West Virginia — Insurance Bulletin 24-06 (NAIC AI Model, Condensed) + Insurance Scoring Bulletin 20-12 + Prior Authorization Statute §33-15-4s + AI Task Force (HB 3187 of 2025): AI Compliance Requirements

This is the binding floor beneath the advisory bulletin, and it had to be located by reading the Code because Bulletin 24-06 cites no statute at all. The Unfair Trade Practices Act, W. Va. Code art. 11, defines and prohibits unfair methods of competition and unfair or deceptive acts and practices in insurance, and it reaches conduct regardless of the method used to determine or support it — an AI System is not a defence and is not a category the article carves out. Enforcement runs through §33-11-6: after notice and hearing, on a finding that a person has engaged or is engaging in a prohibited method, act or practice, the Commissioner SHALL issue a cease-and-desist order — this is mandatory, not discretionary — and "in addition thereto" MAY at his or her discretion order monetary penalties, licence revocation or suspension, or restitution. Read the shape carefully, because it differs from both patterns seen elsewhere in this vein: a monetary penalty is available at FIRST INSTANCE and is not conditioned on breaching an earlier cease-and-desist order, but it is discretionary and sits on top of a compulsory cease-and-desist rather than replacing it. Note also §33-11-6(f), which expressly provides that the restitution mechanism creates NO private cause of action and voids itself if a court finds one; and §33-11-6(i), which disapplies §33-11-4a and the restitution subsection to medical professional liability claims under §55-7B and to workers' compensation policies under §23-2C. Judicial review of any order runs through §33-2-14.

This is West Virginia's real algorithmic-accountability regime, and it predates the AI debate. Insurance Bulletin 20-12, "Insurance Scoring for Personal Lines" (issued May 15, 2020, rescinding Informational Letter 142B in its entirety), sets the requirements every filing must meet where the filing relies "in any way" upon the use of consumer credit reports or insurance scoring. Three of its sixteen items bear directly on model governance and go further than the NAIC bulletin's advisory language. Item 1: the insurer, rating organisation OR MODEL PROVIDER must have tested and certified — and must retain documentary evidence available to the OIC on request — that the data are not used in an unfairly discriminatory manner based upon age, race, socioeconomic class, occupation, nationality, religion, sex or handicap, "either directly or INDIRECTLY". That express reach to indirect discrimination is a proxy-variable hook, and it is the provision an AI model trained on correlated features must be tested against. Item 2: the same parties must have tested and certified, with evidence retained, that "the algorithm is an accurate and statistically credible predictor of loss". Item 4: the Commissioner may request that the model developer provide THE ACTUAL INSURANCE SCORING ALGORITHM in use together with all statistical data used to develop it; proprietary or trade-secret material is not exempt from production but is withheld from PUBLIC disclosure provided the insurer or developer files it separately and clearly identifies it as such. Item 5 adds that first-time implementation of credit reports or insurance scoring must have no overall rate impact, and any change producing an overall rate change must be accompanied by a rate change request.

Three consumer-facing constraints that bite on any automated personal-lines decision. First, item 6: insurance scoring "shall not be the sole basis for the declination" of a request for personal lines automobile or homeowner's insurance — placement of the risk with an affiliate company does not count as a declination. This is a sole-basis prohibition of the kind most NAIC-bulletin states lack, and it means a fully automated decline driven by score alone is non-compliant regardless of how well validated the model is. Second, item 11(b): where an insurer takes an adverse action (as defined in the Fair Credit Reporting Act, 15 U.S.C. §1681a(k)) based upon credit information, it must notify the consumer that an adverse action has been taken based upon credit information, provide the name and address of the source from which the information was obtained, and explain the reason for the adverse action "in clear and specific language so that a person can identify the basis for the insurer's decision" — and the bulletin then forecloses the usual evasion by stating that generalized terms such as "poor credit history", "poor credit rating" or "poor insurance score" do NOT meet the explanation requirement. Standardized credit explanations supplied by consumer reporting agencies or other third-party vendors are deemed to comply. Third, item 11(c): no adverse action may be taken based on credit information unless the insurer obtains and uses a credit report issued, or an insurance score calculated, WITHIN 90 DAYS of the date the policy is first written or renewal is issued. Item 8 additionally requires that the methodology and logistics of obtaining the credit report not violate the Fair Credit Reporting Act.

