Welcome back to The Silent Line. This issue tracks what has moved since our inaugural briefing in September. The topics this month include a revised set of Colorado ADMTA rules heading into an October 26 hearing, with a federal constitutional challenge and the Department of Justice waiting in the wings; a federal preemption debate that has taken concrete legislative shape; a Texas Attorney General case against Allstate and Arity now set for a February 2027 jury trial; a new voluntary White House accord with frontier AI developers; and a continued hardening of the AI-exclusion market.
In this issue: Regulatory Radar, Docket Watch, Market Signals, and One to Watch.
REGULATORY RADAR
U N I T E D S T A T E S — N A I C
AI Systems Evaluation Tool relaunches as the "AI Risk Evaluation Supplement," version 5.0
The tool we introduced last month has a new name and a new version number. On August 31, 2026, the NAIC's Big Data and Artificial Intelligence (H) Working Group released version 5.0 of what is now called the AI Risk Evaluation Supplement, with a comment period running through September 29, 2026. The rename reflects more than just a branding exercise. The new Exhibit B has been reframed around a carrier's formal "AIS Program" rather than the looser "governance framework" language of v4.0, and the tool now explicitly scopes in agentic AI. This may signal that the NAIC intends the framework to be flexible with the technology rather than requiring a rewrite each time a new capability emerges. The underlying pilot, run by the same twelve states identified in Issue No. 1 (California, Colorado, Connecticut, Florida, Iowa, Louisiana, Maryland, Pennsylvania, Rhode Island, Vermont, Virginia, and Wisconsin), concluded as scheduled at the end of September, with formal adoption anticipated at the NAIC's Fall National Meeting, set for November 14–17, 2026 in Dallas.
WHAT THIS MEANS FOR UNDERWRITERS AND PRODUCERS
- Carriers that began preparing AI governance files under the 0 exposure draft should revisit them against the v5.0 Exhibit B language before the fall adoption vote. This shift to "AIS Program" framing may require restructuring existing documentation rather than simply supplementing it.
- If your AI use includes any agentic or multi-step autonomous functionality, expect that to be a specific line of inquiry once the tool is formally adopted. Document those systems now rather than reactively.
C O L O R A D O
Revised ADMTA rules head to an October 26 hearing with a constitutional challenge in the wings, while Regulation 10-1-1 reporting is now live
Colorado's rulemaking clock, discussed in Issue No. 1 as a pending open question, has started running in earnest. On August 11, 2026, the Colorado Attorney General's Office filed proposed rules (4 CCR 904-6) implementing the Automated Decision-Making Technology Act (ADMTA) alongside the related Chatbot Safety Act, together with a notice of rulemaking hearing. On October 6, 2026, the Department of Law released a revised draft. The revision takes a position on the threshold question the August draft left open, i.e., when a system "materially influences" a covered consequential decision. Under new Rule 6.1, an automated output is presumed to materially influence a decision if it constrains an option set, sets a threshold, or produces a rank, score, classification, recommendation, prediction, or other inference that pertains to the individual, is reviewed by the decision-maker (or is used to screen the data the decision-maker sees), and is consistent with the outcome. A deployer may rebut the presumption with evidence that the output was a de minimis factor. Such evidence might include the following: the decision-maker did not consult it, applied a hard cut-off or threshold that is consistently applied to all consumers, or independently reviewed substantial other relevant information with the authority and subject- matter understanding to decide on that basis. For claims and underwriting operations, the practical takeaway is this: under the revised draft, a score or recommendation that an adjuster or underwriter sees, and whose outcome matches the decision, will be presumed to "materially influence" that decision, bringing the tool within the ADMTA, unless the carrier can show the output was only a de minimis factor, which in practice means documenting independent judgment. The draft's new definition of "De Minimis Factor" also looks beyond the individual file to whether the deployer's own policies, training materials, or vendor contracts direct personnel to treat the output as authoritative. Claims guidelines that tell adjusters to defer to a score could therefore undercut the rebuttal even where the file reflects careful review. The revision also changes the required contents of post- adverse-outcome disclosures and the standards for human reviewers. The formal comment period and public hearing both run through October 26, 2026, in Denver and by videoconference. The earlier deadlines for comments to be reflected in the hearing draft (September 4 for the initial draft and October 5 for proposed revisions) have passed, but all comments submitted through October 26 will be considered for the final rules.
