material; immediate for severe). The clause carries breach consequences ranging from premium adjustment to cession reduction to treaty termination for material breach. Cedants must operationalize the representation: cession reporting must reflect actual AI use; incident response must include reinsurer notification workflow; the AI committee and CRO must understand the AI-cession reporting chain.

Pattern 2 - AI Exclusion or Limitation on Cyber Treaty. Cyber treaty wordings are bifurcating on AI exposure. One pattern carves out AI-incident losses (training-data poisoning, AI hallucination producing claims, AI-driven extortion) from standard cyber cession, treating them as a separate cession class requiring affirmative coverage and reinsurance support. The Coalition affirmative AI endorsement model is being replicated upward into treaty wordings. Carriers writing cyber should expect their cyber treaty renewals in 2027 to require explicit AI-coverage carve-in or carve-out language; the negotiation is non-trivial because reinsurers' appetite for AI cyber risk is genuinely uncertain.

Pattern 3 - Bermuda Form 006 AI Handling. The Bermuda Form 006 (occurrence-reported triggered) and Form 004 (claims-made occurrence-reported) wordings are being negotiated with AI-handling language: how AI-driven coverage analyses, AI-driven reserve setting, and AI-influenced settlement decisions interact with the trigger, with the reported-occurrence definition, and with the integrated occurrence aggregation. The Bermuda market is the testbed for treaty AI language because Bermuda reinsurers tend to lead innovation in clause wording; the 2026-2027 cycle is establishing the baseline language that the London Market and U.S. domestic reinsurers will adapt.

Lloyd's slip-level AI language. Lloyd's slip drafting is incorporating AI language at three points: the security clause (named reinsurers and their AI handling commitments), the data clause (AI data residency and processing), the claims handling clause (AI-driven first response and reserve setting). Lloyd's brokers leading these slips in 2026-2027 include market specialists at major brokerages developing AI-aware clause templates; the slip drafting workflow is being augmented with AI-specific provisions that protect both cedant and reinsurer interests. Send Flow and similar broker platforms are picking up slip-level AI language in their drafting templates.

The cedant's operational response: the AI committee charter incorporates treaty-renewal coordination; the reinsurance department understands the AI-cession reporting obligation; the algorithm inventory has a treaty-exposure flag identifying which systems materially affect treaty cession; the incident response runbook includes reinsurer notification with timing aligned to treaty wordings. The 2027 placements being negotiated mid-2026 are the test of cedant operational maturity on AI-cession reporting.

AM Best Survey-to-Readiness Trajectory Framing

AM Best's posture on insurance AI through mid-2026 is precisely characterized as survey-and-readiness-input to the existing Performance Assessment, not as a standalone AI capability rating methodology. The April 2026 Best's Special Report indicated approximately 41% of surveyed carriers using AI in core functions (underwriting, claims, pricing) and approximately 60% expecting one-to-three-year transformative AI impact. These figures inform the AM Best analyst's view of operational performance and ERM but do not produce a standalone AI rating.

The trajectory through 2027: AM Best is expanding the survey scope, integrating AI-readiness scoring into the Performance Assessment qualitative review categories (data readiness, talent, governance, third-party risk, operational integration), and developing analyst training on AI evaluation. The carrier-facing narrative for the AM Best meeting must therefore be calibrated: not "we have AI rated 4/5" but "our AI program supports operational performance through these specific capabilities; here is our readiness across data, talent, governance, third-party, integration." The CRO and Chief Actuary preparing for the AM Best meeting should anticipate questions on algorithm inventory completeness, fairness testing cadence, ECDIS source list, vendor concentration, treaty-AI clauses, and incident history with material impact.

The deliverables for the AM Best meeting that align with the trajectory framing: a one-page AI Program Summary mapping to ERM and operational performance; a brief on Tier-1 systems with model-card extracts; the §4 governance memo (AISET Exhibit B); the algorithm inventory with treaty-exposure flags; the third-party AI vendor schedule with concentration analysis; the incident-history summary with material-event count; the ESG-AI cross-reference where applicable. The CRO frames the conversation around operational performance support and ERM integration, not around AI as an independent rating variable.

The 2027 evolution: AM Best is expected to publish updated AI-readiness criteria within the Performance Assessment framework, more structured AI-related questions in the periodic Best's surveys, and analyst training establishing baseline AI evaluation. Carriers should anticipate Best's Special Reports through 2027 with AI-specific framing, but should continue to position AI as operational performance input rather than as standalone rating dimension. Misframing AI as a rating driver in CRO presentations creates analyst expectations the rating methodology does not currently support; properly framed, AI demonstrates operational maturity feeding into the existing rating dimensions.

