RegEd Inc
11/12/2026 | Press release | Distributed by Public on 11/12/2026 12:41
Insurance Regulatory Roundup | September-October 2026
September and October insurance activity brought AI governance, pricing practices, privacy, claims administration, and distribution oversight into sharper focus. State guidance continued to connect technology-supported decisions with existing consumer-protection obligations, while federal developments added new work around pricing disclosures, enrollment controls, and future Medicare requirements.
For carriers, agencies, and compliance teams, the throughline is operational: these developments must translate into coordinated changes across underwriting, claims, licensing, training, data, and vendor oversight. The highlights below focus on the operational implications and distinguish adopted requirements from draft examination tools and proposed rules.
NAIC · AI Examination Readiness
The Draft AI Supplement Moves the Discussion Toward Evidence
The NAIC's post-pilot AI Risk Evaluation Supplement version 5.0 remained a draft. Stakeholder comments were submitted in September and compiled in October. The supplement is designed to support existing market-conduct, financial analysis, and financial examination processes, rather than create a separate regulatory regime.
The NAIC's summary of changes specifically identifies a model inventory request, clarifies materiality and inherent-risk concepts, and explains how regulators may scope inquiries. The draft offers a useful indication of the information insurers may be asked to produce about AI use and governance.
Insurers should
- Maintain an inventory of relevant systems and models, document how risk and materiality are assessed, and identify accountable owners.
- Connect governance and vendor oversight with testing, monitoring, data sources, and issue remediation.
- Treat the draft as a readiness resource, not a newly effective requirement.
State · AI Governance and Health Coverage
North Dakota, South Carolina, and Alabama Highlight Different AI Compliance Needs
North Dakota Bulletin 2026-2, dated October 5, addresses algorithms, predictive models, and AI across the insurance life cycle. It sets expectations for governance and describes information the department may request during investigations and examinations.
South Carolina issued guidance on insurers' use of artificial intelligence systems across all business lines, pointing toward documented governance, risk controls, testing, monitoring, and accountability for AI-supported decisions rather than narrowly focused model documentation. More states are likely to move from broad AI principles toward more prescriptive examination standards, documentation requirements, and controls across underwriting, pricing, claims, fraud detection, and consumer communications.
Alabama Bulletin 2026-07 addresses statutory limits on AI use by health benefit plan providers, that became effective October 1. The bulletin identifies a January 1, 2027 deadline for prominent disclosure on the face page of affected contracts and necessary form filings, and a May 31, 2027 deadline for the first annual certification through SERFF.
Key dates
Alabama disclosures and necessary filings: January 1, 2027
First annual certification: May 31, 2027
Insurers should
- Distinguish all-lines governance expectations from product-specific health-plan obligations.
- Review the applicable statute, plan exclusions, clinical oversight, contract disclosures, filings, and certification ownership rather than applying one generic AI policy to every business line.
Multi-State · Pricing and Consumer Protection
Price Optimization Remains a Target for State Oversight
Michigan's October 27 Bulletin 2026-23-INS explains that legislation effective September 21 codified the prohibition on price optimization in property and casualty ratemaking. Washington's October 12 advisory reaffirms that premiums or rating factors unrelated to cost and risk can be unfairly discriminatory. West Virginia Bulletin 26-03 similarly addresses varying rates based on a policyholder's willingness to pay rather than risk of loss.
These developments concern the factors and judgments used in pricing, whether implemented through conventional methods or more advanced analytics. The key distinction is between risk-based pricing and adjustments driven by non-risk-related consumer behavior.
Insurers should
- Review rating inputs, renewal adjustments, model changes, and vendor methodologies for prohibited price-sensitivity factors.
- Retain the actuarial rationale and approval records supporting pricing decisions.
- Confirm state-specific requirements instead of assuming the three releases impose identical obligations.
Colorado · Aerial Imagery
Revised Aerial-Imagery Guidance Narrows the Scope of the Bulletin
Colorado's revised Bulletin B-5.57 addresses aerial imagery used in underwriting and claims decisions. Unlike the earlier version, the revised text does not frame its scope around pricing and rating, and it excludes specified catastrophe and wildfire predictive-model uses.
The bulletin emphasizes that imagery should be appropriate for its purpose and not treated as definitive on its own. Additional verification may include virtual or physical inspection or customer-provided photos. The revised bulletin retains a 12-month general underwriting benchmark, subject to more recent conditions warranting verification.
