Tracking State Filing Requirements and Regulatory Change: Software for Carriers and Multi-State MGAs (2026)

A carrier writing in forty states is subject to four separate streams of regulatory change, each arriving on its own schedule, in its own format, from its own source. 

The hard part is not finding out that a state issued something, but rather the distance between a bulletin landing on a website and an underwriter applying the right form edition to the right risk in the right state. That distance is where compliance programmes actually fail, and it is the part no tool on the market currently closes.

This article is a reference: what the four streams are, what issued in 2025 and 2026 with dates, how a change travels from a filing to an underwriting file, and what the monitoring tools do and do not cover.

Key takeaways

• The NAIC model bulletin wave is over. Twenty-one jurisdictions adopted it in 2024, four in 2025, one so far in 2026. What's left is divergence, not convergence — and divergence is harder to monitor than a standard.
• The national tracker is already behind. NAIC's own adoption map, updated to 31 August 2026, still represents Texas by a 2020 bulletin and does not reflect the AI bulletin Texas issued in June 2026.
• Colorado's quantitative testing rule was never adopted. It remains a 2023 draft. The Division said so itself as recently as October 2025. Anyone treating BIFSG testing as Colorado law is three years out of date.
• SERFF is a change source, not just a submission channel. Each state's Filing Rules are maintained inside it, and states push State Generated Messages when those rules change.
• Nobody connects a regulatory change to an underwriting file. We reviewed seven offerings in September 2026. Two get a change to a compliance officer's task queue. One gets a filing to a state. None documents the step in between.

The four sources of change a carrier must watch

1. NAIC model law and model bulletin adoption

The NAIC writes models; states decide whether to adopt them, when, and in what form. The Model Bulletin: Use of Artificial Intelligence Systems by Insurers, adopted by the NAIC Executive (EX) Committee and Plenary on 4 December 2023, is the current working example.

NAIC maintains an adoption map for it, and as of its 31 August 2026 revision that map lists 25 states plus the District of Columbia. NAIC does not print a total on the document; that figure is a count of its list.

Two things about that map matter a lot. First, the adoption pace: 21 of the 26 landed in 2024, four in 2025, one in 2026. Second, it lags. Texas issued Commissioner's Bulletin B-0003-26 on 12 June 2026, addressed to "all regulated entities and their agents and representatives" — but because Texas grounded it in the NAIC's 2020 AI principles rather than the model bulletin, Texas does not appear on the adoption list, and the map still represents the state by its 2020 bulletin. A registry built from the national tracker alone inherits that gap.

2. State bulletins and circular letters

This is the highest-volume stream and the one that has no central index. Every department publishes on its own site, in its own format, under its own naming convention (bulletins in most states, circular letters in New York, technical assistance advisories in Washington, administrative letters in Virginia, insurance guidance documents in Nebraska).

New York's Insurance Circular Letter No. 7 (2024), issued 11 July 2024, is the most demanding single instrument in the category and repays reading in full rather than in summary. Two sentences carry most of its operational weight:

"An insurer may not rely solely on a third-party's claim of non-discrimination or a proprietary third-party process to determine compliance with anti-discrimination laws. The responsibility to comply with anti-discrimination laws remains with the insurer at all times."

And on adverse decisions:

"An insurer may not rely on the proprietary nature of a third-party vendor's algorithmic processes to justify the lack of specificity related to an adverse underwriting or pricing action."

What those obligations require of a governance programme is covered in our guide to AI governance in insurance. What matters here is narrower: DFS has issued no further AI circular letter since. Absence is information too, and a monitoring function that only reports additions will never tell you that a rule has been stable for two years.

3. Form and rate filing requirements via SERFF

SERFF — the System for Electronic Rates & Forms Filing — is the NAIC platform through which filings reach the states. NAIC's Proposed 2026 Budget puts it at "53 jurisdictions and over 6,500 insurance industry users," handling "hundreds of thousands of transactions annually." Florida is the state outside it; it runs its own I-File system.

Most filers think of SERFF as a submission channel. It is also a requirements database. Each state maintains a Filing Rules set inside its own SERFF instance, and the SERFF training material is explicit about its status: "SERFF's Filing Rules database is a core piece of the application and this information is the basis for the creation of all filings in SERFF."

Four components sit under it — Requirements, General Instructions, Types of Insurance, and Submission Requirements — and the operative unit is narrower than most people assume. A state's requirement is defined against a specific Type of Insurance, Sub-Type, and Filing Type combination. "What does Ohio require?" is not an answerable question. "What does Ohio require for this TOI, this Sub-TOI, and this filing type?" is.

