AI Acceptable Use Policy for Insurance Agencies

Most insurance agencies already use AI, whether or not anyone decided to. A producer pastes call notes into a chatbot to clean them up. A CSR asks a free tool to draft a renewal email. A new agent uses a browser extension that summarizes carrier guides. None of that is wrong on its own, but without written rules, every person on the team is making their own judgment calls about client data, accuracy, and carrier contracts. An AI acceptable use policy turns those private judgment calls into one standard the whole agency follows. This article explains why agencies need one, what the industry and regulators already say, and what a practical policy should cover.

Why an AI acceptable use policy matters now

AI tools rarely arrive through a formal purchase. They show up inside software the agency already pays for, or as free tools a producer finds on their own. The Independent Insurance Agents & Brokers of America (IIABA) makes this point in its legal memo on acceptable uses of AI, noting that “AI is being quickly incorporated into existing technology products and services” even for agencies that never went looking for it.

That memo groups the risks into a few buckets that map closely to daily agency work:

• Data privacy and security. Client information typed into a third-party tool may be stored on that vendor’s servers and used in ways the agency never intended.

• Quality and accuracy. AI output can include confident statements that are simply false. The memo gives the example of “an agency chatbot inadvertently misleading a client about coverage.”

• Contractual restrictions. The IIABA warns that “some carriers may begin to prohibit the use of AI in connection with carrier data without express prior permission,” and says its counsel had already reviewed an appointment agreement with that kind of language.

• Regulatory exposure. Automated decisions in regulated areas can create bias and compliance problems, even when no one intended them.

A written policy does not remove these risks. It makes sure everyone on the team handles them the same way, and it gives the owner something concrete to train against and enforce.

What regulators expect from carriers, and why agencies should pay attention

The National Association of Insurance Commissioners (NAIC) adopted its Model Bulletin on the Use of Artificial Intelligence by Insurance Companies in December 2023. According to the NAIC’s artificial intelligence topic page, the bulletin “sets forth expectations as to how insurers will govern the use of AI” and reminds insurers that decisions made or supported by AI must comply with all applicable insurance laws and regulations.

The bulletin is addressed to insurers, not producers. But carriers that have to document their own AI governance tend to ask the same questions of the agencies that sell their products. The NAIC page also describes an AI Systems Evaluation Tool that regulators can use to gather information about a company’s AI use, governance and risk mitigation practices, and the data that feeds its AI systems, with 12 states piloting it as of March 2026. We walk through the bulletin in more depth in what the NAIC’s AI rules mean for life insurance agents.

Adoption on the carrier side is uneven. In the NAIC survey results summarized on that same page, 58% of the 161 life companies that responded said they use, plan to use, or plan to explore AI or machine learning models in their operations. In practice, that means the carriers your agency works with are likely at very different stages, and their contract language may change as they catch up.

Borrowing a structure from the NIST AI framework

Agencies do not need to invent a governance model from scratch. The National Institute of Standards and Technology (NIST) published the AI Risk Management Framework, a voluntary framework built around four functions: Govern, Map, Measure, and Manage. The Govern function is the part most relevant to a small or mid-sized agency, and several of its outcomes read almost like a policy checklist:

• Know the rules. “Legal and regulatory requirements involving AI are understood, managed, and documented.”

• Keep an inventory. “Mechanisms are in place to inventory AI systems and are resourced according to organizational risk priorities.”

• Train people. Personnel and partners receive AI risk management training so they can do their jobs consistent with the organization’s policies.

• Define human oversight. Policies and procedures “define and differentiate roles and responsibilities for human-AI configurations and oversight of AI systems.”

• Cover third parties. Policies address AI risks that come from outside vendors and partners.

An agency does not have to adopt the full framework to benefit from it. Those five outcomes are a solid skeleton for a policy that fits on a few pages.

What to include in your agency’s AI policy

The sections below combine the IIABA’s suggested limits with the NIST Govern outcomes. Adjust them for your agency’s size, lines of business, and carrier contracts, and have your own counsel review the final version.

1. Approved tools list

Name the AI tools staff may use for work, and say what each one is approved for. Anything not on the list needs a manager’s sign-off before anyone uses it with client or carrier information. This is the agency version of the NIST inventory outcome, and it is the single most useful line in the policy because it makes shadow tools visible. Our guide to vetting AI vendors for an insurance agency covers what to check before a tool earns a spot on the list.

2. Data rules

Spell out what information may never go into an AI tool that has not been approved for it. The IIABA memo puts the baseline plainly: “employees should not be permitted to input confidential, proprietary or sensitive information, such as PII, without adequate protections in place.” For a life insurance agency, that usually means names, dates of birth, Social Security numbers, health history, medications, and policy numbers. Our article on client data privacy and AI tools goes deeper on what to share and what to hold back.

3. Human review before anything leaves the agency

No AI-generated content goes to a client, carrier, or regulator without a licensed person reviewing it. The IIABA calls it “essential for users to carefully review, edit and monitor the quality and accuracy of AI outputs.” That applies to emails, proposals, coverage explanations, and application notes. AI tools can produce plausible but wrong statements, a problem we cover in AI hallucinations in insurance.

4. Carrier contract check

Before using AI with carrier materials, quotes, or underwriting guides, confirm the appointment agreement allows it. Keep a short note of which carriers have AI language in their contracts and what it says. If a contract is silent, the safest reading is to ask the carrier rather than assume.

5. Client disclosure

Decide how agents tell clients that software helped prepare a recommendation. A single plain sentence during the fact-find usually works: software helped compare options, the agent made the recommendation, and the carrier makes the final underwriting decision.

6. Training and acknowledgment

Every team member reads the policy, signs an acknowledgment, and gets a short refresher when the approved tools list changes. New hires get it during onboarding, not months later.

7. Incidents and review

Give staff a simple way to report an AI mistake or a data slip without fear of blame, and log what happened. Review the whole policy on a fixed schedule, such as twice a year, because both the tools and carrier contracts change quickly.

A policy is a starting point, not a control system

A written policy is only as good as the habits behind it. If the approved tools list is two years old, or nobody checks whether producers follow the data rules, the document gives a false sense of safety. The agencies that get this right treat the policy as a living checklist: the owner reviews the tools list, managers spot-check AI-assisted work, and the team knows who to ask when a new tool shows up.

Tool choice matters too. Software built for a specific job, like a quoting tool such as Peach Quote, is easier to list, review, and train on than a general chatbot that staff use for everything. Whatever tools you approve, the same principle holds: the agent owns the advice, and the carrier owns the decision.

Frequently asked questions

Do small agencies really need an AI policy?

Yes. A two-page policy with an approved tools list, data rules, and a human review requirement covers most of the risk for a small team, and it can be written in an afternoon.

Does the NAIC Model Bulletin apply directly to agents?

The bulletin is addressed to insurance companies, not producers. Agencies feel it indirectly, through carrier contracts, audits, and questions from the carriers they represent.

Where can I find a sample policy?

The IIABA memo linked above includes a template agencies can adapt. Your E&O carrier or state agent association may also offer one. Have your own counsel review any template before you adopt it.

Peach Pilot supports licensed agents’ workflow. Carriers make final underwriting and issue decisions.