That assumption is partially correct. And partially wrong in a way that will only become clear when an examiner arrives, a plaintiff’s lawyer sends a subpoena, or a claimant’s attorney files a discovery request.

The gap between “we have AI governance” and “we can prove what governed this specific decision” is the gap most carriers have not yet closed. This article explains why it exists, what it costs, and what closing it actually requires.

Two Different Questions Regulators Ask

Start with the distinction that matters. There are two separate questions in play when a regulator examines an insurer’s AI program:

Question One — System governance: Do you have appropriate governance structures around your AI systems? Is there an inventory? Are risks assessed? Is there human oversight? Are bias tests documented?

Question Two — Decision governance: For this specific AI-assisted decision made on this specific date — what compliance policy version was the AI operating under? Who reviewed it? Was the AI recommendation followed or overridden? If overridden, why?

“Most governance programs answer Question One well. Almost none answer Question Two reliably — because they were never designed to.”

These are not the same question. They require different infrastructure to answer. And confusing them — treating a well-documented system governance program as proof that decision governance exists — is the gap that surfaces when scrutiny arrives.

What the NAIC Actually Asks For

The NAIC AI Systems Evaluation Tool, currently being piloted across 12 states with nationwide adoption expected in November 2026, organizes examination questions across four exhibits. Understanding which exhibit addresses which question is essential.

Most governance programs are built to satisfy Exhibits A, C, and D. They have inventories. They have bias testing. They have data documentation.

Exhibit B is the one that breaks them. Because Exhibit B asks not just whether governance policies exist — but whether you can demonstrate, at the individual decision level, that those policies were actually in force when the decision happened.

The Lokken Case — What Discovery Actually Looks Like

In February 2025, a federal court allowed breach of contract and bad faith claims to proceed in Estate of Lokken v. UnitedHealth Group. In March 2025, the court granted broad discovery into UnitedHealthcare’s AI-driven claims processes.

Gene Lokken’s Medicare Advantage coverage had been denied by an AI tool called nH Predict — a model with a reported 90% error rate on appeals. He paid $12,000 to $14,000 per month out of pocket until he died.

The discovery order required production of: all versions of evidence of coverage documents, expected versus actual denial rates, all AI-driven decisions across the relevant period, employee performance evaluations, and financial information on Medicare Advantage revenue.

The Lokken ruling is not an outlier. It is a preview. Every carrier using AI in claims, underwriting, or pricing decisions faces the same potential exposure. The question is whether the evidence infrastructure exists before the letter arrives.

Why System Governance Doesn’t Solve the Decision Governance Problem

A well-built AI system governance program typically provides:

• A centralized AI inventory with risk classifications
• Documented bias testing results per model
• Oversight structures with named roles and responsibilities
• An audit log of governance activities — models registered, assessments completed, approvals recorded
• Framework mapping across NAIC, NIST AI RMF, Colorado AI Regulation

This is genuine governance infrastructure. It answers Exhibit A, C, and D questions. It demonstrates that the carrier has a functioning governance program at the system level.

What it does not provide:

• A record of which compliance policy version was active when this specific decision was made
• Evidence that the AI was operating under the current policy — not an outdated version from before the last policy update
• The identity of the human reviewer who reviewed the AI recommendation for this decision
• Documentation of whether the reviewer agreed with or overrode the AI recommendation, and why
• A cryptographically tamper-evident record that the above evidence has not been altered since the decision was made

The Policy Version Drift Problem

Insurance compliance policies change frequently. Underwriting guidelines update with new regulatory guidance. Claims handling procedures change after case law developments. Pricing rules are revised for new product filings.

AI systems do not automatically update when policies change. The update process — from policy revision to model retraining or prompt update to production deployment — takes days, weeks, or sometimes months depending on the carrier’s technical infrastructure.

During that gap, the AI is operating under an outdated policy. It is applying old rules to new decisions. And unless there is a system explicitly designed to detect and log this — what the NAIC Model Bulletin calls “model drift” — nobody knows it is happening until someone asks.

What Decision-Level Governance Actually Requires

Closing the gap between system governance and decision governance requires capturing specific evidence at the moment each AI-assisted decision is made. Not assembled before the audit. Not reconstructed from logs. Captured at execution time.

The minimum field set for a defensible AI decision record under NAIC Exhibit B requirements:

The key insight in this field set: most of these fields are not captured by system governance programs. They require a separate layer — one that operates at the individual decision level, continuously, from the moment AI enters a compliance-sensitive workflow.

The “Reconstruction Replacing Proof” Problem

When an examiner or plaintiff requests evidence of what governed an AI decision six months ago, there are two possible answers.