The change channel here is easy to miss: states issue State Generated Messages to subscribed industry users when Filing Rules or State Preferences change. That is a push notification about regulatory requirements, and it arrives in a system your filing team already uses.

The underlying regimes differ enough that "multi-state" understates the problem. California operates prior approval for property-casualty rates under Proposition 103 — Insurance Code § 1861.01(c) requires rates to be approved before use, with a 60-day deemer running from public notice and a 180-day backstop, and CDI's Bulletin 2024-7 layering a 60-day review with up to two 30-day extensions on top. Texas splits the two: forms are prior approval under Insurance Code Chapter 2301, rates are file-and-use under Chapter 2251. And a large share of Texas commercial lines is exempt from both. Per TDI's Filings Made Easy guide, D&O, employment practices, errors and omissions, cyber, commercial umbrella and excess, non-medical professional liability, commercial inland marine and highly protected commercial property are all exempt from form and rate filing — as is any risk meeting the large-risk thresholds of total insured values of $5 million, gross revenues of $10 million, or premium of $25,000 for property.

A program that files identically in both states is doing unnecessary work in Texas or non-compliant work in California.

4. Market conduct exam focus areas

The fourth stream is the one carriers tend to watch the least and get surprised by the most, because there is no published list of what examiners are currently looking for. There are, however, three authoritative proxies.

The first is the Market Regulation Handbook Examination Standards Summary, a free NAIC publication that extracts the examination standards from the Handbook itself. It organises every line-of-business chapter around the same seven areas: operations and management, complaint handling, marketing and sales, producer licensing, policyholder service, underwriting and rating, and claims. It also disclaims completeness in its own words — it "does not represent all examination standards, methodologies and areas of review that may be utilized by a department of insurance."

The second is the Market Conduct Annual Statement. What regulators newly ask for is a direct signal of what they are newly interested in, and the 2026 blanks contain a question worth knowing about: both the private passenger auto and homeowners blanks ask whether the company uses digital claim settlement and, if so, ask it to "list the names of the vendors providing third-party data and algorithms used in the digital claim settlement process." There is no AI line of business in MCAS and no AI data call inside it, but there is already vendor-level algorithm disclosure sitting in two of the thirteen blanks.

The third is committee work in progress. The Market Conduct Examination Guidelines (D) Working Group carries a 2026 charge to develop examiner guidance for overseeing regulated entities' use of consumer data and models using algorithms and artificial intelligence. Charges and draft chapters are public before they reach the Handbook, which makes them the earliest available read on exam direction.

What actually issued: 2025–26 state AI and compliance instruments

Dated, with the instrument type stated, because the distinction between adopting the NAIC model bulletin, issuing a different bulletin, and promulgating a regulation gets collapsed constantly — and the three carry different weight.

‍

‍

How to read this table. "NAIC model bulletin adoption" means the state issued a version of the NAIC model. "Standalone" means the state acted on its own authority or on a different framework. Dates are issue or adoption dates as the instrument states them; where a regulation's effective date differs, both appear. Michigan's 2026 bulletin is listed because it is routinely miscounted as an insurance instrument — the BT/CF/CU suffixes are banks and trust, consumer finance, and credit unions, and insurers are outside its scope. Michigan's insurance instrument remains Bulletin 2024-20-INS of August 2024.

Three states that people commonly assume acted in this window did not: New York, Connecticut and Nevada all still operate on their 2024 AI instruments. Vermont's 2024 AI bulletin also still stands, but Vermont did act, on aerial imagery, in August 2026.

The Colorado case, stated accurately

Colorado is worth separating out, because the version of it in circulation is wrong.

SB21-169, signed 6 July 2021, created C.R.S. § 10-3-1104.9 and directed the Commissioner to adopt rules by line of business requiring insurers to show they have tested external consumer data and models for unfair discrimination. The Division delivered the governance half: Regulation 10-1-1 took effect for life insurers in November 2023, and the amended version extended it to private passenger auto and health benefit plans effective 15 October 2025.

The quantitative testing half never arrived. The Division published a draft in September 2023 that would have mandated Bayesian Improved First Name Surname Geocoding to estimate race and ethnicity from applicant names and geolocation, with hard numeric thresholds — a five-percentage-point approval gap, a five percent premium disparity — triggering remediation. It carries a placeholder number, "New Regulation 10-2-xx," because none was ever assigned. Three years on it has not been adopted, and the Division's own Bulletin B-10.004, revised in October 2025, states plainly that it "has not yet adopted rules establishing the required quantitative testing."