Insurers should
- Review the final revised bulletin, not the earlier proposal or a summary of the original version.
- Document image age, quality, relevance, verification, and decision rationale, and ensure vendor-supported decisions can be explained and reviewed.
Federal · AI Terminology
Federal Materials Begin Using SI Alongside Familiar AI Concepts
Executive Order 14434 directs executive agencies to use "Super Intelligence" or "SI" in place of "Artificial Intelligence" or "AI" in non-statutory documents, to the extent permitted by law. It does not require changes to previously issued regulations, contracts, or historical materials. State insurance guidance continues to use AI terminology.
Insurers should
- Include both terms in regulatory monitoring and internal reference materials.
The change in federal terminology does not eliminate the need to assess the underlying model, data, vendor, and consumer-impact risks.
California · Insurance Privacy
A New Privacy Framework Requires Early Implementation Planning
California SB 354, signed September 27, replaces the existing insurance information and privacy framework with revised standards operative July 1, 2028. The new law addresses processing and sharing of personal information, privacy notices, consumer choices and rights, and obligations involving service providers.
The implementation period is longer than many of September and October's filing deadlines, but the work can span underwriting, claims, marketing, procurement, privacy, security, and records management. Applicability and exclusions should be assessed by entity, product, and data flow rather than assumed across an entire organization.
Key dates
SB 354 privacy framework operative: July 1, 2028
Insurers should
- Begin a scoped gap assessment covering personal-information inventories, notices, sharing permissions, consumer requests, retention, and vendor contracts.
- Build an implementation plan that accounts for operational dependencies and subsequent regulatory guidance.
Delaware · Privacy and Breach Response
Delaware Updates Privacy and Breach-Response Requirements
Delaware amended its personal-data privacy law to clarify applicability and separately amended its breach-reporting requirements. The changes affect all business lines and may require updates to privacy assessments, incident-response procedures, notification thresholds, and escalation protocols.
Insurers should
- Reassess applicability under the amended privacy law and confirm that breach-notification thresholds, timelines, and escalation steps match the new requirements.
- Connect privacy applicability analyses to cybersecurity incident-response workflows so the basis for each notification decision is documented.
California · Wildfire Claims and Adjuster Training
Smoke-Damage Legislation Reaches Beyond a Training Requirement
California AB 1795, the Smoke Damage Recovery Act, was signed September 15. The new law includes a rebuttable presumption linking specified smoke damage within a wildfire impact zone to the wildfire, claims-handling provisions, and training and certification programs for insurance adjusters. The law's training provisions should not be treated as the only operational issue. The bill also addresses investigation, testing, restoration, payments, and additional living expenses.
Insurers should
- Coordinate claims, legal, training, and adjuster-management teams.
- Map applicable duties and timing before changing procedures.
- Track training and certification development separately from claims obligations, and confirm the final implementation instructions before assigning courses.
New York · Cybersecurity
Risk Assessments and Patching Remain Operational Priorities
New York's Department of Financial Services (NYDFS) published guidance on conducting and using cybersecurity risk assessments on September 10 and a critical PHP vulnerability alert on October 22. Together, the releases reinforce the need to connect risk identification with timely operational response.
Insurers should
- Confirm that risk assessments drive remediation decisions and that patching ownership, vendor dependencies, exceptions, and completion evidence are documented. A policy or assessment alone does not establish that an identified exposure has been addressed.
State · Claims Administration and Filings
California Downcoding Guidance Adds a Near-Term Filing Deadline
California DMHC All Plan Letter 26-015, issued October 23, addresses downcoding practices in health-plan claims adjudication. It mandates plans make an amendment filing by November 23 and addresses payment policies, review of supporting documentation, provider dispute rights, and oversight of delegated claims functions.
The filing instructions request information about whether plans or contracted entities use downcoding. Plans should assess the letter's filing instructions even if they believe their current practices do not involve downcoding.
Key dates
Downcoding compliance amendment due: November 23, 2026
Insurers should
- Identify affected claims practices and delegates, collect the required policies and agreements, and assign filing responsibility.
- Review whether explanations, supporting-record review, provider notices, and oversight controls align with the letter.
