Security, privacy, and regulatory vetting of an insurance AI vendor is the contractual and operational layer that survives the actual breach, the actual market-conduct exam, and the actual NAIC AISET information request. The vendor's SOC 2 report is the starting point, not the destination. The carrier's responsibility is to ensure GLBA Safeguards Rule §314 compliance flows through the vendor relationship, HIPAA Business Associate Agreements are current and operationally enforced for L&H lines, state privacy regimes are individually addressed by jurisdiction (CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA, TIPA, and the 2026 wave of state additions), NAIC Model Bulletin §4 third-party AI standards are flowed contractually, and bank-owned carriers absorb OCC and FRB heightened third-party risk expectations. The 2025-2026 enforcement environment is materially more active than 2023-2024: the FTC's December 2025 settlement with a property carrier over §314 failures attached to a vendor incident; the OCR's January 2026 enforcement action on a L&H carrier's BAA failures; Colorado, Connecticut, Nevada, Texas, Florida DOI bulletins now explicitly address third-party AI; and the New York DFS Circular Letter 7 has been operationalized in market-conduct exams. This lesson is the contractual and operational vetting framework - the clauses that survive a breach, the operational controls that survive an exam, and the documentation that survives an OCR or DOJ subpoena.

GLBA Safeguards Rule §314.4(f) - The Third-Party Oversight Burden

The Gramm-Leach-Bliley Act Safeguards Rule (16 CFR §314) requires financial institutions, including most insurance entities, to maintain a written information security program. §314.4(f) explicitly addresses oversight of service providers and was strengthened in the 2021 amendments effective June 2023. The carrier must: select service providers capable of maintaining appropriate safeguards; require service providers by contract to implement and maintain such safeguards; periodically assess service providers based on the risk they present and the continued adequacy of their safeguards.

For an AI vendor, the §314.4(f) operational implementation requires: a written contract that specifies the safeguards the vendor must maintain (typically by reference to SOC 2 Type 2, ISO 27001, NIST CSF, or equivalent); a documented assessment process with annual cadence at minimum; the right to audit (on-site or remote, with reasonable notice); incident-notification obligations from vendor to carrier (typically within 24-72 hours of incident detection); sub-processor controls (consent on material additions, audit rights to material sub-processors); data destruction obligations at contract termination with attestation. The FTC's December 2025 enforcement action against a property carrier turned on the carrier's failure to maintain a documented assessment of an AI vendor whose breach exposed customer NPI - the carrier had SOC 2 reports on file but no documented annual assessment beyond the SOC 2 receipt. The $4.2M FTC settlement included a five-year compliance monitor.

HIPAA and L&H - The BAA Discipline

Life and health carriers, workers' comp carriers handling medical data, and BI claims operations reviewing medical records all touch Protected Health Information (PHI) and trigger HIPAA Business Associate Agreement obligations under 45 CFR §164.504(e). AI vendors processing PHI must execute a current BAA before any data flow begins; the BAA must address: permitted uses and disclosures of PHI, safeguards required, reporting obligations, sub-BA agreements with the vendor's own sub-processors, return or destruction of PHI at contract end, and breach notification under the HIPAA Breach Notification Rule (45 CFR §164.400-414).

The OCR's January 2026 enforcement action against a L&H carrier turned on a stale BAA - the carrier's AI vendor for behavioral health claim review had been operating under a 2019 BAA that did not address the 2020 amendments, did not name current sub-processors, and did not specify breach notification timing within HIPAA's 60-day external notification window. When the vendor experienced a breach affecting 14,000 records, the carrier's incident response was hampered by the BAA's deficiencies. The OCR settlement was $3.1M plus three-year corrective action plan. BAA refreshes should be annual or upon material vendor change (sub-processor addition, ownership change, scope change).

MHPAEA Non-Quantitative Treatment Limitation (NQTL) compliance adds a layer specific to AI in behavioral health claims. Under the 2024 MHPAEA final rule, carriers must document that any algorithmic decision-making applied to mental health and substance use disorder claims has comparable methodology and operational application to medical/surgical claims. AI vendors processing behavioral health claims must support the carrier's NQTL testing with documentation, performance data segmented by claim type, and fairness testing across MHPAEA-protected populations.

State Privacy Regimes and the 2026 Wave

State privacy laws applicable to insurance AI vendors in mid-2026: California CCPA/CPRA (operative since 2020/2023), Virginia CDPA (operative 2023), Colorado CPA (operative 2023), Connecticut CTDPA (operative 2023), Utah UCPA (operative 2023), Tennessee TIPA (operative 2025), Iowa ICDPA (operative 2025), Indiana ICDPA (operative 2026), Texas TDPSA (operative 2024-2025 phased), Oregon OCPA (operative 2024-2026 phased), Montana MCDPA (operative 2024), Delaware DPDPA (operative 2025), New Jersey NJDPA (operative 2026), New Hampshire NHCDPA (operative 2026), Kentucky KCDPA (operative 2026), Rhode Island RIDPA (operative 2026), and Maryland MODPA (operative 2026).

