Show me your written AI program, and the record of what your AI recommended, and who decided, on this file.
A regulator will ask that question. Not rhetorically, and not eventually: at an examination, about a specific file. This page explains what the rules require and how Catalyst produces the record that answers them.
Get the 2026-2027 regulatory brief
A plain-language walkthrough of the NAIC Model Bulletin and NY DFS 2024-7, and the record that answers both. Twelve pages, written for the people who sign the compliance attestations. We email it to your work address.
What the NAIC Model Bulletin requires
The NAIC Model Bulletin on the Use of AI Systems by Insurers has been adopted in 27 states and the District of Columbia, per the NAIC's implementation tracker dated October 8, 2026, and the list is still growing. It requires carriers to maintain a written AI program: a documented account of how AI is used, governed, and controlled across the organization.
That program is subject to regulatory examination. It is not an internal aspiration document. An examiner can ask to see it, and can ask to see evidence that practice matches what it says.
What NY DFS 2024-7 adds
New York DFS Circular Letter 2024-7 goes further. Carriers must be able to demonstrate that their AI does not proxy for protected classes. They must maintain explanatory documentation for how the AI reaches its outputs. And they cannot rely solely on a vendor's claim of non-discrimination: buying the AI from someone else does not transfer the obligation.
Together the two set a concrete standard: a written program, explanations an examiner can follow, and evidence at the level of the individual file.
And the other 49 states
New York is the sharpest example, not the whole picture. Most carriers write in many states, and the states are moving at different speeds: some adopted the NAIC bulletin, some wrote their own rules, some did both.
We keep the full map on one searchable page: every US jurisdiction, its adoption status, and its special requirements.
Why an external observability tool cannot answer it
Horizontal AI governance tools observe agents from the outside. They produce dashboards: aggregate metrics about systems they did not run. Governance bolted alongside the system never sees the agents the system spawned, and it cannot say what was recommended on a specific file, or who decided.
The examiner's question is not aggregate. It names a file. A dashboard cannot answer it.
How Catalyst answers it
Catalyst sits between your people and your data and governs agents from the inside. The record is produced where the work happens, not reconstructed afterward.
Append-only event spine
Every action lands on an append-only event spine. Nothing is edited in place, so the history an examiner reads is the history that happened.
Typed predicates for hard refusals
Hard refusals run on typed predicates: deterministic rules, not model judgment. What must never happen is enforced by code an auditor can read.
Provenance on every recommendation
Every recommendation carries provenance: the document, rule, or precedent it came from, cited at the point of recommendation.
The decision, recorded against the file
The human decision is recorded against the file. The record shows what the AI recommended and who decided. People make the calls.
The record itself
The output is a compliance report an examiner can hold: the written program on one side, the file-level record on the other, mapped section by section to the NAIC bulletin and DFS 2024-7.
The fastest way to evaluate it is on a real file from your own book.
The report, mapped section by section
Auditing the interviews themselves
Interview compliance is its own discipline. Polyrific Advisory for Insurance brings the same approach to it: Interview QA is designed to review recorded application interviews against the script and the requirements, and flag what needs a second listen. The reviewer decides, on the same governed substrate.