The human-review provisions remain the most consequential for claims and underwriting operations, and the October 6 revision moves them in an important direction. The August draft called for a reviewer who had not made the original decision and, where feasible, was not a subordinate of the original decision-maker. The revised draft drops that structural-independence requirement: a reviewer may be internal or external to the deployer, so long as the reviewer has actual authority to approve, modify, or override the decision, and a contracted external reviewer qualifies if the deployer remains accountable and the contract insulates individual review outcomes from the deployer's influence. Other safeguards carry forward. Reviewers must have subject-matter understanding commensurate with the stakes of the decision and specified training, must not be subject to steering by upper management, and must be shielded from retaliation. The revised draft also retains the rule that automated decision-making technology may not assist in the review itself, while clarifying that tools used solely to summarize, organize, translate, draft, route, or present information may be used. A response to a review request must state the reviewer's decision, the type of review conducted, the factors considered, and reasons specific to the evidence — not a recitation of the system's general logic.
The ADMTA's January 1, 2027 effective date is also less settled than the statute alone suggests. In April 2026, xAI filed suit in the U.S. District Court for the District of Colorado challenging the ADMTA's predecessor, the Colorado AI Act, on First Amendment, Commerce Clause, vagueness, and equal protection grounds. See X.AI LLC v. Philip J. Weiser, in his official capacity as Attorney General of the State of Colorado, No. 1:26-cv-01515-DDD (D. Colo. filed Apr. 9, 2026). The U.S. Department of Justice intervened weeks later, citing Executive Order 14365, which had singled out the Colorado statute as an example of problematic state AI regulation. Under a stipulated order entered in late April, the Attorney General agreed to stay enforcement of the predecessor Act, and of any legislation replacing it, until the court rules on xAI's anticipated preliminary-injunction motion, and that motion must be filed within 28 days after final adoption of implementing rules under that Act or any legislation replacing or amending it. In practical terms, final adoption of the ADMTA rules could start a 28-day clock on an injunction motion. The case is also the clearest example yet of federal preemption issues arising in state AI regulation that reaches insurance.
Separately, and independent of the ADMTA track, Colorado's insurance-specific Regulation 10-1-1 has moved from prospective concern to live compliance obligation: the July 1, 2026 deadline for private passenger auto and health benefit plan insurers to achieve compliance and submit their first compliance reports has now passed, and the regulation repeats the reporting obligation annually, with the next report due July 1, 2027. Carriers licensed in Colorado are consequently no longer merely anticipating two overlapping frameworks — they are actively reporting under one (Regulation 10-1-1) while the second (the ADMTA) is still being finalized through rulemaking.
WHAT THIS MEANS FOR UNDERWRITERS AND PRODUCERS
- Review the October 6 revised draft against your claims and underwriting workflows now, particularly its new "materially influence" standard and rebuttable presumption, which will determine which automated tools fall within the ADMTA at all. Comments submitted through October 26 will be considered for the final rules.
- Pay particular attention to the "meaningful human review" standard as it develops through rulemaking — this is the same conceptual territory as the "human-review theater" vulnerability flagged in our Deep Dive last issue, and Colorado's regulatory definition may become an influential benchmark for what plaintiffs' counsel argue constitutes genuine review versus rubber-stamping in other jurisdictions.
- Do not treat the xAI litigation as a reason to defer compliance work. The stipulated non-enforcement arrangement runs only until the court rules on an injunction motion, and the operational build-out the proposed rules require, such as notices, adverse-outcome disclosures, rights-request intake, and qualified reviewer staffing, may be difficult to implement quickly if the challenge is resolved on short notice.
- Auto and health benefit plan carriers that have not yet submitted their first Regulation 10-1-1 compliance report should treat this as a filed, enforceable obligation, not a future deadline.
C A L I F O R N I A
No material regulatory development to report this month. The AI Transparency Act and the SB 1120 utilization- review rules discussed in Issue No. 1 remain in steady-state effect. We will flag any enforcement activity or guidance as it emerges.
