What US regulatory requirements matter when outsourcing or automating property claim production?

Review claims handling, AI governance, licensing, data security and record obligations state by state and task by task. A supplier’s contract cannot be treated as a substitute for the insurer’s applicable regulatory responsibilities.

Important source-based examples include:

• NAIC AI model bulletin: adopted on 4 December 2023, it describes a risk-based written AI systems programme and expectations for governance, testing and third-party diligence. It is a model for jurisdictional use, not a single federal insurance AI statute. (content.naic.org)
• Texas: Bulletin B-0003-26, issued 12 June 2026, states that AI-made or AI-supported consumer-impacting decisions must comply with applicable insurance laws. It sets governance expectations extending to third parties and discusses information TDI may request. (tdi.texas.gov)
• California: the Department’s January 2026 disaster-adjusting guide describes claims documentation and settlement obligations. A separate CDI notice addresses policyholder access to claim-related documents, including preliminary and final estimates and reports. (insurance.ca.gov)
• New York cybersecurity: DFS guidance addresses third-party selection, contracting, ongoing oversight and termination for covered entities. Applicability and exemptions need entity-specific review. (dfs.ny.gov)

Current-development caution: As of this research date, the NAIC working group lists AI Risk Evaluation Supplement version 6.0 for comment following its 16 October 2026 notice, with comments due 30 October 2026. An exposed draft should not be described as an adopted nationwide requirement. (content.naic.org)

Have counsel maintain a jurisdiction-and-task matrix before deployment. This research is procurement guidance, not a legal opinion on a particular delegation.