West Virginia's prior-authorization statute, enacted by SB 267 of 2023 and effective for policies, contracts, plans or agreements delivered, executed, issued, amended, adjusted or renewed on or after January 1, 2024, with parallel provisions at §33-16-3dd (group accident and sickness), §33-24-7s, §33-25-8p and §33-25A-8s (health maintenance organizations). Health insurers must require prior authorization forms and all related communication to be submitted through an ELECTRONIC PORTAL and must accept one prior authorization per episode of care; the portal must sit in an easily identifiable and accessible place on the insurer's webpage with its address printed on the insured's insurance card, must include instructions for submitting clinical documentation, must send electronic confirmation of receipt, must carry a comprehensive list of everything for which authorization is required — with the standard for inclusion being "science-based using a nationally recognized standard", updated at least QUARTERLY — and must state conspicuously whether step therapy applies. The portal was to be prepared by July 1, 2024. Decision deadlines: the insurer must respond within FIVE BUSINESS DAYS of electronic receipt of a complete request, reduced to TWO BUSINESS DAYS where delay could seriously jeopardize the life, health or safety of the patient or others, or where in the opinion of a practitioner with knowledge of the patient's condition the patient would be subjected to adverse health consequences without the care. If the submission is incomplete the insurer must identify ALL deficiencies and return the request within TWO BUSINESS DAYS, with the practitioner then having three business days to supply the additional information; if the insurer wishes to audit the request or the step-therapy information is incomplete it may transfer the request into peer review within two business days. Evaluation must use NATIONAL BEST PRACTICE GUIDELINES. An approved authorization carries over to all other managed care organizations, health insurers and the Public Employees Insurance Agency for three months where the services are provided in-state. Any prescription written for an inpatient at discharge that would require authorization must be immediately approved for not less than three days provided the medication does not exceed $5,000 per day.

The human-reservation provision, and the precise limit of it — which matters more than its existence for anyone deploying automated utilization review in West Virginia. Where a prior authorization is rejected and the submitting practitioner requests an appeal by peer review of the decision to reject, §33-15-4s(i) requires that "the peer review shall be with a health care practitioner, SIMILAR IN SPECIALTY, EDUCATION, AND BACKGROUND". The health insurer's MEDICAL DIRECTOR has the ultimate decision regarding the appeal determination, and the practitioner has the option to consult with the medical director after the peer-to-peer consultation. Timing is capped twice: the peer-to-peer appeal process may take no longer than FIVE BUSINESS DAYS from the date the peer-to-peer consultation is requested, and the appeal of a decision on a prior authorization may take no longer than TEN BUSINESS DAYS from the date the appeal is submitted. READ THE LIMIT HONESTLY: this subsection reserves the APPEAL to a similar-specialty human and names a human with ultimate authority over it, but it says nothing about who or what may issue the ORIGINAL adverse determination. West Virginia is therefore NOT among the states that reserve the denial itself to a licensed physician — on the face of the statute an automated system may issue the first-instance prior-authorization denial, provided the statutory deadlines are met and a compliant human peer-review appeal is available behind it. Two backstops sit behind that: evaluation must still use national best practice guidelines under subsection (h), and art. 16H provides binding independent review organization external review, where §33-16H-3 makes the IRO decision enforceable in the same manner as an order of the Commissioner, requires the issuer to provide benefits pursuant to the final external review decision including payment on a disputed claim unless and until a court decides otherwise, and makes an issuer that petitions for judicial review liable for the individual's reasonable attorney's fees where the individual substantially prevails.

