Shadow AI in Insurance: How Undocumented AI Undermines NAIC Exhibit A

Employees across insurance companies use artificial intelligence to summarize claims notes, draft customer emails, build pricing spreadsheets, and write board materials. Many do so without the knowledge of IT, legal, or compliance. That is not a technology trend. It is a governance blind spot, and it is becoming a regulatory one.

Shadow AI is the use of AI tools outside an organization’s approved governance framework. For insurers, the issue is not just data leakage or security risk. It is that the NAIC AI Systems Evaluation Tool begins with Exhibit A, which asks carriers to quantify all AI systems across the company. A tool no one knows about cannot be inventoried. A model used by a claims team but never reviewed by compliance cannot be documented. That gap turns an operational nuisance into a regulatory failure.¹

Why Exhibit A is the right place to start

The NAIC AI Systems Evaluation Tool is built around four exhibits. Exhibit A is the foundation because it asks a simple question: what AI systems do you actually use? Regulators want to know the number of models, where they sit in the organization, what decisions they influence, and whether they have been updated recently. The purpose is to give regulators a baseline before they move into governance, risk, and high-risk system details.²

Most regulators will start with Exhibit A. If the inventory is incomplete, the rest of the evaluation becomes harder to defend. A carrier can have a polished board-level AI governance policy and a vendor oversight program on paper, but if the actual AI footprint is larger than the inventory shows, regulators will notice the mismatch. The question then becomes whether the company did not know, or did not want to know. Either answer is bad.³

Exhibit A asks for more than a list of vendor contracts. It asks for AI systems used across operational and program areas. That includes tools embedded in third-party software, AI features inside productivity suites, and locally built scripts. A claims adjuster using an AI-enabled browser extension to summarize medical records is using an AI system. An underwriter running pricing scenarios through a spreadsheet with an AI add-in is using an AI system. If compliance does not know those tools exist, they cannot be disclosed.³

How shadow AI creates the gap

Shadow AI appears in insurance organizations in predictable ways. Employees use public AI platforms to draft correspondence or analyze documents. They activate AI features in existing software without a formal review. They build small internal tools or use AI-enabled browser extensions. In each case, the tool is useful, the data leaves the approved environment, and the activity is invisible to governance.¹

The structural problem is that AI risk does not fit neatly into one function. Business owns the value, risk and audit own oversight, IT owns execution, legal owns regulatory alignment, data privacy owns ethical use, and procurement owns vendor accountability. When no single function owns the whole AI lifecycle, gaps form in the handoffs. A procurement team may vet a vendor contract, but not know the claims department has turned on an AI feature inside that vendor’s platform. IT may monitor network traffic, but not notice that a licensed employee is using an AI tool on a personal account.¹

The consequences are not hypothetical. As advisory firm Cherry Bekaert has documented, a recent SEC cybersecurity disclosure involved an employee’s use of an unsanctioned AI tool that triggered a public-company disclosure. The incident did not require a breach or an external attacker. It required only an employee using a tool that governance had not approved or monitored. For insurers, the same dynamic applies to producer data, claims files, and policyholder information.¹

Why insurance is especially vulnerable

Insurance companies face a specific shadow AI risk because of how decisions are made. Pricing, underwriting, claims, and customer service are distributed across business units, regions, and third-party partners. Each group may adopt AI tools to speed up its own work. The central compliance team may not have visibility into what each group is using until an exam notice arrives.

Third-party relationships make the problem worse. Agents, brokers, managing general agents, and claims administrators may use AI tools that the carrier does not control. The NAIC Model Bulletin on the Use of AI Systems by Insurers expects insurers to oversee third-party AI systems, including vendor due diligence and ongoing monitoring. If a vendor’s AI use is not visible, the carrier cannot demonstrate that oversight.⁴

The scale of adoption is not in doubt. The NAIC’s 2025 Health AI/ML Survey found that 84% of responding health insurers already use AI or machine learning, across claims, fraud detection, and other core operations. Those are precisely the areas where shadow AI can appear.⁵ An adjuster trying to process claims faster may use an AI tool to summarize notes. A customer service representative may use AI to draft responses. Each use case is small, but together they describe an AI footprint that may be materially different from the one on file.

What compliance officers can do in 30 days

The goal is not to eliminate every unauthorized AI tool on day one. That is unrealistic. The goal is to build an inventory that is directionally complete and defensible, then close the gaps over time. The following steps can be completed in roughly 30 days.

