THE TAKE
An AI policy is easy to approve. Explaining which systems it covers, how they affect customers and why some receive more scrutiny is harder. For insurers, that explanation needs to hold up when an examiner asks for the evidence.
On October 16, 2026, the NAIC circulated version 6.0 of its AI Risk Evaluation Supplement for comment. The exposure draft provides proposed questionnaires for use alongside existing examination and financial-analysis procedures. It explicitly says it does not independently create new substantive legal duties or expand regulatory authority. The discussion here draws on that October draft, not an assumed final adoption.
What deserves attention is the connection between the inventory and the inquiry. The draft starts with how AI is used and can lead to deeper questions about governance, high-risk models and data. Regulators may specify materiality themselves or consider a company's threshold with an explanation supporting it. Management's classification is something to substantiate, not a limit it can impose on the examiner.
That makes the inventory a record of judgment. A list of product names will not explain the use case, consumer impact, financial exposure or reasoning behind a risk rating.
THREE THINGS BOARDS SHOULD KNOW
- The inventory needs business context. Identify the system, its use, operating area, inherent risk and consumer or financial impact. Inherent risk means assessing exposure before taking credit for controls.
- Buying a model does not remove it from the governance conversation. Vendor models and data can sit inside claims, underwriting and fraud workflows. Management needs to understand those dependencies and what evidence it can obtain.
- Materiality requires an explanation. Document the basis for the threshold used in a response and the treatment of consumer harm. A financial threshold should not become shorthand for ignoring consumer impact.
THE QUESTION I'M HEARING
"If this creates no new obligation, why should it be on the committee agenda?"
Because it gives management a practical way to test whether the governance program can support an examination response. A policy may describe an approach that the inventory and supporting records cannot yet demonstrate.
I would ask management to run a one-hour exercise before the next risk or audit committee meeting. Select three systems close to a consumer outcome, such as claims triage, underwriting eligibility and fraud referral. For each, produce the inventory entry, risk rationale, relevant vendor dependency and evidence supporting the assessment. Record missing information rather than filling the gap with assurances.
Have the chief risk officer own the exercise, with legal, technology and business owners contributing. Document who approved the classification approach and why. Give each significant gap an accountable owner and a realistic completion date, then bring the unresolved consequences to the committee. Directors should challenge the reasoning and follow-through; management should do the inventory work.
THE BOTTOM LINE
Your AI inventory should explain how the business uses these systems and why management considers the risks acceptable. When that explanation cannot be supported, the governance gap is already visible, whether or not an examination has begun.