That is why a monitoring function tracks proposals, not just adoptions. A carrier that is built to the 2023 draft spent three years complying with a rule that does not exist; a carrier that ignored it entirely missed the clearest available statement of where one regulator thinks testing is heading.

How a change actually reaches an underwriting file

A regulatory change has to travel five steps before it affects a risk decision, and each step is owned by a different team.

1. Filing. A statutory or bulletin change obliges a rate, rule or form filing, or a bureau issues a circular that does. Owner: state filings.
2. Form edition. The filing produces a new form or a new edition of an existing one, effective on a state-specific date. Owner: product.
3. Endorsement. The form becomes an endorsement available — sometimes mandatory — on policies in that state. Owner: product and operations.
4. Guideline. The underwriting guideline is updated to say when the endorsement attaches, to whom, and with what limits. Owner: underwriting.
5. Check. Someone verifies, on the actual file, that the right edition of the right form is attached in the right state. Owner: compliance, underwriting audit, or nobody.

Monitoring tools operate at step one. Filing services operate at steps one and two. Document and workflow platforms operate at step five. Steps three and four — the translation from a filed form into an operative underwriting instruction — are done in spreadsheets, email and institutional memory at most carriers we've seen, and they are where the chain breaks.

The break is not a tooling failure so much as a knowledge-ownership question. Which state version applies to which risk under which guideline is interpretation, and interpretation lives with your product and underwriting staff. The useful question for any vendor is therefore not whether they already know your rules, but whether you can load your rules in and have them applied to every file consistently.

The standardization problem for MGAs writing in 30-plus states

An MGA operating across thirty-plus states under delegated authority has the carrier's problem plus two of its own.

The first is that the binding authority agreement, not state law, is the immediate constraint. An MGA is accountable to each capacity provider for underwriting inside the agreed guidelines, and those guidelines vary by carrier as well as by state. A single risk can sit inside one carrier's appetite and outside another's, in the same state, on the same day.

The second is that the audit is external and periodic. Capacity providers audit delegated authority, and the audit is a file-level reconstruction of decisions made months earlier. Whatever was not recorded at the time is not available at audit.

Both problems reward the same thing: making the state and carrier rule explicit at the point of decision, and recording the check. That is a documentation discipline more than a software feature, though software is what makes it survivable at volume.

The one measured outcome we can point to here sits on the capacity side rather than the MGA side, and it is worth being precise about whose gain it is. In a delegated-authority audit engagement, a reinsurer auditing roughly twenty underwriting files per MGA against mutually agreed underwriting and rating guidelines cut each audit from about 200 hours to roughly 110 — a 45% reduction, achieved by automating the extraction and comparison work that consumed about half the total. The saving accrues to the auditor, not to the MGAs being audited. What it tells an MGA is different and still useful: the comparison your capacity provider will run against your files is now cheap enough to run more often.

Named carrier deployments exist — Upland Capital Group, an AM Best A– rated specialty property and casualty insurer, runs broker submission intake and clearance extraction on FurtherAI — but publishes no outcome figures. We'd rather say that than infer one.

How the monitoring tools cover this

We reviewed the public product material of seven offerings in September 2026 against five dimensions. There are two things worth knowing before reading it.

First, these are not seven versions of the same product. Two are producer licensing platforms whose "regulatory change" scope is licensing and appointment rules, not substantive insurance regulation. One is a horizontal governance, risk and compliance platform that licenses its regulatory content from third parties rather than producing it. One is primarily a filings services firm with software attached. The category column says which is which, and three empty cells on a licensing platform mean it is differently scoped, not deficient.

Second, vendors are listed alphabetically, and this is a capability matrix rather than a ranking.

‍

‍

How to read this table. "Documented" means the capability is described in the offering's own public product material. "Partial" means an adjacent capability is described but not the specific one. "Not documented" means we could not verify it publicly, which is not the same as saying it doesn't exist — most of these gate their real documentation behind a login and publish marketing pages instead. Vendor links are omitted deliberately; assess each against your own requirements.

What the matrix shows

The last column is empty across every row, and it is the column that matters.

Wolters Kluwer and RegEd both get a monitored change to a compliance officer's task queue with an audit trail behind it. Perr&Knight gets a filing to a state, and is the only one of the seven that publicly documents a direct SERFF integration — a two-way API with its StateFilings.com platform, announced in 2022.

FurtherAI checks underwriting files against rules, with citation back to the source document. Nobody documents the connection between the first thing and the last.

One distinction is worth spelling out, because the wording invites a misreading. RegEd's policies and procedures product integrates with its change management product to flag "which policies require action as a result" of a change. Those are internal compliance policies — the documents your compliance department maintains — not insurance policy forms. It is a real and useful capability, and it is not form impact analysis.