Multi-State · Pharmacy Benefit Managers
PBM Oversight Becomes More Operational and Examination-Focused
Several states advanced pharmacy benefit manager oversight during this period. Kansas issued implementation guidance covering PBM reporting, pricing, dispensing fees, compliance, and licensing. Florida adopted rules governing PBM investigations and market-conduct examinations. Delaware enacted changes addressing pharmacy audits, reimbursement appeals, retaliation, prior authorization, reporting, and prohibited practices. California implemented mandated disclosure of PBM contracts and pharmacy delegations.
The direction is consistent: more states may require detailed PBM reporting, examination access, contract disclosures, reimbursement standards, and insurer oversight of delegated PBM functions.
Insurers should
- Confirm which obligations attach to the PBM, which attach to the carrier, and which require contractual oversight of delegated functions.
- Review reporting, examination-access, contract-disclosure, and reimbursement requirements state by state, and retain the documentation needed to demonstrate oversight of delegated pharmacy functions.
State · Regulatory Systems
Portal Changes Require Records and Access Planning
Maryland's Licensee Portal transition notice states that the existing portal retires November 15 and the new portal opens November 16. Closed task history will not carry over; the notice directs carriers to download needed records and coordinate access requirements, while form and rate filings remain in SERFF.
Illinois Company Bulletin 2026-14 introduces a Financial Statement Filing Portal for Illinois-domiciled companies beginning with third-quarter 2026 submissions. The bulletin requires electronic uploads while retaining hard-copy submissions until the department fully transitions.
Key dates
Maryland old portal retires: November 15, 2026
New portal opens: November 16, 2026
Insurers should
- Preserve historical records, confirm user access, assign backup owners, and reconcile open tasks during transitions. Do not assume a new electronic process eliminates existing submission methods unless the regulator says so.
Licensing · Background Reviews and Appointment Renewals
Licensing Teams Should Separate Policy Changes From Renewal Cutoffs
Kentucky's Legislative Bulletin 2026-05 explains that HB 185 allows a potential applicant to seek a criminal-background review before undertaking required training or specialized education when the licensing authority requires a background check. The bulletin identifies April 10, 2026 as the act's effective date and January 1, 2027 as the deadline for licensing authorities to formulate policies and procedures.
Oklahoma's October appointment-renewal notice identifies a November 25-December 31 renewal period. Its termination cutoff differs from the NIPR schedule: the department notice specifies November 13 at 4 p.m. Central, while NIPR lists November 14. Carriers should confirm the discrepancy and plan for the earlier cutoff to reduce processing risk.
Insurers should
- Update candidate guidance without implying a favorable background determination guarantees a license.
- For renewals, reconcile appointments and confirm termination processing before invoices are created. Keep a record of the controlling regulator instructions and any clarification.
Federal · Health Pricing Transparency
Transparency in Coverage Changes Affect Data and Consumer Support
The October 6 Transparency in Coverage final rule revises public pricing disclosures for affected non-grandfathered group health plans and issuers. Changes address file standardization, contextual data, accessibility, reporting, and the availability of pricing information by telephone. The regulations are effective December 7, 2026; implementation planning should separately track the applicability provisions for each requirement.
Insurers should
- Map changes to data sourcing, file generation, validation, website publication, vendor contracts, and telephone support. Do not treat the rule's effective date as a single universal compliance date for every provision.
Federal · Marketplace Distribution
CMS Connects Agent Attribution With Enrollment Integrity
CMS's October 27 issuer agent-of-record guidance describes system protections intended to prevent unauthorized or non-compliant enrollments from generating commissions. It also explains that CMS does not intend to disrupt legitimate existing issuer attribution processes, including corrections supported by records showing that an agent or broker assisted the consumer.
Separate October 5 guidance explains the Federally-facilitated Exchange's (FFE's) implementation of statutory changes limiting Advanced Premiums Tax Credit (APTC) and income-based cost-sharing reductions for noncitizens to the defined eligible categories beginning in plan year 2027. This guidance concerns financial assistance, not a blanket prohibition on Marketplace coverage.
Insurers should
- Review consumer authorization, NPN attribution, identity verification, commission exceptions, and supporting records.
- Coordinate eligibility and renewal communications with operations and distribution teams, and avoid equating loss of financial assistance with automatic loss of all coverage eligibility.
