The NAIC Big Data Working Group has just closed its comment period on version 5.0 of the AI Risk Evaluation Supplement, with final adoption expected at November's Fall National Meeting. This is not a voluntary standard. This is an examination-level tool that state regulators will use to assess whether insurers—including UK-domiciled firms with US operations—have proper AI governance in place. For mid-market UK insurers operating in the US, or holding regulatory permissions that touch US-regulated activities, this means regulators will now have a structured framework to interrogate your AI practices. The FCA's own AI rulebook (still in consultation) will not be as prescriptive as this NAIC framework. That matters: US regulators move faster, and they set the tone globally.

This story is part of a wider pattern. The EU AI Act has already embedded governance requirements into EU law. Lloyd's of London has published Blueprint Two, which explicitly expects syndicates to evidence AI governance. The PRA's SS1/23 on third-party management now covers AI vendors. Regulators across four continents are converging on the same core question: show us your AI governance, or explain why not. The days of deploying an off-the-shelf GenAI tool (whether Copilot, Claude, or a legal-focused product like Harvey) and hoping nobody asks hard questions are over. Regulators now expect firms to document model behaviour, audit outputs, manage vendor lock-in, and prove human oversight. Most firms have not done this work.

Here is Trovix's honest view: the NAIC framework will expose a critical gap in how most mid-market firms have implemented AI. They have bought products—document AI platforms, legal research tools, claims intake automation—but they have not built governance infrastructure around those purchases. The NAIC supplement requires evidence of: model performance monitoring, bias testing, explainability, human-in-the-loop controls, and vendor accountability. A tool like Luminance or Legora can flag unusual contract patterns, but it cannot itself prove to a regulator that your firm is managing the risk of that tool's outputs. Similarly, general-purpose GenAI assistants like Copilot offer speed but create governance liabilities if deployed without clear guardrails, audit logs, and user accountability. Products like Trovix Aria—designed specifically for regulated firms—embed governance by design: role-based access, output audit trails, knowledge source traceability, and no model training on your data. But governance infrastructure must sit outside any single tool. You need a framework that covers all AI, vendor-managed or built in-house.

A mid-market insurer, law firm, or accountancy practice should do three things immediately. First, audit every AI tool currently in use—map which decisions it touches, what data it processes, and whether you can explain its outputs to a regulator. This is not a technology exercise; it is a compliance and risk exercise. Second, implement a monitoring and control layer: who is using each tool, for what, and did the output go to a human who checked it before use? Third, use Trovix Watch to track incoming regulatory guidance as the NAIC finalises this supplement and as the FCA and PRA respond. The NAIC meeting is in November. Your governance framework needs to be in place by the time state regulators begin real examinations, which will happen within months of adoption.

Source: Insurance Journal