The operational implication is that a carrier writing nationally must produce a DPA that addresses every regime in its write states. Most carriers in 2026 maintain a master DPA template with state-specific addenda. The vendor's responsibility is to honor the most restrictive applicable regime for each data subject; the carrier's responsibility is to verify vendor practices match the contractual commitment. State DOI and state AG enforcement actions are increasing - Colorado AG launched two enforcement actions in Q1 2026 against insurance-adjacent vendors; the Texas AG's data-broker registration enforcement under DR 21-104 has expanded to AI vendors that process personal data at scale.

Sensitive personal information (SPI) under most state regimes includes precise geolocation, biometric data, health information, racial/ethnic origin, religious beliefs, sexual orientation, and (in some regimes) immigration status and union membership. AI vendors processing SPI face heightened consent, purpose limitation, and disclosure obligations. Insurance AI use cases that touch SPI (telematics geolocation, biometric authentication, health-AI underwriting, fairness testing across protected classes) must specifically address SPI handling in the DPA and supporting documentation.

NAIC Third-Party AI Standards - The Bulletin §4 Flow

The NAIC Model Bulletin on the Use of AI Systems by Insurers, finalized in late 2023, was adopted by 30+ states by mid-2026 (with state-specific variations in adoption mechanism - bulletin, regulation, or law). §4 governs third-party AI vendors used by insurers and requires the insurer to: maintain due diligence on third-party AI vendors; ensure vendor compliance with applicable laws and the insurer's own AI governance; document the relationship including the AI's purpose, capabilities, limitations, performance, and oversight; address incident response coordination; and include third-party AI in the insurer's algorithm inventory and AISET response.

Contractual flow-through is the operational mechanism. Standard 2026 contract language for §4 conformance includes: vendor warrants compliance with applicable AI bulletins and regulations; vendor provides annual §4 conformance attestation signed by vendor-side CRO or equivalent; vendor cooperates with carrier's annual third-party AI audit; vendor maintains its own algorithm inventory or contributes to the carrier's; vendor provides incident-response coordination and joint investigation rights; vendor documents model purpose, capabilities, limitations, performance, and oversight to the carrier's specification.

State adoption variations matter operationally. Colorado has codified third-party AI oversight in Reg 10-1-1 (life insurers using external consumer data and algorithms). Connecticut's bulletin operationalized §4 with explicit market-conduct exam authority. New York DFS Circular Letter 7 predated the NAIC bulletin but aligned with it on third-party AI oversight. California operates under existing fair-pricing and unfair-claims-practices authority plus the 2024 DOI bulletin on AI in claims. The carrier's regulatory affairs team maintains a state-by-state matrix of §4 adoption status and operational implications.

OCC and FRB Heightened Third-Party Risk for Bank-Owned Affiliates

Carriers owned by or affiliated with banks (USAA's banking arm, MetLife's pre-spin-off bank relationships, Allstate's affiliations, mutual companies with bank affiliations) absorb OCC and FRB heightened third-party risk expectations through the holding-company structure. The OCC's June 2023 third-party risk management guidance (consolidating prior OCC, Federal Reserve, and FDIC guidance) raises the bar on vendor risk management for bank-affiliated entities: tiered risk classification of vendors, enhanced due diligence for high-risk vendors (most insurance AI vendors qualify), board-level oversight reporting, contract clauses addressing exit, audit, and incident response, and ongoing monitoring with documented assessment.

For bank-affiliated insurance entities, the AI vendor relationship is subject to both the insurance-specific framework (GLBA, HIPAA, state privacy, NAIC §4) and the banking-specific framework (OCC, FRB, possibly FDIC). The contractual and operational overlay is heavier. The board's risk committee reviews AI vendor relationships at least annually, often quarterly for tier-1 vendors. The internal audit function tests vendor oversight as part of the SOX 404(b) controls program in publicly-traded holding companies.

The Vendor Incident Response Clause That Survives a Real Breach

The single most important contractual clause in an insurance AI vendor contract is the incident response and notification language. Vendors will offer standard 24-72 hour notification language; carriers should negotiate to 24-hour notification with operational coordination obligations beyond notification. The clause must address: notification trigger (vendor's reasonable belief of an incident affecting carrier data or carrier-relevant model behavior); notification channel and contacts (named individuals with backup, not just generic vendor support); information required at notification (scope, timing, root cause if known, data affected, vendor's preliminary response); joint investigation rights (carrier's security and legal teams participate; vendor cannot unilaterally close the incident); customer-facing communication coordination (vendor cannot communicate with carrier's customers without carrier approval); regulatory notification obligation allocation (typically vendor reports incident to carrier; carrier reports to regulators with vendor cooperation); cost allocation (typically vendor bears costs of its own incident response; remediation costs allocated per contract; service credits for SLA failures); ongoing reporting (vendor provides daily updates during active incident, post-incident review with documentation).