West Virginia expects every insurer authorized to do business in the state to develop, implement and maintain a written AIS Program governing AI Systems that make or support decisions on regulated insurance practices. Read the normativity honestly: the bulletin says insurers "should" develop the program and that "the OIC recommends the following AIS Program guidelines be considered by insurers" — the NAIC model says insurers "are expected to". The program must be proportionate to the insurer's own risk assessment across five stated factors: the nature of the decisions being made, the type and degree of potential consumer harm, the extent of human involvement in the final decision, the transparency and explainability of outcomes to the affected consumer, and the extent of reliance on third-party data, predictive models and AI Systems. It must cover the full insurance life cycle (product development and design, marketing, underwriting, rating and pricing, case management, claim administration including payments, and fraud detection) and the full AI life cycle (design, development, validation, implementation, use, ongoing monitoring, updating and retirement), and must reach AI whether built in-house or bought from a vendor. It may sit inside or outside the enterprise risk management programme and may adopt a third-party framework such as the NIST AI Risk Management Framework 1.0. Build it even though the language is advisory: the bulletin's closing paragraph, which was NOT softened, states that an insurer can expect to be asked about its AI Systems irrespective of whether a written programme exists.

Vest responsibility for developing, implementing, monitoring and overseeing the AIS Program — and for setting the insurer's AI strategy — in senior management who are accountable to the board or an appropriate board committee. The governance framework should prioritise transparency, fairness and accountability while protecting proprietary and trade-secret information, and may reuse existing governance structures rather than creating new ones. The bulletin asks insurers to address: the policies, processes and procedures (including risk management and internal controls) at each stage of an AI System's life cycle from proposed development to retirement; the requirements adopted to DOCUMENT compliance with those policies; and the accountability structure itself — the formation of centralized, federated or otherwise constituted committees drawing on business units, product specialists, actuarial, data science and analytics, underwriting, claims, compliance and legal; scope of responsibility and authority, chains of command and decisional hierarchies; the independence of decision-makers and lines of defence at successive stages; monitoring, auditing, escalation and reporting protocols; and ongoing training and supervision of personnel. Note the softened voice — West Virginia writes "the OIC recommends that an insurer's AIS Program include a governance framework" and "Governance would ideally prioritize", where the NAIC model states both as expectations.

Document the risk management framework and internal controls for AI Systems generally and at each life-cycle stage. The bulletin asks the AIS Program to address: the oversight and approval process for developing, adopting or acquiring AI Systems, including constraints and controls on automation and design; data practices and accountability procedures covering data currency, lineage, quality, integrity, bias analysis and minimization, and suitability; management and oversight of predictive models, comprising INVENTORIES and descriptions of the models, detailed documentation of their development and use, and assessments of interpretability, repeatability, robustness, regular tuning, reproducibility, traceability, MODEL DRIFT and the auditability of those measurements; validating, testing and retesting to assess how AI System outputs generalize on implementation, including the suitability of the data used to develop, train, validate and audit a model — where validation may take the form of comparing model performance on UNSEEN DATA available at development time against performance observed post-implementation, measuring against expert review, or other appropriate methods; protection of non-public information, particularly consumer information, including unauthorized access to the predictive models themselves; data and record retention; and a narrative description of each model's intended goals and objectives and how it is developed and validated to ensure the AI Systems relying on it correctly and efficiently predict or implement those goals. The bulletin defines a predictive model inline, in guideline 2.4, as "the mining of historic data using algorithms and/or machine learning to identify patterns and predict outcomes that can be used to make or support the making of decisions", and asks for methods to detect and address errors, performance issues, outliers or UNFAIR DISCRIMINATION arising from model use.

Address in the AIS Program how the insurer acquires, uses or relies on third-party data used to develop AI Systems and on AI Systems developed by third parties. The bulletin asks for standards, policies, procedures and protocols covering: due diligence and the methods used to assess the third party and its data or AI Systems, so that decisions made or supported by them which could lead to adverse consumer outcomes will meet the legal standards imposed on the INSURER ITSELF — the vendor's compliance posture is not a defence; the inclusion in third-party contracts, where appropriate and available, of terms that provide audit rights or entitle the insurer to receive audit reports by qualified auditing entities, and that REQUIRE THE THIRD PARTY TO COOPERATE with the insurer regarding regulatory inquiries and investigations related to the insurer's use of the vendor's product or services; and the actual performance of those contractual audit rights and other activities to confirm the third party's compliance with contractual and, where applicable, regulatory requirements. Note that the audit-rights and cooperation terms are qualified by "where appropriate and available", so the bulletin does not mandate a specific clause — but the diligence standard that vendor-supported decisions must meet the insurer's own legal obligations is stated flatly.