F E D E R A L
Preemption debate takes concrete legislative form as "Great American AI Act" draft circulates
The December 2025 executive order flagged in Issue No. 1 has since been published as Executive Order 14365, and its final text was narrowed from earlier drafts to expressly disclaim preemption of state laws addressing child safety, AI compute and data-center infrastructure, and state government procurement of AI. This represents a meaningfully softer posture than the sweeping framing initially reported. Narrowed or not, the order is now being put to work: as discussed above, the Department of Justice cited it when intervening in the xAI challenge to Colorado's AI statute. Readers should also take care not to conflate that order with a separate, later order: Executive Order 14409, "Promoting Advanced Artificial Intelligence Innovation and Security," signed June 2, 2026, which is focused on federal cybersecurity hardening and a voluntary pre-deployment review framework for frontier AI models.
The more consequential federal development is legislative rather than executive. On June 4, 2026, Representatives Jay Obernolte (R-CA) and Lori Trahan (D-MA) released a 269-page bipartisan discussion draft, the Great American AI Act, which would preempt for three years any state law that "specifically regulates the development" of an AI model, while expressly preserving state authority over "post-deployment activities, including the implementation, distribution, offering, or use" of AI systems. That build-versus-use distinction matters considerably for this newsletter's readers: NAIC's Model Bulletin, the AI Risk Evaluation Supplement, Colorado's Regulation 10-1-1 and ADMTA, and comparable state insurance frameworks all regulate how AI is deployed and used in insurance practice — not how underlying models are developed — and would therefore likely fall outside this preemption clause even if the bill were enacted as drafted. The comprehensive draft, however, remains just that: a discussion draft. In July, Representatives Obernolte and Trahan introduced a standalone bill carrying forward one piece of it — independent-audit and transparency-reporting requirements for large frontier developers — while the preemption title remains in draft form. The broader draft has already drawn opposition from both AI-safety advocates (who object to any preemption) and a House Democratic commission on AI.
WHAT THIS MEANS FOR UNDERWRITERS AND PRODUCERS
- Do not treat the Great American AI Act's preemption clause as a reason to pause state-level insurance AI compliance As drafted, it targets developer-side model-development obligations, not the deployment- focused rules that govern how carriers use AI in underwriting and claims.
- Continue to monitor the distinction between EO 14365 (state preemption policy, narrowed) and EO 14409 (federal cybersecurity posture) when briefing internal stakeholders.
U N I T E D K I N G D O M — F C A / L L O Y D ' S
FCA moves from principles-based posture to active supervisory review
Issue No. 1 described the FCA's approach as folding AI expectations into existing Consumer Duty and SM&CR frameworks rather than building a standalone regime. That description still holds as a matter of architecture, but the FCA has moved from posture to action within it: among its stated 2026 priorities, the regulator is launching a dedicated review specifically assessing how insurance firms use AI in underwriting, claims handling, and consumer-facing services, alongside continued reliance on existing rules rather than new AI-specific rulemaking. Separately, the House of Commons Treasury Committee has pressed the FCA to publish more concrete guidance on audit trails and human-in-the-loop protocols, describing the current state of regulatory clarity as insufficient given the pace of AI adoption in the sector.
The transatlantic contrast we drew in Issue No. 1 — bulletin-and-model-law accumulation in the U.S. versus principles-based application of existing duties in the U.K. — continues to hold, but this month's developments on both sides sharpen it: the U.S. picture is one of rules multiplying and hardening (NAIC's v5.0 supplement, Colorado's rulemaking), while the U.K. picture is one of existing rules being applied with increasing specificity and supervisory attention, rather than new rules being written.
DOCKET WATCH
TRAIGA's insurer carve-out: why Chapter 541/542 remains the operative standard for AI-assisted claims decisions in Texas
The Texas Responsible Artificial Intelligence Governance Act (TRAIGA), in effect since January 1, 2026, is worth a note for Texas-focused readers — chiefly for what it does not do to insurers. TRAIGA's core private-sector prohibition is intent-based: it bars developing or deploying an AI system with the intent to unlawfully discriminate against a protected class, and it is enforced exclusively by the Texas Attorney General, with no private right of action. Section 552.056, however, provides that the discrimination prohibition does not apply to an insurance entity, for purposes of providing insurance services, if the entity is subject to applicable statutes regulating unfair discrimination, unfair methods of competition, or unfair or deceptive acts or practices related to the business of insurance. TRAIGA's construction provision likewise disclaims authorizing any department or agency other than the Texas Department of Insurance to regulate or oversee the business of insurance.