First, map the known AI systems. Start with the obvious sources: approved vendor contracts, IT procurement records, model risk management files, and the legal team’s AI use policy acknowledgments. This is the inventory the company already thinks it has. It is the baseline.

Second, ask the business units directly. Send a short questionnaire to each line of business and function, asking three questions: what AI tools are you using, what decisions do they influence, and what data do they process. Make it clear that the purpose is inventory, not punishment. The answers will surface tools that central records missed.¹

Third, check network and SaaS spending data. Shadow AI tools often leave a financial footprint before they leave a security footprint. Look for new software purchases, browser extension deployments, or API calls to AI services. IT and finance can run this together. The results will identify tools that employees may not have reported.

Fourth, document the gaps honestly. When a tool is discovered that is not in the approved inventory, record what it does, who uses it, what data it touches, and whether it can be brought into governance or retired. Do not hide shadow AI findings from the official inventory. Regulators are more likely to trust a carrier that discloses a gap and explains its remediation plan than one that presents an implausibly clean inventory.¹

How to keep the inventory current

A one-time inventory is not enough. New AI tools appear inside existing software every quarter. The 30-day sprint should be followed by a repeatable process. Assign an owner for the AI inventory. That owner should be accountable for updating the inventory when new AI systems are deployed, when vendors release AI features, or when business units report new use cases. The owner should also be responsible for escalating high-risk findings to legal, compliance, and risk committees.¹

Integrate the inventory into the existing AI governance program. The NAIC Model Bulletin requires a written AI Systems Program covering governance, risk management, internal controls, consumer notice, and vendor oversight. The inventory should be the first document referenced in that program and the first document updated when something changes.⁴

Finally, train employees on what shadow AI is and how to report it. Many employees do not know that an AI-enabled browser extension or a personal AI account is a governance issue. Clear guidance and a simple reporting channel can turn employees into sensors rather than liabilities. Training should be specific: give examples of tools that are allowed, tools that require approval, and tools that are prohibited.¹

The link to Exhibits B, C, and D

A complete Exhibit A inventory makes the rest of the NAIC evaluation tool easier. Exhibit B asks about governance and risk management. If the inventory is wrong, the governance structure is governing the wrong set of systems. Exhibit C asks about high-risk AI systems. If the inventory is incomplete, high-risk systems may be missed entirely. Exhibit D asks about data and model details. Regulators cannot review data lineage for a model that was never disclosed.²

For insurers preparing for the NAIC evaluation tool, the practical message is that inventory is not a compliance checkbox. It is the prerequisite for every other answer. Shadow AI does not just make the inventory incomplete; it makes the entire governance framework suspect. Fixing the inventory is the fastest way to reduce regulatory risk across the program.

For a deeper look at how the tool structures its four exhibits, see our guide to the NAIC AI Systems Evaluation Tool’s Exhibits A–D.

InsureAI Wire tracks NAIC and state-level AI governance developments weekly. Subscribe for updates on the evaluation tool pilot, state adoption maps, and compliance checklists.

Footnotes

1. Cherry Bekaert, “What Is Shadow AI and How Can This Governance Blind Spot Trigger an SEC Disclosure?,” July 2, 2026: https://www.cbh.com/insights/articles/what-is-shadow-ai-its-sec-disclosure-risk-cherry-bekaert/ ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸

2. NAIC, “AI Systems Evaluation Tool 4.0,” Exhibit A: Quantify Regulated Entity’s Use of AI Systems: https://content.naic.org/sites/default/files/inline-files/AI%20Systems%20Evaluation%20Tool%204.0%20%28Clean%29.pdf ↩ ↩²

3. Foley & Lardner, “What To Do If You Receive an NAIC AI Systems Evaluation Tool Pilot Request,” 2026: https://www.foley.com/p/102mmre/what-to-do-if-you-receive-an-naic-ai-systems-evaluation-tool-pilot-request/ ↩ ↩²

4. NAIC Model Bulletin, “Use of Artificial Intelligence Systems by Insurers,” adopted December 4, 2023: https://content.naic.org/sites/default/files/inline-files/2023-12-4%20Model%20Bulletin_Adopted_0.pdf ↩ ↩²

5. NAIC, “Health Artificial Intelligence and Machine Learning Survey,” conducted November 2024–January 2025 (93 companies; 84% of respondents use AI/ML), reported to the Big Data and Artificial Intelligence (H) Working Group, May 2025: https://content.naic.org/sites/default/files/inline-files/Health%20Survey%20Memo%20to%20BDAIWG%2005092025%20-%20Final_1.pdf ↩