The clause that survives a real breach also includes operational provisions outside the contract - playbook for the carrier's incident response team with vendor-specific contact information, regulatory-notification timelines for each applicable jurisdiction, customer-communication templates pre-approved by legal and brand teams, and an annual tabletop exercise testing the vendor-relationship incident response. The 2025-2026 enforcement environment has shown that carriers without operational incident-response readiness pay multiples in regulatory fines and litigation costs compared to carriers with disciplined incident response.

The Pre-Signing Vetting Checklist

Before any AI vendor contract is signed, the carrier completes the following checklist. (1) Current SOC 2 Type 2 report received and reviewed by security team. (2) ISO 27001 certification verified if claimed. (3) Penetration test reports from last 24 months received and reviewed. (4) Incident history disclosed for trailing 24 months. (5) Sub-processor list current and reviewed; jurisdictional exposure documented. (6) BAA executed if PHI exposure. (7) DPA executed addressing all applicable state privacy regimes. (8) §4 conformance attestation received and reviewed. (9) Insurance - vendor's E&O, cyber, and general liability coverage verified with carrier named as additional insured where appropriate. (10) Financial stability - vendor's financial position reviewed; for high-concentration vendors, audited financials may be required. (11) Exit-clause language reviewed and tested through tabletop. (12) Incident response clause reviewed and named contacts confirmed. (13) Sub-processor consent rights reviewed for foundation-model providers. (14) Model-update notification process tested. (15) Audit rights operationally tested through scheduled annual audit. (16) Cross-functional sign-off complete (security, legal, data science, actuarial, business owner, CRO).

The Quarterly and Annual Operational Cadence

Post-signing, vendor relationships require ongoing operational discipline. Quarterly: KPI review against contractual targets; incident-history scan; sub-processor change log review; model-update notification cataloging; SLA performance review. Annual: full §314.4(f) assessment refresh; BAA review and refresh if material change; DPA review against state privacy updates; §4 conformance attestation refresh; SOC 2 cycle review; incident-response tabletop exercise; audit execution and finding remediation; renewal-eval per Ch2-1 framework. Triggered: any material vendor change (ownership, sub-processor, security posture) triggers ad-hoc review.

Key Takeaways

• GLBA Safeguards Rule §314.4(f) requires documented annual assessment of service providers, not just SOC 2 receipt. The FTC's December 2025 settlement against a property carrier ($4.2M plus five-year monitor) turned on this gap.
• HIPAA BAAs must be current - annual refresh or upon material vendor change. OCR's January 2026 L&H carrier settlement ($3.1M plus three-year corrective plan) traced to a stale 2019 BAA. MHPAEA NQTL testing requires AI vendors processing behavioral health claims to support documentation, performance data segmentation, and fairness testing across protected populations.
• State privacy regimes applicable in mid-2026: CCPA/CPRA, CDPA (VA), CPA (CO), CTDPA (CT), UCPA (UT), TIPA (TN), ICDPA (IA), ICDPA (IN), TDPSA (TX), OCPA (OR), MCDPA (MT), DPDPA (DE), NJDPA, NHCDPA, KCDPA, RIDPA, MODPA. Carriers writing nationally maintain master DPA with state-specific addenda. Colorado AG and Texas AG enforcement is materially active in 2026.
• NAIC Model Bulletin §4 adopted by 30+ states by mid-2026 with state-specific variations. Contractual flow-through includes annual §4 conformance attestation, joint audit, algorithm inventory contribution, incident-response coordination, model-documentation to carrier's spec. Colorado Reg 10-1-1 codified the framework for life insurers; Connecticut and NY DFS Circular Letter 7 operationalize it.
• Bank-affiliated carriers absorb OCC/FRB heightened third-party risk: tiered classification, enhanced due diligence for high-risk vendors, board-level oversight, contract clauses on exit/audit/incident, ongoing monitoring with documented assessment. Heavier operational overlay than non-bank-affiliated peers.
• Incident response clause is the single most important contractual provision. 24-hour notification, named contacts with backups, joint investigation rights, customer-communication coordination, regulatory-notification allocation, daily updates during incident, post-incident review with documentation.
• Pre-signing vetting is a sixteen-item checklist covering SOC 2, ISO 27001, pentest, incident history, sub-processors, BAA, DPA, §4 attestation, vendor insurance, financial stability, exit clauses, incident response clause, sub-processor consent, model-update notification, audit rights, cross-functional sign-off.
• Post-signing operational cadence: quarterly KPI/incident/sub-processor/SLA review; annual §314.4(f) refresh, BAA refresh, DPA refresh, §4 attestation refresh, SOC 2 review, incident-response tabletop, audit execution. Triggered review on any material vendor change.