The practical result is that the Legislature left the regulation of insurers' AI use where it already sat: the Insurance Code's unfair-discrimination provisions in Chapter 544 and the unfair-practices and prompt-payment framework of Chapters 541 and 542, read alongside Menchaca and discussed in our Deep Dive last issue. That framework, unlike TRAIGA, does not turn on intent; it asks whether a denial was reasonable, not whether it was purposeful. Carriers hoping TRAIGA's intent standard might become a defensive talking point in algorithmic bad faith litigation should not count on it, because for regulated insurers the statute largely steps aside. TRAIGA may remain relevant, however, to vendors and other participants in the insurance AI supply chain that do not themselves qualify for the carve-out.
Legal malpractice carriers face a first wave of AI hallucination claims
This development will be relevant to our readers who are lawyers, not just insurance professionals. EPIC Law Firm Group's 16th Annual Lawyers' Professional Liability Claims Survey — "Economic and Tech Turmoil Give Rise to Legal Malpractice Risks in 2026," released May 22, 2026, and authored by Eileen Garczynski — draws on senior claims executives at thirteen LPL insurers collectively covering more than 80% of Am Law 200 firms. Seven of those thirteen insurers reported an increase in AI-related claims over the past year. Notably, the survey also found that legal malpractice claim frequency generally rose for the first time in five years (eight of thirteen insurers reported higher frequency), with AI cited as one driver alongside economic pressure and growing cyber exposure — meaning the AI finding arrives inside a broader inflection point in the market, not as an isolated data point. As Garczynski put it, AI-related malpractice exposure "has moved from theoretical to real," and "the duty of competence cannot be delegated to technology." Separately, the AI Hallucination Cases database maintained by French lawyer and legal-data researcher Damien Charlotin (available at damiencharlotin.com/hallucinations, and cited by federal courts including the Fifth Circuit) has documented a rapidly growing count of court filings worldwide containing AI-fabricated citations — the database is updated continuously, and we refer readers to it directly rather than cite a count that would be out of date by the time this issue reaches inboxes.
The coverage question underlying all of this is genuinely unsettled. Most lawyers' professional liability (LPL) policies were not drafted with this fact pattern in mind, and court-imposed sanctions themselves are typically excluded from coverage regardless of the underlying policy's scope. The harder, unresolved question is whether a hallucinated citation that makes it into a filing and harms a client is a covered "professional error" (failure to verify) or an excluded "technology failure," a characterization some carriers may be incentivized to advance given the difference in outcome. Nor should firms expect the emerging affirmative AI insurance market, discussed in Market Signals below, to close this gap yet: the products launched to date are aimed at commercial liability and AI-performance risk, not at lawyers' professional errors.
WHAT THIS MEANS FOR LAW FIRMS
- Firms should not assume existing LPL coverage responds to an AI hallucination claim by default. We expect AI- specific exclusions or sublimits to appear on a growing number of LPL forms at 2027 renewals, and firms should review renewal language closely.
- A documented AI governance program, including a written AI-use policy, verification requirements for AI- assisted citations, and required attorney review before filing, should be part of every law firm's governance and management structure.
Texas AG v. Allstate and Arity: an algorithmic pricing case built on the input side
A Texas-specific matter worth tracking arises from the input side of algorithmic decision-making rather than the claims side. In January 2025, Texas Attorney General Ken Paxton sued Allstate Corp. and its data-analytics subsidiary Arity LLC, alleging the companies covertly embedded tracking software in popular mobile apps (including Life360, GasBuddy, and Fuel Rewards) to collect location and movement data from more than 45 million people without adequate notice or consent, then used that data — marketed to insurers as "driving behavior" data even though the underlying software could only track a phone's movement, not who was driving — to help justify premium increases and coverage decisions. The suit alleges violations of the Texas Data Privacy and Security Act, the state's Data Broker Law, and the Texas Insurance Code's prohibition on unfair and deceptive acts and practices. Allstate answered in February 2026, disputing both that consumers lacked notice and that Arity plays any role in setting premiums, and asked that the claims against Arity be dismissed with prejudice. The State's case is pending in Montgomery County district court (No. 25-01-00561). According to the court's docket, the State's case is currently set for jury trial on February 18, 2027.
