The Mid-Market Insurance AI Stack: What’s Needed Before an AI Model

Most insurance AI advice assumes a data-science team and a new core system. Mid-market carriers need neither to start. Here is the stack that matters.

Preface

Based on reporting from multiple news outlets and influencer channels, it is widely recognized that AI technology poses both factual and economic risks. The insurance industry is not immune to these risks. The AI Failure Index documents multiple catastrophic failures in underwriting and claims, discrimination, data breaches, unlawful collection and sale of driver data, wrongful claim denials, and improper use of personally identifiable information (PII) [1].

As noted in previous papers, AI compliance and implementation are both an art and a science (sometimes more art) of selecting the right framework for the business problem at hand. No single compliance framework addresses all the challenges of identifying and implementing an organization’s most important workloads across different domains. Organizations create AI value by developing a methodology that sequences a repeatable pipeline tied to measurable checkpoints, using the most appropriate framework. [2, 3]

Key Insights

• Start now — no data-science team or new core systems required. The narrative that AI demands a multi-year, enterprise-scale transformation applies to Tier 1 carriers, not to regional and specialty insurers, who can begin with a small set of targeted, high-probability projects.
• The constraint is infrastructure, not the model. Data readiness, lineage, governance, and IT operations bandwidth, not model quality, explain why most carriers get AI into production (roughly 73% in life, annuity, and benefits), yet few scale it enterprise-wide (about 7%), and only about a third report positive ROI.
• Decouple AI from core system replacement. A governed data layer alongside the legacy system of record lets early use cases read from the core without waiting for an 18–36-month, $5M–$25M rebuild, and it survives the eventual migration rather than being rebuilt.
• Choose first workflows where failure is visible. Bounded, document-heavy tasks that a person already reviews, submission triage, loss-run extraction, and FNOL intake, catch their own errors and attract proportionate regulatory scrutiny.
• Make governance and compliance the enabler, not the brake. Genuine human override authority, plus an audit trail of inputs, outputs, model versions, decisions, and overrides, logged from day one, turns AI oversight into evidence an examiner will accept.
• Build to the strictest standard you are likely to encounter. The NAIC Model Bulletin is in effect in 24 states and the District of Columbia, while California, Colorado, New York, and Texas maintain their own, often stricter, regimes.

Introduction

The events described in the preface affected Tier 1 carriers; however, this does not mean that mid-market insurers are immune to these issues. If you run operations or technology at a regional or specialty carrier, that content reads less like advice and more like a description of a race you’ve already lost. There is no doubt that AI will transform the insurance industry. AI techniques are already deployed across all stages of the insurance life cycle, including product development, marketing, sales and distribution, underwriting and pricing, policy servicing, claims management, and fraud detection [4]. Mid-market carriers must adopt and evolve to embrace this sea change.

AI will enable innovative products, improve the customer experience, and automate processes for greater efficiency and accuracy. But it also poses unique consumer risks — inaccuracy, unfair discrimination, data vulnerabilities, and limited transparency — that insurers must take steps to minimize [5].

Media coverage of AI in the insurance industry usually focuses on large carriers with a data-science organization, a multi-year transformation program already underway, with a well-funded budget line for Enterprise AI platforms.

Not True!

However, AI for insurance policy administration (PA) is poised to automate complex operations, including policy issuance, billing, endorsements, renewals, customer service, and portfolio analytics, that have historically relied solely on human judgment and static tools. New policy administration systems (PAS) now incorporate AI into core carrier workflows.[6]

Modern AI technologies can process unstructured data, interpret context, deliver on-demand conversational assistance to policy administrators and policyholders, and coordinate multi-step policy workflows involving judgment, exceptions, and incomplete information.[7]

AI Implementation Strategy for Mid-Market Carriers

What mid-market carriers need is a targeted approach to projects with a high likelihood of success. The reality is that the programs large carriers pursue often boil the ocean, developing a long list of opportunistic projects that target a broad base of constituents to gain support from corporate and business units. A targeted, risk-assessed approach makes the most sense [8].

Mid-market carriers do not necessarily need a large, complex, and expensive AI program to achieve real, tangible business results. However, each effort must be evaluated systematically to assess business needs, risks, and technical viability through the lens of AI risk management [2].

The Mid-market Squeeze

Mid-market carriers are in an awkward spot: too large to run on relationships and spreadsheets, too small to fund a data-science team or absorb a PAS replacement that can take 18 to 36 months and cost $5 million to $25 million. [9].

Datos Insights’ 2026 CIO survey found that midsize carriers aren’t moving in a different direction from large ones; they’re a step or two behind on the same curve. Large language models have achieved near-universal deployment across both groups. The difference is sequencing. Midsize insurers are allocating roughly a third of their transformation budgets to data infrastructure and analytics, recognizing that data quality and governance must precede AI scaling. Their top constraint isn’t ambition. It’s IT operations bandwidth [8].

