Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 23 SEPTEMBER 2026

Privacy, Cyber & Data Strategy Advisory | NAIC Summer Meeting Sharpens Focus On AI, Data, And Technology Governance

Alston & Bird LLP
Alston & Bird LLP
Contributor
Alston & Bird LLP

Alston & Bird LLP

Alston & Bird provides the highest-quality and most responsive legal counsel and services to...

View firm profile
Explore more from Alston & Bird LLP

The National Association of Insurance Commissioners intensified its regulatory focus on artificial intelligence governance, third-party data models, and cybersecurity oversight at its Summer 2026 meeting. Regulators are shifting from principles-based guidance to examination-ready supervisory tools, emphasizing that insurers remain accountable for the technologies and vendors they deploy. The meeting revealed how AI risk evaluation, vendor oversight frameworks, and privacy modernization efforts are convergin

United StatesInsurance
Dorian W. Simmons
Dorian W. Simmons

Executive Summary

The National Association of Insurance Commissioners (NAIC) Summer National Meeting highlighted regulators’ growing focus on how insurers govern AI, third-party data and models, cybersecurity, and privacy. Our Privacy, Cyber & Data Strategy Team examines what the latest NAIC initiatives could mean for technology governance, vendor oversight, and regulatory readiness.

  • NAIC regulators are moving from principles-based AI guidance toward supervisory tools and examination readiness
  • Proposed initiatives could increase expectations for third-party data and model oversight and streamline cybersecurity event reporting
  • Privacy modernization continues as regulators consider changes affecting consumer rights, consent, service providers, and data governance

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

AI Regulation In Insurance: A Crossroads

As artificial intelligence development accelerates and safety concerns mount, state insurance regulators are advancing comprehensive examination frameworks to govern AI use in the insurance industry. The National Association of Insurance Commissioners nears completion of its AI Risk Evaluation Supplement, which will establish standardized oversight procedures for insurers' AI governance practices across market conduct and financial examinations.
United StatesInsurance
McDermott Will & Schulte
McDermott Will & Schulte
Article

Agents Of Change: Amendments To Washington State Insurance Regulations Take Effect October 18

Washington's Insurance Commissioner has announced significant amendments to insurance claims handling regulations that will reshape how insurers investigate and process claims in the state. The changes, effective October 2026, introduce new requirements for mitigation approvals, investigation standards, and claimant communications that could substantially impact insurer operations and liability exposure. These regulatory updates come in response to a surge in consumer complaints and litigation, establishing
United StatesInsurance
Ballard Spahr LLP
Ballard Spahr LLP
Article

Don’t Try To Deny It: Federal Court Holds FCA Settlement Is Covered By Insurance

A federal court ruled that CNA must provide coverage for Guidehouse's $7.6 million False Claims Act settlement related to cybersecurity failures in New York's Emergency Rental Assistance Program portal. The decision addresses critical questions about when insurers can deny coverage for FCA settlements under professional liability policies, particularly regarding exclusions for fines, penalties, and deliberate acts.
United StatesInsurance
Crowell & Moring LLP
Crowell & Moring LLP
Article

Massachusetts Appeals Court Affirms Chapter 93A Liability For Delayed Disability Insurance Benefits

The Massachusetts Appeals Court examined whether an insurer's two-year delay in paying disability benefits constituted a violation of state consumer protection and insurance laws. Despite medical evidence describing the plaintiff's feet as paralyzed and functionally useless, the insurer repeatedly denied claims under a policy provision for total loss of use of both feet, arguing the plaintiff could still walk with assistive devices.
United StatesInsurance
Greenberg Traurig
Greenberg Traurig
Podcast

The CLO Chronicles — NAIC’s New Life RBC Factors Cross The Finish Line (Podcast)

The NAIC has spent four years overhauling capital requirements for life insurance companies' investments in collateralized loan obligations, introducing dramatic changes that will reshape how insurers allocate capital across their investment portfolios. These new rules, which account for credit spectrum positioning and tranche thickness for the first time, will force insurers to model significant impacts before year-end 2026 implementation.
United StatesInsurance
Mayer Brown
Mayer Brown
Article

Is Your PFAS Coverage At Risk? An Ohio Federal Court Ruling Opens The Door To Broader Insurer Denials

A federal court in Ohio has ruled that an occupational disease exclusion in a commercial general liability policy bars coverage for PFAS-related personal injury claims brought by firefighters against a manufacturer of firefighting equipment. This landmark decision could significantly impact how insurers respond to PFAS product liability claims and may extend beyond occupational disease exclusions to other policy provisions using similarly broad language.
United StatesInsurance
Benesch, Friedlander, Coplan & Aronoff LLP
Benesch, Friedlander, Coplan & Aronoff LLP
Article

AI Quarterly | A Review Of AI Law, Policy & Practice | 2026 Q3

Explore the latest developments in AI regulation, cybersecurity threats, and compliance frameworks as businesses navigate personalized pricing scrutiny, prompt injection attacks, and evolving transparency obligations. Discover how government initiatives and international intelligence agencies are responding to AI-driven vulnerabilities while organizations implement practical governance strategies across legal, privacy, and operational domains.
United StatesPrivacy
Alston & Bird LLP
Alston & Bird LLP
Article

Privacy, Cyber & Data Strategy Advisory | Connected Devices And Software: New EU Cyber Incident Reporting Rules Take Effect

The EU Cyber Resilience Act's incident reporting obligations take effect on September 11, 2026, requiring manufacturers of connected devices and software to report certain vulnerabilities and cybersecurity incidents. This marks a critical milestone in EU cybersecurity regulation, introducing new compliance requirements for companies that may already face reporting obligations under other digital regulations.
European UnionTechnology
Alston & Bird LLP
Alston & Bird LLP
Article

The Digital Download | Alston & Bird’s Privacy & Data Security Newsletter | August 2026

Alston & Bird's quarterly Digital Download examines the rapidly evolving intersection of privacy, cybersecurity, and data strategy, highlighting how AI-driven threats are reshaping breach costs, regulatory frameworks, and organizational defense strategies. From IBM's 2026 breach report showing record-high costs to new government initiatives like the White House's Gold Eagle clearinghouse, the landscape demands heightened vigilance and sophisticated governance approaches.
United StatesPrivacy
Alston & Bird LLP
Alston & Bird LLP
Article

Privacy, Cyber & Data Strategy Advisory | Autonomous Hacking: Planning For The AI Cyber Agent That Goes Rogue

Artificial intelligence agents are gaining unprecedented autonomy and cyber capabilities, transforming theoretical risks into tangible legal liabilities. As AI systems independently exploit vulnerabilities and access unauthorized systems, organizations face complex questions about criminal and civil exposure under existing computer fraud laws. Understanding how autonomous agents can go rogue—and what legal frameworks apply when they do—has become essential for any company deploying these powerfu
United StatesTechnology
Alston & Bird LLP
Alston & Bird LLP