NAIC Form B Holding Company AI Disclosures

NAIC Form B (the Holding Company Annual Registration Statement) under the Insurance Holding Company System Regulatory Act is becoming the structural location for holding-company-level AI disclosure. The 2026-2027 evolution of Form B is incorporating AI-specific disclosure under existing categories - Item 3 (organizational structure with AI-related affiliates and service providers), Item 5 (intercompany transactions with AI-related service contracts), Item 6 (board structure and AI committee charter), Item 7 (governance and oversight including AI policy framework), Item 12 (financial information including AI-related capital and material investment), and the prospective Schedule on AI Systems being drafted at the NAIC level.

The expected Form B AI Schedule structure (2027 working drafts circulating): identification of material AI systems used by the insurance group (insurer level and affiliate level); ownership and licensing structure of AI systems (proprietary vs. third-party with vendor identification); intercompany flow of AI services (affiliate developing AI for group use, intercompany service contracts); board-level oversight structure (AI committee, charter, reporting cadence); CRO and CCO accountability; ERM integration of AI risk; cross-border AI service flows; material AI investments and capital allocation; incident history at the holding-company level. The disclosure is intended to give state DOI examiners visibility into AI use across the insurance group, not just at the insurer level.

Operational implications for holding companies: the holding-company AI policy framework must support Form B disclosure; intercompany service agreements covering AI must be documented in §4 and reflected in Form B Schedule D and Y; the AI committee charter must include holding-company scope; the algorithm inventory must distinguish insurer-level vs. affiliate-level vs. holding-company-shared systems. The Form B compilation process should be coordinated with the AI committee, the CRO, the CCO, the Chief Actuary, and the General Counsel.

The Form B AI disclosure interacts with state-level requirements: Colorado Reg 10-1-1 algorithm inventory feeds the Form B holding-company AI schedule; New York DFS Circular 2024-7 governance memo aligns with Form B Item 7; the §4 program documentation supports Item 7 and the prospective AI Schedule. Carriers operating holding-company structures across multiple states should treat the Form B AI compilation as the consolidating disclosure that maps the multi-jurisdiction state disclosure work into a single annual filing.

The 2027 Readiness Roadmap and 90-Day Runup

The CRO and CCO leading 2027 readiness should structure work around five workstreams with the next 90 days as the inflection.

Workstream 1 - State Bulletin Mapping. Inventory current state operations; map current and pending state AI bulletins; build the state-jurisdiction applicability matrix per algorithm; assign each algorithm a state-disclosure flag set; produce the cross-state notice template library. Owner: CCO with state regulatory affairs. Cadence: monthly through Q4 2026 with quarterly review through 2027.

Workstream 2 - Federal Activity Tracking. Subscribe to FTC, OCC, FRB, HHS OCR, Treasury FIO, CFPB publication channels; map federal posture to internal AI program areas; coordinate with bank-affiliated insurer subsidiaries on OCC/FRB exam preparation; coordinate with health-plan affiliates on HHS OCR posture. Owner: GC with regulatory tracking; CCO co-owner. Cadence: weekly publication scan; quarterly federal posture brief to AI committee.

Workstream 3 - Treaty AI Clause Negotiation. Inventory current treaty wordings; identify AI-related provisions; coordinate with reinsurance brokerage (Aon, Guy Carpenter, Lockton Re, Howden, Gallagher Re, Acrisure Re, Howden M&A) on slip-level AI language for 2027 renewals; build the AI-cession reporting workflow; integrate with incident response runbook. Owner: Chief Reinsurance Officer (or reinsurance department head) with CRO co-owner. Cadence: continuous through renewal cycle with quarterly AI committee briefing.

Workstream 4 - AM Best Meeting Preparation. Refresh the AI Program Summary for AM Best; refresh algorithm inventory, governance memo, third-party schedule, incident history; ensure CRO and Chief Actuary alignment on framing AI as operational performance and ERM input. Owner: CRO with Chief Actuary co-owner. Cadence: annual ahead of AM Best meeting with quarterly inventory refresh.