Federal · Medicare Advantage Provider Directories
CMS Raises Expectations for Provider-Directory Accuracy
CMS issued multiple communications addressing technical specifications, FHIR-based JSON files, data validation, and FAQs, and released Contract Year 2027 directory data on Medicare Plan Finder on October 9, 2026. The volume and progression of guidance indicate heightened expectations for provider-data accuracy and continuing supervisory attention.
The repeated guidance and technical-assistance sessions suggest CMS expects organizations to move beyond periodic manual directory checks toward more continuous data validation. Likely future activity includes additional technical corrections, validation expectations, audit protocols, and enforcement tied to inaccurate or inaccessible directory information.
Key dates
Contract Year 2027 directory data released on Medicare Plan Finder: October 9, 2026
Insurers should
- Review data lineage, validation, reconciliation, exception remediation, certification, and vendor oversight for provider-directory information.
- Treat directory accuracy as an ongoing data-quality obligation rather than a periodic manual check.
Federal · Medicare Part D
A Part D Pharmacy-Contracting Standard Is on the Horizon
CMS issued a Request for Information concerning "reasonable and relevant" pharmacy contract terms and conditions. The RFI is likely to inform proposed rulemaking, and the standards must be established for plan years beginning January 1, 2029 - the clearest future-rulemaking signal in the recent federal activity.
CMS also notes the availability of quarterly retail-pharmacy network-access results in HPMS, connecting future contracting policy with its existing network-access supervision.
Key dates
Part D pharmacy-contracting standards apply for plan years beginning January 1, 2029
Insurers should
- Monitor the RFI and any resulting proposed rule.
- Begin inventorying pharmacy contract provisions and mapping them to likely CMS policy categories so impact can be assessed as the standard develops, while keeping an RFI distinct from a final requirement.
Federal · Mental Health Parity
Parity Enforcement Focuses on Nonquantitative Treatment Limitations
The Department of Labor published enforcement principles for Mental Health Parity and Addiction Equity Act (MHPAEA) nonquantitative treatment limitations (NQTLs). The principles create compliance risk around comparative analyses, utilization-management practices, network design, and documentation of benefit limitations.
Future activity may include plan-specific information requests, enforcement actions, updated examination criteria, FAQs, and further coordination among the Department of Labor, HHS, and Treasury.
Insurers should
- Connect each nonquantitative treatment limitation to its comparative analysis, supporting data, approvals, testing, and remediation history.
- Confirm that utilization-management practices, network design, and benefit limitations are documented in a way that can withstand a plan-specific information request.
Federal · Communications and Future Medicare Requirements
Robocall Changes and CMS Proposals Need Distinct Treatment
The FCC's September 30 order, released October 1 and published October 26, modifies consent-revocation rules, including category-specific informational-call revocations and an exclusive revocation method, and amends the financial-institution fraud-alert exemption. The published final rule is effective November 25, 2026. It is more nuanced than a general tightening of opt-out requirements.
CMS also issued an October 16 proposed rule addressing Medicare Advantage provider-directory accuracy and Part D PBM accountability, with provisions tied to later contract years. An October 23 proposed Exchange verification rule is another item to monitor.
Insurers should
- Review calling categories, consent records, revocation handling, and vendor workflows against the final FCC text.
- For CMS proposals, assess potential data, contract, and oversight impacts while keeping proposed provisions separate from statutory requirements and final rules.
How RegEd Can Help
Operationalize change across states and business functions
The volume of September and October activity underscores the challenge of managing requirements that vary by jurisdiction, product, effective date, and responsible business function. Catastrophe orders may change repeatedly, PBM requirements divide responsibility among carriers and vendors, and 2027 health and Medicare developments require coordinated updates across contracts, claims, reporting, member materials, and training.
RegEd's regulatory change management and compliance management solutions help insurers connect regulatory developments to affected products, policies, procedures, controls, owners, and recurring tasks. A centralized, workflow-enabled approach can improve implementation visibility while maintaining the documentation needed to demonstrate that regulatory changes were reviewed and addressed.
RegEd Inc published this content on November 12, 2026, and is solely responsible for the information contained herein. Distributed via Public Technologies (PUBT), unedited and unaltered, on November 12, 2026 at 18:41 UTC. If you believe the information included in the content is inaccurate or outdated and requires editing or removal, please contact us at [email protected]