Changelog

Technical build v0.4: corrected the cost estimate to three to five engineer-weeks (the table sums to 16.5 to 26.5 engineer-days); named the approval-gated prompt-promotion pipeline as a legitimate artifact when prompts must stay in a SaaS (Control 2); noted the timer-based config hot-reload exposure (Control 3); added the approval and deny asymmetry, found inverted in the wild, to Control 5; and allowed a gated pre-release evaluation job rather than a run on every commit (Control 6). Reviewed and contributed by Kaio Pedreira.

Methodology v0.2: clarified that criteria score 0/25/50/75/100 on a full review, while the interactive readiness check uses a three-point fast-track (Yes 100, Partly 50, No 0), and pointed the readiness-check section at the interactive tool. Reviewed and contributed by Kaio Pedreira.

The NAIC released version 5.0 of the AI Risk Evaluation Supplement at the Aug 31 Working Group meeting, superseding draft 4.0 (issued as a clean version with a separate summary of changes). It reframes the Supplement as a supplement to the existing examiner handbooks, an examination instrument rather than a new filing. Exhibit A now separates AI systems from AI models and adds a named model inventory; Exhibit B refocuses on the company's AIS Program, adds an explainability and transparency question, and strengthens the delegated-authority reach-through (narrative Q4 now names material AI systems run by third parties, including actuarial, claim, MGA, and audit services), with new checklist questions on materiality (3o) and third-party model oversight (3p); Exhibit C centers the model, adds provenance fields, and assigns a per-model high, moderate, or low risk rating; Exhibit D adds data-reliance and data-dictionary provisions; and definitions align to NIST, the 2023 Model Bulletin, and the Financial Condition Examiners Handbook (materiality and inherent risk assessed before controls). GLMs remain in scope, with regulator discretion to narrow inquiry after Exhibit A. This guide's exhibit walkthroughs and readiness criteria are being reconciled to 5.0; the timeline and this changelog reflect the release now.

Readiness check rebuilt as a guided, five-pillar self-assessment: 25 criteria mapped 1:1 to the methodology, live per-pillar and weighted composite scoring, save and resume in the browser, and a gap list that links each gap to the control that closes it. Adds an optional AI-written readiness memo and an optional emailed summary. Shaped by an interactive prototype and thinking shared by James Addison Moore (Corecreek).

Technical build v0.3: removed the redundant "Exhibit B" before "checklist" references (Controls 2, 4, 7, 8; Controls 5 and 9 already read cleanly); added a model retirement_date to the register with a CI rule that fails as a vendor deprecation date nears (Control 1); clarified the Control 4 replay assertion to compare the decision and customer-facing fields, not the raw response or confidence, which vary between runs. Reviewed and contributed by Dulce Hernandez Cruz.

Reporting v0.1 added: six-section AI governance bordereaux, four reporting flows, board summary.

Workflow map v0.1 added: deterministic, probabilistic, and human placement across submission, quote, bind, endorsement, COI, claims, renewal, bordereaux, billing, and service.

Vendors v0.1 added: nine-section evidence checklist and fourteen-clause AI vendor schedule.

Tiering v0.1 added: four-input scheme, four tiers, control matrix, GLM scope position.

Methodology v0.1 and technical build v0.2 drafted against Supplement draft 4.0. State tracker seeded from the NAIC implementation map (status April 1, 2026) and the 12-state pilot roster.

NAIC Summer National Meeting: the Working Group renames the AI Systems Evaluation Tool to the AI Risk Evaluation Supplement.

Pilot reaches 12 states with California joining; pilot window runs March to September 2026.