Workstream 5 - Form B Compilation Coordination. Coordinate Form B preparation with AI committee; build holding-company AI schedule template aligning with NAIC 2027 working drafts; map intercompany AI service flows; refresh §4 program documentation supporting Form B disclosure. Owner: General Counsel with CCO and CRO co-owners. Cadence: annual Form B cycle with mid-year refresh.

The 90-day runup objective: by Q4 2026 every workstream has a named owner, a documented baseline, a monthly cadence, and an AI committee reporting line. By Q1 2027, the carrier is positioned to absorb regulatory and treaty-renewal pressure without crisis. Carriers entering 2027 without this structure will face compounding pressure as multiple state regulations land within months of each other and as 2027 treaty renewals begin closing through Jan-July 2027.

Integration With §4 Program and Algorithm Inventory

The five 2027-readiness workstreams integrate with the existing §4 governance program structurally. The §4 Written AI Program references the state bulletin matrix as a maintained appendix. The algorithm inventory carries state-jurisdiction flags and treaty-exposure flags. The vendor lifecycle includes treaty AI clause flow-down requirements. The incident response runbook includes state, federal, treaty, and AM Best notification protocols. The AI committee charter incorporates 2027 readiness oversight as standing agenda. The CRO scorecard includes 2027-readiness metrics.

The integration is structural, not additive. A carrier whose §4 program is mature absorbs 2027 readiness through extension of existing artifacts. A carrier whose §4 program is fragmented faces 2027 as a re-architecture event. The 90-day runup is the test: can the existing §4 absorb the 2027 wave through extension, or does it require restructuring? Carriers in the latter position should accelerate §4 maturity through Q4 2026 to enter 2027 with the structural capacity to absorb regulatory and treaty pressure.

Key Takeaways

• The 2027 state bulletin pipeline stacks deeper and broader than 2025-2026. California, Texas, Florida, Illinois, Washington layer onto Colorado, New York, Connecticut, Nevada with substantive differences. Carriers operating in 9+ states face concurrent disclosure regimes reconcilable only through a single internal algorithm registry mapping state applicability flags.
• Federal activity layers without preempting: OCC and FRB heightened third-party risk for bank-affiliated insurers, FTC Section 5 on AI claims, HHS OCR on health-plan AI under Section 1557, Treasury FIO anticipated AI data call, CFPB on consumer-financial-product overlap. Each layers documentation expectations on the §4 program structure.
• Reinsurance treaty AI clauses are emerging in 2026 renewals: AI Representation and Use Clause, AI Exclusion or Limitation on Cyber Treaty, Bermuda Form 006 AI Handling, Lloyd's slip-level AI language. 2027 placements being negotiated mid-2026 test cedant operational maturity on AI-cession reporting.
• AM Best framing is survey-and-readiness-input to Performance Assessment, not standalone AI rating methodology. April 2026 Best's Special Report indicated approximately 41% AI use in core functions and approximately 60% expecting one-to-three-year transformative impact. CRO narrative should position AI as operational performance input, not as independent rating driver.
• NAIC Form B Holding Company filing is becoming the holding-company-level AI disclosure location. 2027 working drafts anticipate AI Schedule covering material systems, ownership/licensing, intercompany flow, board oversight, ERM integration, cross-border flows, material AI investments, incident history.
• Treaty AI Representation and Use Clause carries breach consequences from premium adjustment to cession reduction to treaty termination. Cedants must operationalize: cession reporting reflects actual AI use; incident response includes reinsurer notification; AI committee and CRO understand AI-cession reporting chain.
• The 2027 readiness roadmap is five workstreams: State Bulletin Mapping (CCO), Federal Activity Tracking (GC), Treaty AI Clause Negotiation (Chief Reinsurance Officer), AM Best Meeting Preparation (CRO), Form B Compilation Coordination (GC). The 90-day runup positions the carrier to absorb 2027 wave through §4 extension rather than restructure.
• OCC/FRB Interagency Guidance on Third-Party Relationships applied to AI vendors operationalizes as SOC 2 Type II covering AI controls, explicit contractual training/sub-processor/audit/incident provisions, ongoing monitoring through SOC refresh and vendor scorecard. Bank-affiliated insurers face exam expectations operationally identical to NAIC §4.3 but with sharper documentation and earlier examination integration.
• Mature §4 programs absorb 2027 readiness through extension of existing artifacts; fragmented §4 faces 2027 as re-architecture event. The 90-day runup through Q4 2026 is the operational test of whether existing structure absorbs regulatory and treaty pressure or requires restructuring.