Twenty-nine jurisdictions had adopted the NAIC's AI model bulletin by October 2026, Colorado replaced its general AI law in May 2026 while keeping its insurance-specific rules, and the EU moved high-risk obligations, including life and health insurance pricing, to December 2, 2027. What insurers using AI need to be able to show, and how to build it.
Regulators have mostly not banned anything. They expect insurers to know which AI systems they use, to govern them, and to be able to show the results are not unfairly discriminatory. That is an engineering problem as much as a legal one.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
An inventory of AI systems and predictive models: purpose, owner, data sources, decisions affected, vendor if any.
Documentation for each: how it was built or selected, what it was tested for, known limits.
Testing for unfair discrimination, repeated when the model or data changes.
Human review for adverse decisions where rules require it, and an explanation path for consumers.
Logs of inputs, outputs and model versions for decisions, kept long enough to answer a regulator or a complaint.
Oversight of vendors: contract rights to information and audits, not only a questionnaire.
Model registry and documentation: SageMaker Model Registry and model cards for trained models; the same inventory for LLM features, recording the Bedrock model ID and prompt version.
Decision logs: every scored application or claim written with inputs, output, model version and reviewer to an immutable store such as S3 with Object Lock.
Evaluation: scheduled bias and accuracy tests on held-out data, and Bedrock evaluations for generative features, with results stored next to the model version.
Human review: Amazon A2I or your own work queue for low-confidence or adverse outcomes.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
NYDFS Part 500 After November 2025: What Insurers Must Have in Place, Mapped to AWS
The amended Part 500 finished phasing in on November 1, 2025 with MFA for every user of every information system and a full asset inventory that records owner, location, classification, support end date and recovery time. What licensees must now have, the reporting clocks, and how each requirement maps to AWS services.
Read
Claims and Underwriting Documents on AWS: Textract, Bedrock Data Automation, or an LLM?
First notice of loss forms, medical records, police reports, loss runs, invoices and supplemental applications arrive as PDFs, scans and photos. Three ways to turn them into data on AWS, with current per-page prices, the accuracy you should measure, and the human review loop that keeps it safe.
Read
As of October 26, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.