AI Project Outcomes

The outcome data supports sequencing. In Datos’ Q1 2026 survey of North American P&C executives, most carriers had AI in production, but almost none had achieved widespread adoption. Two variables explained most of the variation in results: data readiness and deployment maturity[3]. On the life, annuity, and benefits side, 73% of carriers now run AI in production, yet only 7% have scaled it enterprise-wide. Only a third report positive ROI, and most are stuck in a stage where production AI is constrained by legacy integration and talent scarcity [10].

Read that carefully. The wall isn’t the model. It’s everything needed to support the models.

Leverage your core systems. Don’t assume you have to replace them immediately

Tying AI to core PAS modernization is tempting. The new platform promises clean APIs and embedded AI features. Why not wait to tackle AI until you can replace core systems with new technology?

Tying AI to a core replacement hitches it to your longest, riskiest project. If the replacement slips, your AI program slips with it. And the first AI use cases worth doing don’t need to write to the core at all. They need to read from it and from the documents, emails, and third-party feeds that surround it.

The practical architecture is layered. The legacy core systems remain the systems of record. A governed data layer sits alongside them, pulling only what the AI workflows need, with lineage recorded at every step. AI workflows operate on that layer and hand results to people, who act in the systems they already use. When the core is eventually replaced, the data layer survives the migration, and the lineage work you’ve done becomes an asset for the cutover rather than something to rebuild. Legacy has real costs of its own, but blocking AI doesn’t have to be one of them [11].

The Four Critical Elements the AI Stack Needs

1. A Data Layer with Known Lineage – essential for Regulatory compliance

Choose the appropriate governed layer aligned with your initial two or three workflows. This enables you to answer four questions about any field an AI system has interacted with. Data lineage involves systematically tracing the journey of data within an organization’s systems, starting from the original source (such as an operational database, API, or sensor) through every transformation, join, aggregation, and copy, until it is used in reports, dashboards, ML models, or analytical decisions. Lineage creates a comprehensive map of data dependencies, indicating for each data asset its origin (upstream lineage) and its destination (downstream lineage) [12]. This includes:

• Data Source(s) – where does the information come from and is the source understood and reliable?
• Data receipt date(s) and time(s) – When was the information created?
• Data Updates and Change Types – Who made the changes and what changed? Are we logging these transactions for compliance review?
• Structural Changes (metadata, tables, columns, data types, etc.) – Do we monitor and audit meta data changes and is there a verifiable change control process?

This matters more for mid-market carriers than for large ones because so much data arrives from outside the organization (e.g. producers, TPAs, and etc.).

The NAIC Model Bulletin tells insurers to expect regulators to review data lineage, quality, integrity, and bias analysis [5].

Regulatory Compliance – The NAIC and AI Data Accuracy and Compliance

The National Association of Insurance Commissioners (NAIC) is the U.S. standard-setting and regulatory support organization created and governed by the chief insurance regulators from the 50 states, the District of Columbia, and five U.S. territories [13].

The NAIC Model Bulletin published in 2023 advises insurers to expect regulators to review documentation for AI systems, with a focus on data practices, including lineage, quality, integrity, and bias analysis, as well as validation and testing records that include evaluations of model drift [5].

According to the NAIC’s most recent published adoption map, 24 states and the District of Columbia have adopted the Model Bulletin, while California, Colorado, New York, and Texas maintain their own insurance-specific rules or guidance. Multistate carriers should not assume the bulletin is the final word on AI compliance, as individual states may strengthen AI compliance requirements through their own legislation (see Appendix 1 below) [14].

Colorado is the clearest example of a stricter regulatory regime. Regulation 3 CCR 702-10 requires insurers that use external consumer data and predictive models to maintain a risk-based governance framework to detect unfair discrimination through quantitative testing. Amendments effective October 2025 extend this requirement to private passenger auto and health benefit plans, in addition to life insurance. In separate legislation, Colorado’s cross-industry AI Act was repealed and replaced in May 2026 with a revised law that takes effect on January 1, 2027. This law regulates “automated decision-making technology” (ADMT) used in “consequential decisions.” It imposes specific transparency and documentation requirements on developers and deployers, grants consumers rights to data correction and meaningful human review, and grants the Colorado Attorney General exclusive enforcement authority without a private right of action [15].

Meanwhile, Texas issued its AI-specific bulletin in June 2026, six years after its earlier guidance. [16].

This serves as a reminder that the regulatory landscape for AI in insurance is still evolving.

