AI governance

AI governance that applies to the work.

Name an owner. Approve the uses. Decide what people must approve. Keep the record.

Build integrations, pages, reports and automations inside Deep Thought. They use the platform’s sign-in, permissions, approvals and records.

Discuss your AI governance See the security controls

The principles, put into practice.

Set the policy for your company, then apply it to the work people and AI do together.

Accountable ownership

Policy: Name an executive owner and an AI committee, with clear decision authority. Approve new uses, tools and vendors; review the program quarterly.
Why it matters: Clear responsibility keeps AI decisions from falling between departments.
Deep Thought: Administrators control model settings, tool permissions and shared connections. Changes to those controls are recorded.

Approved tools only

Policy: Company data belongs in approved AI tools, never personal accounts. Review new AI features before enabling them.
Why it matters: Each additional tool introduces permissions and data terms to govern, and another vendor review.
Deep Thought: Connect approved systems through Deep Thought, with one set of platform permissions, approvals and records.

Protect customer data

Policy: Require written terms for no training on company data, defined retention, US processing and a disclosed subprocessor list.
Why it matters: Policyholder information needs protection wherever AI processes it.
Deep Thought: Administrators control AI data handling, and changes are recorded. Incoming files are scanned for malware before they are opened.

Least access

Policy: Use company sign-in with multifactor authentication. Grant only needed access, review it quarterly and remove access on departure.
Why it matters: Overbroad access gives AI more information than the work requires.
Deep Thought: Use company sign-in, roles and connection grants. Direct database queries are read-only; stored connection credentials are encrypted.

Human oversight, in proportion to risk

Policy: Assign a person to approve consequential actions. Keep coverage, premium and claim decisions with people; introduce automation in stages.
Why it matters: A wrong action can change coverage or send the wrong instruction.
Deep Thought: Consequential actions in conversations require approval. Automations follow owner-approved instructions. Content read by AI cannot grant approval.

Govern what AI builds

Policy: Keep AI-built pages, reports and automations on the approved platform. Review work before sharing it across the company.
Why it matters: Tools people rely on need controls throughout their use.
Deep Thought: Pages, reports and automations use platform permissions and records. Sharing a page requires administrator review; interactive page content runs in a sandbox.

Keep the record

Policy: Keep an inventory of AI uses and retain evidence of actions and approvals for the period your policy requires.
Why it matters: Evidence must exist before a regulator or carrier asks for it.
Deep Thought: Audit records carry integrity checks, a default one-year retention period, configurable retention and legal hold.

Hold vendors to the standard

Policy: Review vendors’ data use, retention, training, subprocessors, security and breach notice before use and annually. Document each review and its outcome. Keep controls independent of model choice.
Why it matters: Changing providers must not weaken governance.
Deep Thought: Choose from approved AI models while permissions, approvals and records remain in the platform.

Train people, and review

Policy: Train staff on acceptable AI use and fraud. Confirm payment changes using a known number; review access, uses and incidents quarterly.
Why it matters: Policies need people who understand them and regular checks that they still fit.
Deep Thought: Review users, roles, actions and approval records in one administration console.

Why now

Insurance regulators expect AI governance to be documented and applied.

Adoption and state guidance

As of October 8, 2026, 29 jurisdictions have adopted the NAIC Model Bulletin on insurers’ use of AI. California, Colorado, New York and Texas have separate insurance-specific regulation or guidance.

NAIC adoption map · October 8, 2026

A written program, with evidence

The bulletin expects a written AI program with senior accountability, controls proportionate to risk, oversight of third-party AI and records available for regulatory review.

NAIC Model Bulletin · Sections 3 and 4

Vendor oversight: a draft framework

On July 8, 2026, the NAIC exposed a draft framework for data and model vendors supporting property and casualty premium calculation and underwriting. It proposes a voluntary, shared NAIC registry with governance information accessible to state regulators.

Bring your AI policy. Walk through the controls.

See how your systems and proposed AI uses fit the permissions, approvals and records in Deep Thought.

Talk through your policy