On our own row: FurtherAI documents no regulatory change monitoring, and we have said so before. Our multi-state compliance for national brokers guide recommends pairing a regulator system of record with an operational compliance layer and a document workflow tool, because no single product covers the span. That is still the honest answer. What we do cover is step five — checking the file against the rule and citing the evidence — which is why the row reads Partial rather than Documented on the underwriting column, and empty on the three before it.

For the adjacent question of running those checks inside the underwriting workflow itself, see AI underwriting compliance software.

What good looks like

‍

An operating model that survives a market conduct exam has five components. None of them is a product.

A named owner per stream. Someone owns NAIC and model adoption, someone owns bulletins and circular letters, someone owns filings, someone owns exam readiness. Four streams, four names. Shared ownership of all four means ownership of none.

An inventory keyed to the thing that changes. Not a list of states. A list of form and edition combinations by state, with the filing behind each, so that when an edition changes you can answer which policies are affected in under an hour.

A triage rule set before the alert arrives. Decide in advance what makes a change material — effective date inside 90 days, affects a line you write, requires a form change — so triage is a filter rather than a meeting.

Rules recorded where the decision happens. The state-specific instruction belongs in the guideline the underwriter applies, not in a compliance memo they will not open. If software enforces the guideline, the rule goes in the software.

A contemporaneous record of the check. Which file, which rule, which reviewer, which date, and the source document behind each. Reconstructed records are worth less at exam than recorded ones, and this is the component most often skipped because it produces nothing visible until the day it is needed.

Frequently asked questions

‍

REFERENCES

^{California Department of Insurance. "Bulletin 2024-7: Revisions to Department Review of Complete Rate Applications." 9 August 2024. insurance.ca.gov}

^{California Department of Insurance. "Proposition 103 Intervenor Program." insurance.ca.gov}

^{Colorado Division of Insurance. "DRAFT Proposed Algorithm and Predictive Model Quantitative Testing Regulation." 28 September 2023. doi.colorado.gov}

^{Colorado Division of Insurance. "Notice of Adoption: New Regulation 10-1-1, Governance and Risk Management Framework Requirements." 21 September 2023. doi.colorado.gov}

^{Colorado Division of Insurance. "Notice of Adoption: Amended Regulation 10-1-1." 20 August 2025. doi.colorado.gov}

^{Colorado Division of Insurance. "Notice of Adoption: Bulletin B-6.05 and Revised Bulletins B-4.148 and B-10.004." 22 October 2025. doi.colorado.gov}

^{Colorado General Assembly. "SB21-169: Restrict Insurers' Use of External Consumer Data." Signed 6 July 2021. leg.colorado.gov}

^{National Association of Insurance Commissioners. "Implementation of NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers." Status as of 31 August 2026. content.naic.org}

^{National Association of Insurance Commissioners. "Market Conduct Annual Statement." content.naic.org}

^{National Association of Insurance Commissioners. "Market Conduct Examination Guidelines (D) Working Group." content.naic.org}

^{National Association of Insurance Commissioners. "Market Regulation Handbook Examination Standards Summary." 2025 edition. content.naic.org}

^{National Association of Insurance Commissioners. "Model Bulletin: Use of Artificial Intelligence Systems by Insurers." Adopted 4 December 2023. content.naic.org}

^{National Association of Insurance Commissioners. "Proposed 2026 Budget." October 2025. content.naic.org}

^{National Association of Insurance Commissioners. "SERFF." content.naic.org}

^{National Association of Insurance Commissioners. "SERFF State Participation." content.naic.org}

^{New York State Department of Financial Services. "Insurance Circular Letter No. 7 (2024): Use of Artificial Intelligence Systems and External Consumer Data and Information Sources in Insurance Underwriting and Pricing." 11 July 2024. dfs.ny.gov}

^{SERFF. "End User Training Manual, Lesson 3: Filing Rules." login.serff.com}

^{SERFF. "State Generated Messages." login.serff.com}

^{Texas Department of Insurance. "Commissioner's Bulletin # B-0003-26: Use of artificial intelligence." 12 June 2026. tdi.texas.gov}

^{Texas Department of Insurance. "Filings Made Easy Guide." May 2025. tdi.texas.gov}

‍

DISCLAIMER 

This article is for general informational purposes only and does not constitute legal, regulatory, compliance, underwriting, or other professional advice. The content reflects information available as of the date of publication, and FurtherAI undertakes no obligation to update it as laws, regulations, or AI technologies evolve. 

‍