Include in the AIS Program processes and procedures to provide notice to impacted consumers that AI Systems are in use, and to provide FREE access to appropriate levels of information based on the phase of the insurance life cycle in which the AI Systems are being used. The word "free" is West Virginia's own — it is the single substantive normative ADDITION the state made to the NAIC model bulletin, confirmed by diffing the two texts (the model says only "provide access to appropriate levels of information"; a search for the phrase "free access" returns nothing in the model and one hit in 24-06). Everything else West Virginia changed was a softening. The practical consequence: an insurer may not meet this expectation by charging the consumer a fee, a records-request cost or a subscription for the explanation of how AI was used in a decision affecting them. Scope the information to the life-cycle phase — marketing, underwriting, rating, claims — rather than publishing a single generic notice, since the guideline ties the level of information to the phase.

This is the part of Bulletin 24-06 that West Virginia did NOT soften, and it is the operative sentence for anyone deciding whether the advisory guidelines can be ignored. The bulletin states that in the context of an OIC investigation or market conduct action, an insurer can expect to be asked about its development, deployment and use of AI Systems IRRESPECTIVE OF THE EXISTENCE OR SCOPE of a written AIS Program — so AI deliberately left outside the programme, or left ungoverned because the programme was never written, is reached anyway. Investigations and market conduct actions may be performed using procedures varying in nature, extent and timing according to regulatory judgment, and may include inquiry, examination of company documentation, or any of the continuum of market actions described in the NAIC Market Regulation Handbook; they may involve contracted specialists with relevant subject-matter expertise. Nothing in the bulletin limits the OIC's authority to conduct any regulatory investigation, examination or enforcement action, and nothing in it relieves an insurer of the responsibility to comply with state law regardless of its use of an AI System. IMPORTANT LIMIT, recorded honestly: unlike the NAIC model and unlike Arkansas's verbatim adoption, West Virginia DROPPED the model's Section 4 itemised production list (model items 1.1-1.3 with their sub-items and 2.1-2.4). West Virginia has therefore told insurers they will be asked, without publishing the document schedule of what will be asked for. Preparing to the NAIC model's Section 4 list is the prudent response, but note that it is the model's list, not West Virginia's.

West Virginia's rating article requires that rates for the lines it covers not be excessive, inadequate or unfairly discriminatory, and that standard applies to rates, rating rules and rating plans however they were derived — including by AI techniques and predictive models trained on historic loss data. The scope limit is the point, and it is the fourth consecutive NAIC-adopting state in this vein to carry one. W. Va. Code §33-20-2 provides at (a) that the article "applies to fire, marine, casualty and surety insurance on risks or operations in this state", and at (b) that it does NOT apply "(1) To reinsurance, other than joint reinsurance to the extent stated in section eleven of this article; (2) To life or ACCIDENT AND SICKNESS insurance; (3) To insurance of vessels or craft, their cargoes, marine builders' risks, marine protection and indemnity or other risks commonly insured under marine, as distinguished from inland marine, insurance policies; (4) To insurance against loss of or damage to aircraft ...; (5) To malpractice insurance insofar as the provisions of this article directly conflict and thereby are supplanted by article twenty-b of this chapter." An AI model pricing accident and health risk in West Virginia is therefore outside this article entirely. Unlike Arkansas, however, that does not leave A&H with only the unfair-trade-practices conduct standard — West Virginia routes accident and sickness rates to art. 16B instead, which carries a filing gate and a different substantive test (see the separate requirement). Where a kind of insurance is subject both to provisions expressly applicable to casualty and surety and to those applicable to fire and marine, §33-20-2(c) lets the Commissioner apply whichever provisions are in his or her judgment most suitable.