2. Identify workflows where failure will be visible

The best first projects share two traits:

• The task is bounded -with well-defined inputs and outputs
• A person already reviews the output

When the AI gets it wrong, someone notices and can take corrective action. In insurance, that points to a short list. Here are some example workflows for consideration:

• Claims
  • Basic Claims adjudication – with minimal minimum adjuster oversight required.
  • First Notice of Loss (FNOL) intake – AI captures and structures first notice of loss for an adjuster.
  • Claims processing has other workflows that on first review look attractive but can have additional risk
• Underwriting
  • Automatic declination – This has more market appearance exposure issues because this process usually occurs pre-binder and contract.
  • Loss-run extraction – AI turns unstructured loss histories into structured data an underwriter can use.
  • Submission intake & triage – The AI reads broker submissions, extracts exposures, and flags appetite fit based on the carrier’s lines of business and coverage portfolio.

This isn’t about settling for small wins. These bread-and-butter processes are core to insurance operations, where accuracy and timeliness are critical. Datos found that the top P&C production use cases are all variations on AI reading and summarizing documents [10]. These workflows also fall under a lower tier of regulatory scrutiny. States piloting the NAIC’s AI Systems Evaluation Tool are applying a proportionality principle, focusing on high-risk AI and less on low-risk back-office applications [17]. Start where scrutiny is proportionate and errors are catchable, then build governance muscle before touching pricing or claim decisions.

3. Human-in-the-loop with genuine override authority

“Human in the loop” too often means a reviewer clicking approve on a queue they don’t have time to review. That isn’t oversight. It’s a signature.

Genuine oversight means the reviewer has the authority, context, and time to disagree, and that every disagreement is captured. Override rates are also a cheap, powerful monitoring signal. When underwriters start correcting extracted exposures more often, something upstream has drifted: the data, the documents, or the model.

In at least one major market, this is now an explicit expectation. The Texas Department of Insurance’s June 2026 bulletin states that when a regulated entity uses AI to make a consequential decision, a person should “review and agree with all decisions before action is taken” [16]. Designing to the Texas standard across all states simplifies multistate compliance.

4. An audit trail from the first deployment

The NAIC bulletin mentioned above effectively reframes AI oversight as an evidence problem. An examiner’s question isn’t whether you have a policy. It’s whether you can show what’s in production, how it was tested before deployment, how it has been monitored since, and how you vetted any vendor whose model you rely on. Using a third-party model doesn’t shift responsibility: the bulletin notes that regulators may request your due diligence on vendors and the contract terms covering audits and cooperation with regulators [5].

That’s why the audit trail isn’t documentation hygiene you add later. It’s a deployability requirement. Inputs, outputs, model versions, human decisions, and overrides should be logged from day one in production. Retrofitting it after an examiner asks is expensive at best and impossible at worst because the history was never recorded.

The timing is real. A twelve-state pilot of the NAIC’s AI Systems Evaluation Tool, including California, Colorado, Florida, Pennsylvania, and Virginia, has been running through 2026, and the NAIC anticipates adopting the tool at its 2026 Fall National Meeting [12, 17].

AI readiness checklist

One point for each yes.

1. Can we name the first workflow we’d deploy and the person who owns its outcome?
2. For that workflow, can we trace every input field to its source system or file?
3. Would we know within a week if an incoming data feed changed its structure?
4. Does the reviewer have the authority and time to override the AI, and is every override recorded?
5. Could we quickly compile a list of all AI systems in use, including AI embedded in vendor tools?
6. Do we have pre-deployment test results and a performance baseline?
7. Do our AI vendor contracts grant us audit rights and require cooperation with regulators?
8. Do we know which of our states have adopted the NAIC bulletin and which run their own regimes?

Scoring

Not sure where you land? Our AI Opportunity Roadmap session identifies your first workflows and the gaps to close.

Conclusion – The Hard part isn’t the model

Mid-market carriers don’t fall behind on AI because they lack a data-science team or a new core. They fall behind when they buy a model before they can explain what it’s reading, who’s checking it, and what it did last Tuesday. The carriers that get this right won’t be the ones with the biggest budgets. They’ll be the ones who can answer an examiner’s questions on the first request.

The opportunity for mid-market carriers is real, and it does not require matching a Tier 1 budget. It requires discipline:

• Start with one or two bounded workflows.
• Ensure you have a governed data layer with known lineage.
• Give reviewers genuine authority to override the model’s output, ensuring AI decisions are not affected by bias and hallucinations.
• Implement logging and audit trails by workflow from the first day in production.
• Think of each project as a crawl, walk, run exercise, where each project strengthens the foundation for the next.

