AI for insurance agents: quoting without exposing applicant data

What applicant data is at risk when insurance agents use AI for quoting?

Nearly everything on the application. A personal lines quote can include dates of birth, driver's license numbers, violation and claims history, and vehicle identification numbers. Commercial quotes add payroll figures, loss runs and financial statements. Life and health quotes can include medical information. California's breach notice law, Civil Code 1798.82, lists driver's license numbers, medical information and health insurance information among the data elements that trigger notice when exposed with a name. Any of them can land in an AI prompt when a producer pastes an application to get a summary or a coverage comparison.

What does California law say about sharing applicant information with an AI tool?

It starts from a prohibition. Insurance Code 791.13, part of the Insurance Information and Privacy Protection Act, says an insurance institution, agent or insurance-support organization "shall not disclose any personal or privileged information" about an individual collected or received in connection with an insurance transaction unless an exception applies.

Two exceptions matter most for AI. The first is the individual's written authorization. The second, in subdivision (b), allows disclosure reasonably necessary to let another person "perform a business, professional, or insurance function" for the agent, as long as that person agrees not to disclose the information further except as the section allows or as needed to perform the function.

An AI vendor processing a producer's prompt is arguably performing a business function. Whether it has agreed not to disclose further depends on its terms: whether it may train models on your inputs, how long it keeps them, and whether its staff or subprocessors can read them. Those are questions for the contract and for counsel, and they are why a personal account on consumer terms is a poor place for an application.

Written authorization is the other route, and it rarely suits routine quoting. Collecting a signed authorization for every AI-assisted summary adds friction to the sale and still leaves the agency answerable for how the vendor handles the data afterward. Most agencies get further by choosing tools whose contract terms fit the service provider exception and by keeping identifiers out of prompts whenever the task allows. That combination also gives the agency a simple answer when a carrier, an auditor or a client asks how applicant data is handled.

Do insurance AI rules apply to agencies or only to carriers?

Mostly carriers, with exceptions agencies should know. The NAIC's Model Bulletin on the Use of Artificial Intelligence Systems by Insurers is addressed to insurers, and the NAIC's adoption map showed 29 jurisdictions adopting it as of October 8, 2026. California is not one of them. California's own Bulletin 2022-5, issued June 30, 2022, is directed to insurers, licensees and all persons engaged in the business of insurance in California. It calls on them to avoid bias and unfair discrimination in marketing, rating, underwriting and claims, including where algorithms and models are involved, and to give consumers the specific reasons for adverse underwriting decisions.

Agencies licensed in other states should also check whether those states adopted the NAIC Insurance Data Security Model Law (#668). In the model, Section 4F requires licensees to use due diligence in selecting third-party service providers and to require them to implement appropriate safeguards. Section 9A exempts licensees with fewer than ten employees, including independent contractors, from those program requirements. State versions vary, so read the enacted text.

Which quoting tasks can insurance agents give to AI safely?

The ones that never need an applicant's identity. Much of the everyday value of AI for insurance agents comes from tasks that use no applicant data at all:

• Summarizing a carrier's underwriting guidelines or appetite guide.
• Comparing policy form language between two carriers.
• Drafting plain-language explanations of coverages and exclusions.
• Writing follow-up emails and renewal reminders with placeholders in place of names and policy numbers.

The higher-risk uses are pasting full applications, uploading loss runs or declarations pages, and anything involving health questionnaires. Those need an approved platform and controls before anyone tries them. AI features inside comparative raters and agency management systems deserve the same review: they run under that vendor's contract, so read any AI addendum before turning them on.

What controls let insurance agents use AI in quoting safely?

A short list, enforced by technology instead of memory:

• Approved tools only. Choose business AI plans whose terms bar training on your inputs and limit retention, and keep the contract on file.
• Single sign-on and MFA. Tie AI accounts to agency identities so access ends the day a producer leaves.
• Block personal accounts. Stop staff from signing in to consumer AI services on agency devices.
• Data loss prevention. Write rules that catch driver's license numbers, Social Security numbers and policy numbers in prompts and uploads.
• Logs and review. Keep records of who used which tool with what data, and review them on a set schedule.
• Training with examples. Show producers which quoting tasks are approved and how to strip identifiers before asking for help.

What should an agency principal do this quarter?

Start with what producers already do, then put controls in place before expanding:

• Ask producers and CSRs which AI tools they use today, including features inside your rater and management system.
• Map each use to the data it touches, and sort uses into approved, approved with controls, and not approved.
• Have counsel review your AI vendor terms against Insurance Code 791.13 and any security requirements in your carrier agreements.
• Turn on DLP and personal account blocking before rolling out an approved tool.
• Write a one-page AI rule for the agency and walk through it at your next staff meeting.

How does s90 help?

s90 sets up AI guardrails for insurance agencies and other financial services firms: approved AI platforms tied to your identity system, blocked personal accounts, DLP rules for applicant identifiers, and activity logs you can show an auditor or a carrier. If your producers already use AI to speed up quotes, talk with our team about putting controls around it.