This is where accident and health goes once §33-20-2(b)(2) removes it from the rating article, and it is the reason West Virginia's A&H position differs from Arkansas's. W. Va. Code §33-16B-1 requires that premium rate charges for ANY individual or group accident and sickness insurance policy, certificate or other evidence of insurance issued, endorsed or delivered in the state be FILED WITH THE COMMISSIONER for a waiting period of sixty days before taking effect; at the expiry of sixty days the filed charges are deemed approved unless the Commissioner has affirmatively approved or disapproved them beforehand, and the Commissioner may approve early by written notice. The Commissioner SHALL disapprove accident and health premium rates that do not comply with the requirements of the chapter or with any rule promulgated under §33-16B-2, and must send written notice of disapproval to the insurer. §33-16B-2 supplies the substantive test: premium rates charged for any individual or group accident and health policy "shall be reasonable in relation to the benefits available under the policy", with the Commissioner to promulgate rules establishing minimum ratemaking standards "in accordance with accepted actuarial principles and practices". For an AI-derived A&H rate this means two things that the NAIC model bulletin's rating language does not capture: there is a hard sixty-day pre-effective filing gate, and the standard the model would have you document against — not excessive, inadequate or unfairly discriminatory — is NOT the West Virginia A&H test. Actuarial justification should be framed to benefit-reasonableness and to accepted actuarial principles.

The operational discipline West Virginia imposes on a live scoring model, which maps closely onto what an AI governance programme would call change management and monitoring. Item 3: the insurer, rating organisation or model provider must maintain and use, WITHOUT EXCEPTION, random testing procedures for auditing the accuracy of insurance score assignment; where an inaccuracy is discovered, affected scores will be re-run and the insurer will reevaluate those risks on the corrected score, REFUNDING any difference in premium overpayments. Item 9: the insurer must consistently use the same source of credit reports and insurance scores for all insureds and may not change that source more than once per year. Item 10: the insurer must consistently use the same insurance score model and methodology and may not change the model or methodology more than once per year, and any change in the way insurance scores are used as part of a rating plan must receive PRIOR APPROVAL. Item 14: insurers using insurance scores for rating must make a filing including actuarial justification for the factors whenever rating factors change, because that effectively constitutes a pricing revision. Item 13(a): where credit information is used for tiering or rating, the insurer must recheck policyholders' scores within 36 months of the last calculation and, if the score has changed, re-underwrite and re-rate at the next renewal — with an exception for policyholders already receiving the best available rate on the score alone. Item 13(b): on the insured's request the insurer must re-underwrite and re-rate at renewal, no more than once in any twelve-month period, with requests made fewer than 45 days before renewal taking effect at the following renewal. Item 15: the insurer must not use credit information flagged as in dispute at the credit bureau, and where a bureau determines a report or score was incorrect and the insurer is notified, it must within 30 DAYS re-underwrite, re-rate and adjust the premium, refunding any overpayment calculated back to the shorter of the last twelve months of coverage or the actual period of coverage. Item 7 governs no-hit and thin-file cases: the insurer must either treat the consumer as otherwise approved by the Commissioner on evidence that the absence relates to risk, treat them as having neutral credit information, or exclude credit information and use only other underwriting criteria. Item 12 constrains the model itself — it must not count multiple insurance, mortgage-lending or auto-finance inquiries within a 30-day period, and must not treat as a negative factor collection accounts bearing a medical industry code or negative credit changes after March 1, 2020 for a 36-month period arising from COVID-19-related situations.

West Virginia has a gold-card programme, and the Commissioner has interpreted the burden of operating it as falling on the insurer. Under §33-15-4s(k), where a health care practitioner has performed an average of 30 procedures per year and, in a six-month period during that year, has received a 90 PERCENT final prior approval rating, the health insurer may not require that practitioner to submit a prior authorization for at least the next six months, or longer if the insurer allows. At the end of that period the exemption must be reviewed prior to renewal; if approved, the renewal is granted for a period equal to the previously granted period or longer. The exemption is subject to internal auditing at any time by the health insurer and may be rescinded where the insurer determines the practitioner no longer meets the criteria. Insurance Bulletin 24-03, "Prior Authorizations" (issued May 7, 2024), resolves the operational question the statute left open: the OIC states that the clear legislative intent is for the insurer — not the practitioner — to TRACK the prior authorization data and to enact the gold-card exemption AUTOMATICALLY when a practitioner qualifies, rather than requiring the practitioner to monitor their own data and apply for it. Where an exemption is revoked, the insurer must provide the practitioner with the results of the internal audit supporting the revocation. Nothing in the gold-card programme prevents an insurer from requiring prior authorization for an experimental treatment, a non-covered benefit, or any out-of-network service or procedure. For an automated utilization review system this is an affirmative build requirement, not merely a prohibition: the system must compute qualification continuously and suppress authorization requirements without being asked.

