Key AI, Cybersecurity, and Privacy Takeaways from the NAIC 2026 Spring Meeting

The National Association of Insurance Commissioners (NAIC) hosted its 2026 Spring National Meeting in San Diego, focusing on oversight of third-party data and models, insurer use of artificial intelligence, cybersecurity preparedness, and consumer privacy.
The NAIC is proposing a registry for vendors providing AI models and datasets to insurers, aimed at increasing regulatory visibility into third-party resources and ensuring proper governance practices.
Several states are launching AI evaluation pilot programs to assess how insurers use artificial intelligence and the associated governance practices.
Presentations emphasized operationalizing the NAIC AI model bulletin and governance best practices, including cross-functional governance committees and pilot testing.
There was a discussion on the use of agentic AI in insurance, highlighting its risks and strategies for mitigation, including accountability and human oversight.
NAIC’s Cybersecurity Working Group discussed a centralized event notification portal and the role of AI in accelerating and amplifying cybersecurity threats.
The Privacy Protections Working Group continued efforts to update the Privacy of Consumer Financial and Health Information Model Law, with a draft expected for public comment this year.
Insurers should prepare for increased regulatory scrutiny in AI governance, third-party risk management, agentic systems, and cybersecurity preparedness.

Key AI, Cybersecurity, and Privacy Takeaways from the NAIC 2026 Spring Meeting | Alston & Bird