The Texas case may provide further insight into the explainability theory from our Deep Dive last issue: where that theory concerns what a carrier can show about why an algorithm produced a particular claims outcome, the Allstate/Arity matter concerns what carriers and their data partners must disclose about the inputs feeding a pricing or underwriting algorithm in the first place. Both involve the same underlying regulatory issue — that opacity in the data or logic behind an automated decision is itself the wrong to be remedied — and Texas's invocation of its own Insurance Code's unfair-practices provision here is a directly implicated, if fact-specific, data point for how Chapter 541-style theories can attach to algorithmic pricing inputs, not just claims outputs.
We will continue to monitor duty-to-defend disputes involving algorithmic decision-making, discussed in Issue No. 1, and will report on developments as they surface.
MARKET SIGNALS
AI exclusions: adoption accelerates; correction to Issue No. 1
A correction first: Issue No. 1 identified the third ISO generative-AI exclusion endorsement as "CG 40 35." The correct form number is CG 35 08 (the Products/Completed Operations Liability exclusion). The other two forms — CG 40 47 (the broad Coverage A/B exclusion) and CG 40 48 (the Coverage B–only exclusion) — were correctly identified.
On adoption: by April 2026, major carriers including W.R. Berkley, Chubb, Travelers, Berkshire Hathaway, and Cincinnati Financial had filed to attach the ISO endorsements or proprietary equivalents, with state regulators reportedly approving more than 80% of submitted filings. That pace of adoption has started to generate its own coverage-law commentary: in an April 2026 analysis, Pillsbury attorneys warned that if AI exclusions become sufficiently broad and universally applied, "almost any claim will arguably be connected to AI use," raising the specter of an illusory-coverage challenge under the doctrine that a policy cannot validly exclude virtually everything it purports to cover. Expect that argument to surface as a coverage defense theory once litigation over a broadly worded AI exclusion actually tests it.
An affirmative market is beginning to form on the other side of the ledger. In March 2026, Munich Re's specialty unit HSB introduced HSB AI Liability Insurance for small and mid-sized businesses, designed to be added to partner carriers' business policies (subject to regulatory approval) and to respond to AI-related bodily injury, property damage, and advertising injury losses that some general liability forms now exclude. Munich Re separately offers its aiSure product for AI performance risk, and at Lloyd's, a Chaucer-led binder with Armilla AI provides standalone third-party liability coverage for losses arising from AI system underperformance. None of these products is aimed at professional liability exposures such as the LPL hallucination question discussed in Docket Watch, but together they mark the start of a market that prices AI risk rather than simply excluding it.
Consolidation continues: Munich Re adds At-Bay to its cyber platform
Munich Re Group agreed on August 19, 2026 to acquire cyber insurtech At-Bay at an enterprise value of approximately $575 million, with the business to be overseen by Hartford Steam Boiler, Munich Re's specialty insurance arm; the deal is expected to close in the first quarter of 2027. The transaction converts a longstanding capacity relationship into direct ownership of At-Bay's underwriting platform, data assets, and continuous security-monitoring capability. Coming roughly a year after Munich Re's acquisition of Next Insurance (discussed in Issue No. 1), the At-Bay deal reinforces the consolidation thesis we flagged last issue: incumbent carriers and reinsurers continue to prefer acquiring specialist, technology-native underwriting platforms over building comparable capability internally, even as the reported purchase price (roughly a 2x multiple on At-Bay's gross written premium, and a step down from its 2021 venture valuation) reflects a broader reset in insurtech valuations since the venture-funding peak.
Lloyd's market: AI adoption doubles, governance frameworks becoming the norm
A Lloyd's Market Association survey published in April 2026, drawing on responses representing more than 60% of Lloyd's market stamp capacity, found that AI and machine-learning adoption more than doubled over the prior twelve months, with 93% of respondent firms now having, or actively developing, formal AI governance frameworks. Adoption remains concentrated in efficiency-oriented generative AI use cases (summarization, reporting, data processing) rather than core underwriting or pricing decisions, and data privacy, cybersecurity, and third-party risk have emerged as the market's leading AI-related concerns — a notable shift from a year earlier, when regulatory uncertainty and the absence of governance frameworks topped the list. The LMA has since published an AI Adoption Toolkit to help managing agents formalize governance as AI use moves further into core underwriting workflows.