A recurring transparency obligation that makes an insurer's prior-authorization decision pattern — including any pattern produced by automation — directly visible to the regulator. §33-15-4s(m) provides that the Insurance Commissioner SHALL request data on a QUARTERLY basis, or more often as needed, to oversee compliance with the article, and specifies a minimum data set: prior authorizations requested by health care providers; the total number of prior authorizations DENIED broken down by health care provider; the total number appealed by health care providers; the total number APPROVED AFTER APPEAL by health care providers; the name of each gold-card status physician; and the name of each physician whose gold-card status was revoked together with the reason for revocation. The denial-and-overturn pairing is the operative disclosure for an AI-assisted utilization review programme: a high denial rate coupled with a high approve-after-appeal rate is precisely the signature of an automated first-instance denial process that the peer-review stage keeps reversing, and this statute puts that signature in front of the Commissioner every quarter without any complaint being filed. Build the reporting pipeline to produce these fields per provider rather than in aggregate, and retain the underlying decision records.

The NAIC model bulletin cites the Corporate Governance Annual Disclosure Act as one of the five statutes its expectations rely on, and states that CGAD requirements apply to the elements of an insurer's corporate governance framework that address its use of AI Systems. West Virginia deleted that citation along with the rest of the Legislative Authority section — but the statute exists here regardless, so the hook survives the deletion. W. Va. Code §33-52-3 requires an insurer, or the insurance group of which it is a member, to submit annually to the Commissioner a CGAD containing the information described in §33-52-4; where the insurer belongs to a group, the report goes to the lead state commissioner as determined under the most recent NAIC financial analysis handbook procedures. The CGAD must carry the signature of the insurer's or group's CHIEF EXECUTIVE OFFICER or CORPORATE SECRETARY attesting, to the best of that individual's belief and knowledge, that the corporate governance practices have been implemented AND that a copy of the CGAD has been provided to the board or the appropriate board committee. An insurer not otherwise required to file must do so on the Commissioner's request. Disclosures may be made at the ultimate controlling parent level, an intermediate holding company level or the individual legal entity level, and insurers are encouraged to report at the level at which risk appetite is determined. Practical effect: the board-accountable AI governance structure that Bulletin 24-06 asks for is not merely advisory once it is described in a CGAD — the CEO or corporate secretary attests to it.

West Virginia Insurance Bulletin No. 25-02, "Use of Aerial Imagery by Homeowners Insurers" (issued April 16, 2025), constrains how imagery may drive homeowners decisions. Recorded honestly: this bulletin is AI-ADJACENT BUT IT IS NOT AN AI INSTRUMENT — it contains no reference to artificial intelligence, algorithms, machine learning, automated analysis or predictive models anywhere, and its footnote defines "aerial imagery" purely by capture technology, as "photographs, videos, or other visual data captured using satellites, aircraft, drones, or other aerial platforms". It is modelled here because its duties bite on imagery-driven nonrenewal, cancellation, underwriting and claims handling however the image was interpreted — including where a computer-vision model did the interpreting. Three expectations. (1) Aerial imagery, if used, should be only ONE TOOL: it should not be the only information used in decision-making, and blurry or older images appearing to show staining or discoloration of shingles will usually not be sufficient standing alone to prove a roof must be replaced; where review of imagery raises concerns, the insurer should obtain recent, clear information through a physical inspection or otherwise. (2) Consumer access: where imagery is the basis for nonrenewal it is best practice to notify the homeowner BEFORE initiating the action, to advise that the action is based on aerial imagery, to PROVIDE COPIES of any images used, and to allow the homeowner to provide updated information or dispute the imagery's accuracy — and where a homeowner complains to the OIC, the homeowner is entitled to view the evidence the insurer relied upon. Insurers are encouraged to issue loss control recommendations and allow reasonable time for repairs before nonrenewing. (3) Age and clarity: THE BURDEN IS ON THE INSURER to prove the reason for nonrenewal, recent evidence is required where a change to insurability is asserted, and older imagery standing alone will often not be sufficient to meet that burden.