Changelog

The readiness methodology and the interactive check were rebuilt against version 5.0. Six criteria were added to the existing twenty-five: a defended materiality threshold and model-type and impact flags in inventory, page-addressable evidence in governance, explainability in validation, model-to-data reliance in data provenance, and evidence of what a human reviewer actually checks in consumer controls. Every criterion is now tagged to an exam-funnel stage, and the result screen shows four stage bars (Exhibit A, B, C, D) and one line on how far down the funnel you would survive, because version 5.0 runs as a funnel: every company is asked whether it uses AI, then Exhibit A, then often B, and only a risk-selected set of models reaches C and D. The pillar weights shift to reflect that Exhibit A now gates the exam: inventory rises to 25 percent and consumer controls fall to 10 percent. The scoring math (pillar mean, weighted composite, and the exam-ready, defensible, exposed, and undocumented bands) is unchanged. Still orientation only, not a certification.

The exhibit walkthroughs, the reference appendix, and all six guide parts are now reconciled from draft 4.0 to version 5.0. Exhibit A separates AI Systems counts from AI Models counted by type (GLM, generative or agentic, other) under Direct Consumer Impact and again under Material Financial Impact, drops the Legal/Compliance and Producer Services rows, and adds Part Two's request list with a seven-field Model Inventory. Exhibit B is the AIS Program, every checklist answer cites a document name and page, and the checklist runs 3a through 3p (new 3o materiality threshold, new 3p vendor-developed model oversight) with new narrative 3d on explainability. Exhibit C expanded from 13 to 15 fields and was renumbered throughout (use case moved to C2, a new C6 on purchase and modification, risks and limitations split into C8 and C9), with the crosswalk applied to every field reference across the guide. Exhibit D adds the reliant-systems header field and a possible data-dictionary request. The reference appendix carries the version 5.0 definitions (agentic AI, AI Model, AIS Program, Direct Consumer Impact, GLM, materiality, Material Financial Impact, third party), and Degree of Potential Harm to Consumers is removed. The readiness check's reference labels were updated to the 5.0 numbering; its scoring and questions are unchanged pending a later rebuild. Every section was pressure-tested against the NAIC version 5.0 text.

The toolkit now carries a version-status layer: every page states which Supplement version it tracks (currently 5.0, exposed Aug 31, 2026, not adopted) and the next NAIC date, from one source of truth, so a new version is a data edit rather than scattered string changes. The regulatory timeline is refreshed to the state of play after the Oct 8 Working Group call: written comments closed Sep 29; 33 comment letters were posted Oct 2 (industry pressing to narrow scope, a pilot-state regulator and the Consumer Representatives to sharpen it); at the Oct 8 call regulators signaled an examination funnel (is AI used, then Exhibit A, then often B, then C and D for a risk-selected set of models) is coming in writing, that existing company documents may be submitted in lieu of the templates, and that requests to remove Exhibits C and D were declined. A Working Group call is scheduled Nov 2, with version 7.0 considered for adoption at the Fall National Meeting, Nov 14 to 17. The guide's exhibit walkthroughs and readiness criteria are still being reconciled from draft 4.0 to 5.0; that content pass follows.

Added a model-selection section to the workflow map: once a placement is probabilistic, how to choose between a frontier model and an open-weight one. It starts on the two axes that move fastest, task-specific efficacy and cost per token, then applies the overlays that decide it in insurance: whether the data can leave your boundary (Exhibit D), whether you can reproduce the output and pin the version (Controls 1 and 3), who owns the validation (Q3b), and the tier (Part 3). It also names current picks by task (field extraction, classification and scoring, drafting, and reasoning-assist), with a frontier and an open-weight option for each, ranked from BenchmarkList's public data API by capability against price. Picks are a dated snapshot with the query to refresh them, not an endorsement of any model or vendor.

Technical build v0.4: corrected the cost estimate to three to five engineer-weeks (the table sums to 16.5 to 26.5 engineer-days); named the approval-gated prompt-promotion pipeline as a legitimate artifact when prompts must stay in a SaaS (Control 2); noted the timer-based config hot-reload exposure (Control 3); added the approval and deny asymmetry, found inverted in the wild, to Control 5; and allowed a gated pre-release evaluation job rather than a run on every commit (Control 6). Reviewed and contributed by Kaio Pedreira.

Methodology v0.2: clarified that criteria score 0/25/50/75/100 on a full review, while the interactive readiness check uses a three-point fast-track (Yes 100, Partly 50, No 0), and pointed the readiness-check section at the interactive tool. Reviewed and contributed by Kaio Pedreira.

The NAIC released version 5.0 of the AI Risk Evaluation Supplement at the Aug 31 Working Group meeting, superseding draft 4.0 (issued as a clean version with a separate summary of changes). It reframes the Supplement as a supplement to the existing examiner handbooks, an examination instrument rather than a new filing. Exhibit A now separates AI systems from AI models and adds a named model inventory; Exhibit B refocuses on the company's AIS Program, adds an explainability and transparency question, and strengthens the delegated-authority reach-through (narrative Q4 now names material AI systems run by third parties, including actuarial, claim, MGA, and audit services), with new checklist questions on materiality (3o) and third-party model oversight (3p); Exhibit C centers the model, adds provenance fields, and assigns a per-model high, moderate, or low risk rating; Exhibit D adds data-reliance and data-dictionary provisions; and definitions align to NIST, the 2023 Model Bulletin, and the Financial Condition Examiners Handbook (materiality and inherent risk assessed before controls). GLMs remain in scope, with regulator discretion to narrow inquiry after Exhibit A. This guide's exhibit walkthroughs and readiness criteria are being reconciled to 5.0; the timeline and this changelog reflect the release now.

Readiness check rebuilt as a guided, five-pillar self-assessment: 25 criteria mapped 1:1 to the methodology, live per-pillar and weighted composite scoring, save and resume in the browser, and a gap list that links each gap to the control that closes it. Adds an optional AI-written readiness memo and an optional emailed summary. Shaped by an interactive prototype and thinking shared by James Addison Moore (Corecreek).

Technical build v0.3: removed the redundant "Exhibit B" before "checklist" references (Controls 2, 4, 7, 8; Controls 5 and 9 already read cleanly); added a model retirement_date to the register with a CI rule that fails as a vendor deprecation date nears (Control 1); clarified the Control 4 replay assertion to compare the decision and customer-facing fields, not the raw response or confidence, which vary between runs. Reviewed and contributed by Dulce Hernandez Cruz.

Reporting v0.1 added: six-section AI governance bordereaux, four reporting flows, board summary.

Workflow map v0.1 added: deterministic, probabilistic, and human placement across submission, quote, bind, endorsement, COI, claims, renewal, bordereaux, billing, and service.

Vendors v0.1 added: nine-section evidence checklist and fourteen-clause AI vendor schedule.

Tiering v0.1 added: four-input scheme, four tiers, control matrix, GLM scope position.

Methodology v0.1 and technical build v0.2 drafted against Supplement draft 4.0. State tracker seeded from the NAIC implementation map (status April 1, 2026) and the 12-state pilot roster.

NAIC Summer National Meeting: the Working Group renames the AI Systems Evaluation Tool to the AI Risk Evaluation Supplement.

Pilot reaches 12 states with California joining; pilot window runs March to September 2026.