The first is reconstruction: pulling logs from multiple systems, checking version control history for model configurations, cross-referencing the compliance policy register, interviewing the people involved, and assembling a narrative. This takes days. The evidence is fragile. It can be contested. And it signals to the examiner that governance was not continuous — it was assembled for the purpose of the examination.

The second is proof: producing a timestamped, cryptographically hashed decision record that was created at the moment the decision was made, showing the policy version, the AI recommendation, the reviewer, and the outcome. This takes minutes. The evidence is tamper-evident. It cannot be contested on the basis of reconstruction. And it signals to the examiner that governance was baked into the workflow — not added afterward.

“The organisations that thrive in regulatory scrutiny will not just be the ones that move faster. They will be the ones that preserve evidence at execution — before reconstruction becomes necessary.”

The difference between reconstruction and proof is not a technology problem. It is an infrastructure decision. Carriers that build decision governance infrastructure before the examination avoid the reconstruction problem entirely. Carriers that wait build it under examination pressure — which is the worst possible time.

How This Fits Into Your Existing Governance Program

Decision governance does not replace system governance. It completes it. Think of it as two layers that work together

A carrier with strong system governance but no decision governance has a program that looks complete on paper but breaks under examination when Exhibit B questions arrive.

A carrier with both layers has governance that is genuinely defensible — not just at the system level, but at the decision level, for every AI-influenced outcome that could later be challenged.

Three Questions to Test Your Current Program

Before your next NAIC examination or market conduct review, ask these three questions of your current AI governance infrastructure:

Question 1

If an examiner named a specific AI-assisted underwriting or claims decision from six months ago and asked which compliance policy version was active when that decision was made — how would you answer? How long would it take? What would the evidence look like?

Question 2

Between your last compliance policy update and the next time your AI model was updated to reflect that change — how many decisions did the AI make under the outdated policy? Do you have a record of those decisions and which policy version governed each one?

Question 3

For AI-assisted claims decisions in your portfolio — do you have a timestamped record of the licensed adjuster who reviewed each AI recommendation, whether they agreed or overrode it, and if they overrode it, why?

If the answer to any of these involves the phrase “we would need to check with engineering” or “it would take a few days to reconstruct,” your system governance program is functioning — but your decision governance infrastructure does not yet exist.

What Good Looks Like

An insurer with mature decision governance infrastructure can do the following, on demand, without involving engineering teams:

Examination-Ready Decision Governance

For any AI-assisted decision in the past 36 months: produce a timestamped, tamper-evident evidence pack showing the exact compliance policy version in effect at decision time, the AI recommendation and confidence score, the identity and licence number of the reviewing adjuster, the final human decision, any override and its documented reason, and a cryptographic hash proving the record has not been altered since it was created. Response time: under one hour. No engineering involvement required.

This is not a theoretical standard. It is what the NAIC Exhibit B documentation requirements, the Lokken discovery ruling, and the emerging landscape of state AI insurance regulations are converging toward. The carriers that build it now build it on their own terms. The ones that wait build it under examination pressure.

The Path Forward

Decision governance infrastructure does not require replacing existing system governance programs. It requires adding a continuous capture layer that operates at the individual decision level — logging the policy version, the AI output, the human reviewer, and the outcome, with cryptographic integrity, for every AI-assisted decision that could later be subject to regulatory or legal scrutiny.

The starting point is not a technology procurement decision. It is an honest assessment of whether your current program can answer the three questions above. If it cannot, the gap is real. The timeline for closing it, given the NAIC examination tool’s 2026 nationwide adoption, is shorter than most programs currently assume.

The examination does not ask whether you intended to have governance. It asks whether you can prove what governed each decision when it happened.

How prepared is your program for Exhibit B?

Take the 60-second NAIC Readiness Assessment and find out where your decision governance gaps are.

Take the Assessment →

PolicyProof is live at policyproof.vercel.app

References and regulatory sources: NAIC AI Systems Evaluation Tool Pilot — 12 states, launched March 2026. Nationwide adoption expected November 2026 NAIC Fall Meeting. · NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers — 24 states adopted as of 2026. · Estate of Lokken v. UnitedHealth Group, D. Minn. 2023–2025 — February 2025 ruling allowing breach of contract and bad faith claims to proceed; March 2025 broad discovery order. · Colorado AI Insurance Regulation — expanded to auto and health insurers October 2025. · Colorado SB 21–169 / SB26–189 — automated decision-making technology disclosure requirements. · NIST AI Risk Management Framework 1.0 — voluntary framework referenced across 7 of 31 research sources. · SR 26–2 — Federal Reserve model risk management guidance replacing SR 11–7, April 2026.