NAIC AIS program and Exhibit B

Overview

The NAIC AI Risk Evaluation Supplement (v6.0) asks an insurer for its AIS Program in Exhibit B, either as a Checklist (items 1, 2, 2a–2c and 3a–3p) or as a Narrative. The Supplement defines the AIS Program as “the controls and processes that an insurer adopts and implements to ensure the responsible use of AI Systems.”

Govern → Compliance program → AIS program keeps what Exhibit B asks about, for the whole organisation (not one project or environment):

1. Program: the NAIC filing profile, and the written program documents with their versions, who approved them and when they are next reviewed.
2. Governance: the bodies that oversee AI, the accountable roles, and the subject-matter experts regulators may contact.
3. Training: training programmes on AI use, where prohibited practices are stated, and completions imported from your learning system.
4. Exhibit B: the Checklist and the Narrative in the Supplement’s own order and words, each item answered from the above and from Shield360’s records, exported as PDF, HTML, CSV or JSON.

Caution

Shield360 records your program and prepares Exhibit B from it. Your company reviews the responses and is responsible for what it submits. Nothing here is a statement that the company complies with any law, bulletin or regulation.

Prerequisites

• To read the program and export Exhibit B, you need View the compliance overview (compliance.read) in your organisation role.
• To change the program and answer Exhibit B, you need Maintain the Statement of Applicability (compliance.soa.manage) in your organisation role.
• To link a management review to a governance body, you need Manage internal audits and management reviews (compliance.reviews.manage).

Set up the filing profile

The filing profile is the header every NAIC exhibit Shield360 exports carries: company legal name, group name, NAIC company code (CoCode), NAIC group code, and the filing contact’s name, title, email and phone. Set it once on the Program tab. Codes are digits only.

Record program documents

Shield360 keeps a reference to each document, not the document itself.

Add a document

Choose its type — AIS Program, AI use policy, acceptable use policy, vendor procurement standard, model risk policy, data governance policy, consumer disclosure and notification policy, training material or other — and enter its title, version, what it governs, how often it is reviewed, and where it is kept (a link or document-management reference).

List its sections and pages

One per line, as label | section | page. Exhibit B answers point at these.

Record adoption

Enter the day it was adopted and who approved it: the Board of Directors, a committee (choose which) or management. The next review day is set from the review frequency. Adopting a new version supersedes the version adopted before it.

Record each review

The next review day moves on by the review frequency. When an adopted document passes its next review day, an ais_program.review_overdue alert is raised once.

An adopted version’s type, title, version and scope are what was approved; to change them, start a New version. Only a draft can be deleted; retire an adopted document instead. Every step is kept in the document’s approval history.

Record governance

• Governance bodies: type (board, board committee, management committee, working group), charter, members and their roles, how often they meet, how often they report to the board and when they last did. Shield360 shows when the next board report falls due. Link the management reviews a body held, in any of the organisation’s environments.
• Accountable roles: who answers for each part of the program.
• Subject-matter experts: name, title, area and contact. Exhibit B asks for this list; it is attached to every Exhibit B export.

Record training

Add a programme with its audience, the training document, how often it repeats, and where prohibited practices are stated. Then import completions as CSV:

Name,Email,Completed on
Ann Lee,ann.lee@example.com,2026-01-10
Bo Park,,01/11/2026

The header row needs a name or email column and a completion date column (YYYY-MM-DD or MM/DD/YYYY). People do not need to be Shield360 users. A completion already recorded for the same person and day is skipped; rows that cannot be read are listed by line and not stored. Each import can be undone. A person’s completions are included in a person export and removed by erasure.

Build Exhibit B

Open the Exhibit B tab and choose the form

Regulators ask for either the Checklist or the Narrative. Answers are kept for each.

Answer each item

Point at program documents with a section or page, tick the Shield360 pages that evidence it (controls, AI inventory, risk register, impact assessments, AI requests, findings, internal audits, management reviews, change control, transports, enforcement policy and coverage, training), and write details.

Use Shield360's draft where it helps

Use Shield360 draft adds the documents of the right type, the usual evidence pages, and — where Shield360 has the facts — a draft text. Drafts are written from the organisation’s own settings and records, for example: how many computers, browsers, AI proxies and editors reported in the last 30 days (unsanctioned AI use); what the browser extension, AI proxy and coding-agent hooks do with Social Security numbers, payment cards, bank accounts, emails and phone numbers (nonpublic personal information); the AI tool policy per vendor and AI intake (enterprise assistants); and how intake risk ratings, the risk register and impact assessments treat high-risk use (general-purpose tools in a high-risk workflow). A draft stays marked until someone selects Confirm draft.

Export

Export as PDF or HTML (the Supplement’s header, then every item with its document and page, Shield360 evidence and response, then the documents referenced and the subject-matter experts), or CSV and JSON with every answer in full.

Each item shows a status:

Status	Meaning
Answered	Confirmed text, or a document with its section or page.
Partial	Evidence links only, a document without a section or page, or a draft nobody has confirmed.
Missing	Nothing yet.

API

All routes act on the caller’s current organisation.

Method and path	What it does
GET /api/governance/ais-program	Filing profile, documents with history, governance bodies, people, training.
GET / PUT /api/governance/ais-program/filing-profile	Read or change the filing profile.
POST /api/governance/ais-program/documents	A draft document, or a new version with seriesId.
GET / PATCH / DELETE /api/governance/ais-program/documents/{id}	Read; change, adopt, record_review or retire; delete a draft.
POST /api/governance/ais-program/committees, PATCH / DELETE …/committees/{id}	Governance bodies.
POST /api/governance/ais-program/committees/{id}/reviews	Link (or with linked: false, unlink) a management review.
POST /api/governance/ais-program/people, PATCH / DELETE …/people/{id}	Accountable roles and subject-matter experts.
POST /api/governance/ais-program/training, PATCH / DELETE …/training/{id}	Training programmes.
POST / DELETE /api/governance/ais-program/training/{id}/completions	Import completions { csv }; undo an import ?batch=.
GET / PUT /api/governance/ais-program/exhibit-b	Items, answers and statuses (`?form=checklist
GET /api/governance/ais-program/exhibit-b/export	`?form=checklist

Related

Management review

Reviews held by a governance body, linked from here.

Evidence package

Signed evidence for an environment and period.