For more on building that foundation, see our maturity lens on enterprise AI readiness, our enterprise AI governance framework, and our guide on how Green Leaf builds AI-ready data for mid-market teams.[2, 3, 18]

Ready to find your first two workflows? Start with an AI Opportunity Roadmap session. 

References 

1. Index, T.A.F. AI Failures in Insurance. 2026; Available from: https://failureindex.ai/by-industry/insurance.
2. Ferara, E., Which AI Workloads Should You Build? A Risk-Based Prioritization Framework, in Green Leaf Insights, M. Miner, Editor. 2026, Green Leaf Group: https://greenleafgrp.com/insights/which-ai-workloads-should-you-build-a-risk-based-prioritization-framework/.
3. Ferrara, E., Enterprise AI Governance Framework: Regulatory Readiness, Risk Management, and Compliance in 2026, in Greenleaf-Insights, M. Miner, Editor. 2026, Greenleaf Consulting Group: https://greenleafgrp.com/insights/enterprise-ai-governance-framework-regulatory-readiness-risk-management-and-compliance-in-2026/.
4. Balasubramanian, R., A. Libarikian, and D. McElhaney, Insurance 2030 — The impact of AI on the future of insurance, in McKinsey & Company Financial Services. 2021, McKinsey & Company: https://www.mckinsey.com/industries/financial-services/our-insights/insurance-2030-the-impact-of-ai-on-the-future-of-insurance.
5. NAIC, NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurers. 2023, National Association of Insurance Commissioners {NAIC}: https://content.naic.org/sites/default/files/call_materials/Model%20Bulletin%2010.23%20Clean.pdf.
6. Soupel, V. and V. Belski. Artificial Intelligence AI for Insurance Policy Administration. AI for Insurance Policy Administration: Short Summary 2026  [cited 2026 October]; Available from: https://www.scnsoft.com/insurance/artificial-intelligence/policy-administration.
7. Ferrara, E., AI is Turning Data Platforms into Decision Engines, in Insights, M. Miner, Editor. 2026, Green Leaf Group: https://greenleafgrp.com/insights/ai-is-turning-data-platforms-into-decision-engines/.
8. Gupta, S., Insurer IT in 2026 Bigger Budgets Bolder AI and a Data Problem That Wont Wait, in Datos Insurer IT in 2026. 2026, Datos: https://datos-insights.com/blog/insurer-it-in-2026-bigger-budgets-bolder-ai-and-a-data-problem-that-wont-wait/.
9. Nowak, M., The Core of Digital Insurance in 2026, in Decerto Resources. 2026, DeCerto: https://www.decerto.com/us/post/policy-administration-system-the-core-of-digital-insurance.
10. Krantz, J., AI Implementations in 2026: The Pilot Phase Is Over for Life/Annuities Group Benefit Carriers, in Datos Reports. 2026, Datos: https://datos-insights.com/reports/ai-implementations-in-2026-ins-2026-102370/.
11. Group, G.L., The Hidden Cost of Staying on Legacy Systems in 2026, in Green Leaf Insights, M. Miner, Editor. 2026, Greenleaf Consulting Group: https://greenleafgrp.com/insights/the-hidden-cost-of-staying-on-legacy-systems-in-2026/.
12. NAIC Insurance Topics | Artificial Intelligence. 2026.
13. NAIC. About. 2026; Available from: https://content.naic.org/about.
14. NAIC, Implementation of NAIC Model Bulletin: Use of Artificial Intelligence Systems by Insurer, in mapchart.net, I.o.N.M. Bulletin, Editor. 2026, NAIC: https://content.naic.org/sites/default/files/cmte-h-big-data-artificial-intelligence-wg-map-ai-model-bulletin.pdf.
15. Fulbright, N.R., Colorado enacts revised AI law | Global law firm, in Thought leadership-Publications. 2026, Norton Rose Fulbright: https://www.nortonrosefulbright.com/en/knowledge/publications/18733d31/colorado-enacts-revised-ai-law.
16. TDI, Commissioners Bulletin B-0003-26, T.D.o. Insurance, Editor. 2026, Texas Department of Insurance: https://tdi.texas.gov/bulletins/2026/b-0003-26.html.
17. Gibbs, J., AI Update: NAIC Launches Multi-State Pilot of AI Systems Evaluation Tool. 2026, zelle law: https://www.zellelaw.com/AI_Update_NAIC_Launches_Multi-State_Pilot_of_AI_Systems_Evaluation_Tool.
18. Collier, C., Enterprise AI Readiness as a Strategic Capability A Maturity Lens for CIOs CDOs and CTOs, in Green Leaf Insights, M. Miner, Editor. 2026, Green Leaf Group: https://greenleafgrp.com/insights/enterprise-ai-governance-framework-regulatory-readiness-risk-management-and-compliance-in-2026/.