ONE TO WATCH
Issue No. 1 flagged the NAIC's third-party data and models workstream as the single biggest potential structural shift on the horizon. That workstream has now taken concrete shape: the Third-Party Data and Models (H) Working Group has settled on a registration regime rather than a licensure regime for third-party AI model and data vendors — vendors would be required to file and periodically update disclosures with regulators, but registration would not transfer or diminish an insurer's own accountability for a model's behavior in pricing, underwriting, claims, or fraud detection. The exposed framework's comment period closed August 5, 2026, and the proposal was discussed at the NAIC's Summer National Meeting on August 12, 2026. Realistic estimates put the first state-level implementations in late 2026 or early 2027.
For October, our new item to watch is Colorado's ADMTA rulemaking hearing on October 26, 2026, now on the revised October 6 draft — the first real test of how prescriptive the Attorney General's office is prepared to be on the "meaningful human review" standard discussed above in Regulatory Radar. Given the direct relevance of that standard to the human-review-theater bad faith theory from our Deep Dive, we expect the hearing record to be closely watched well beyond Colorado's borders.
Closer to home, the Texas Attorney General's case against Allstate and Arity, discussed above in Docket Watch, is currently set for jury trial in Montgomery County on February 18, 2027. Trial settings frequently move, but the pretrial rulings that precede it will offer an early signal of how far a Texas court is prepared to let Insurance Code unfair-practices theories reach the data inputs behind algorithmic pricing. We will report on those rulings as they come.
One further item bears watching, even though it is not yet an insurance story. After a September in which prominent AI developers publicly called for greater federal oversight of frontier AI systems and the White House initially pushed back, the administration changed course. On September 29, 2026, President Trump and leaders of six AI and chip companies — Anthropic, Google, Meta, Nvidia, OpenAI, and xAI — signed the White House Accord on Super Intelligence, a one-page voluntary commitment calling for four layers of control around frontier models: internal controls, an internal team to check them, an independent external auditor, and an independent board committee. The Accord carries no penalties, does not require public disclosure of audit results, and gives the government no enforcement role. The same day, a separate executive order directed the executive branch to use the term "Super Intelligence" in place of "Artificial Intelligence." The voluntary posture has not come without pressure. On September 30, the day after the signing, the Federal Trade Commission confirmed that it is investigating Anthropic, OpenAI, and other AI companies over potential risks their products pose to consumers; press reports indicate the agency is preparing civil investigative demands to compel documents and executive testimony. On October 4, the President announced a new federal "Super Intelligence Force," chaired by Director of National Intelligence Jay Clayton, whose members include FTC Chairman Andrew Ferguson, Under Secretary of Defense for Research and Engineering Emil Michael, and Office of Personnel Management Director Scott Kupor. The Force reports to the President and the White House Chief of Staff and is charged with coordinating the federal government's engagement with consumers, public interest groups, critical infrastructure providers, and AI companies — meaning the head of the agency investigating two Accord signatories also sits on the body coordinating federal engagement with them.
As of this writing, no insurance trade association or carrier executive appears to have weighed in, and the Accord addresses developer-side frontier-model safety — a different register from the deployment-focused insurance AI regulation this newsletter otherwise tracks. We are watching it for two reasons. First, a self-regulatory federal posture toward developers, combined with the build-versus-use line in the Great American AI Act draft, reinforces our read that deployment-side insurance AI regulation will remain a largely state-level project for the foreseeable future. Second, the Accord's architecture — internal controls, independent audit, board-level oversight — is the same governance vocabulary underwriters are already using when they ask insureds about AI, and it may become an informal benchmark for what "reasonable" AI governance looks like in D&O and E&O underwriting even though it binds no one. We will report further once it produces something concrete enough to track.
The information provided here is not intended to offer legal advice or opinion and should not be acted upon without consulting a qualified and licensed attorney.