Nebraska — LB 525 Conversational AI Safety Act (signed Apr 14, 2026; compliance Jul 1, 2027) + NDOI Guidance Document IGD - - H1 on insurer AI (11 Jun 2024) + AI limits on utilization review (operative Jan 1, 2026): AI Compliance Requirements

Nebraska has a statutory AI rule for medical-necessity decisions, in force since 1 January 2026. An artificial intelligence-based algorithm may not be the sole basis of a utilization review agent's decision to deny, delay or modify health care services based, in whole or in part, on medical necessity. A utilization review agent must disclose through four separate channels — to the Department of Insurance, to each health care provider in its network, to each enrollee, and on its public website — whether artificial intelligence-based algorithms are used or will be used in the utilization review process, and the Department may at any time audit the agent's automated utilization management system, including by contracting a third party to perform the audit. The human-decision reservation sits alongside this: all adverse determinations for prior authorization must be made by a physician, or by a clinical peer of the requesting provider where that provider is not a physician, and that physician or clinical peer must hold a current, valid, non-restricted licence in a United States jurisdiction, have the appropriate training, knowledge or expertise to apply the clinical guidelines to the service requested, and act under the clinical direction of one of the agent's medical directors — all of whom must themselves be physicians licensed in a United States jurisdiction. The requesting provider may ask to discuss a medical-necessity, appropriateness or experimental/investigational denial with the deciding physician or clinical peer, and may request that the discussion occur within three business days of notice of the adverse determination. Incentives are constrained too: a utilization review agent may not be compensated based on its volume of denials, and may not base any incentive or penalty for a medical reviewer on the volume of denials that reviewer issues or upholds. Separately from these provisions, a utilization review agent must hold a Department certificate; a utilization review program must use documented clinical review criteria based on sound clinical evidence, evaluated periodically, and must make those criteria available to authorised government agencies on request; a covered person or attending physician may on request obtain timely access to the clinical basis of a non-certification, including the criteria, standards or clinical indicators used; a utilization review agent may not compensate staff based directly on the number of adverse determinations; and on final appeal of a clinical non-certification the agent must ensure a physician is reasonably available to review the case (or a non-physician provider within whose scope of practice the service falls, where the service was provided or authorised by a non-physician). Denials remain subject to external review: after exhausting the health carrier's internal grievance process under the Health Carrier Grievance Procedure Act, a covered person or authorised representative may request external review in writing from the director, with an expedited route for adverse determinations involving conditions where the standard timeframe would seriously jeopardise the covered person, decided by an independent review organisation approved by the director.

For minor users, conversational AI operators must not use unpredictable-reward or engagement-maximizing design mechanics, generate sexually explicit material or objectifying content, claim the AI is human or sentient, or simulate emotional dependence, romantic innuendo, or adult-minor romantic role-play — and must provide privacy-management tools accessible to both minors and their parents. Separately (for all users, not just minors), operators must detect prompts related to suicidal ideation or self-harm and make reasonable efforts to refer the user to crisis service providers. CYCLE 18 (2026-08-22): these duties were previously missing from this entry entirely — added after fresh web-verification (wtlgovernance.com direct duty breakdown). legal_review_pending.

Every insurer holding a Nebraska certificate of authority is expected to develop, implement and maintain a written AI Systems ("AIS") Program governing AI Systems that make or support decisions relating to regulated insurance practices, designed to mitigate the risk of Adverse Consumer Outcomes. Controls must be proportionate to the insurer's own assessment of risk, weighing the nature of the decision, the Degree of Potential Harm to Consumers, how far humans are involved in the final decision, transparency and explainability to the affected consumer, and reliance on third-party data and models. The Program must vest ownership with senior management accountable to the board or a board committee (1.3), cover the whole insurance life cycle from product design through claims and fraud detection (1.6), cover every phase of an AI System from design to retirement (1.7), reach vendor-built as well as in-house systems (1.8), and include processes for notifying affected consumers that AI Systems are in use (1.9). It may sit inside the insurer's existing ERM programme and may adopt a third-party framework such as the NIST AI Risk Management Framework 1.0 (1.5). Governance must address per-stage policies and controls (2.1), documentation of compliance built with the examination expectations in mind (2.2), an accountability structure with cross-disciplinary committees, chains of command, independent lines of defence and training (2.3), and, for Predictive Models specifically, methods for detecting errors, performance issues, outliers and unfair discrimination (2.4). Risk management must cover the approval gate for adopting or acquiring AI Systems (3.1), data currency, lineage, quality, integrity, bias analysis and minimisation and suitability (3.2), a Predictive Model inventory with development documentation and interpretability/repeatability/robustness/reproducibility/traceability/model-drift assessments (3.3), validation and re-testing against unseen or post-implementation data (3.4), protection of non-public information including unauthorised access to the models themselves (3.5), and data and record retention (3.6). Third-party AI and data require due diligence against the standards the insurer itself must meet (4.1), contract terms giving audit rights and obliging vendor cooperation with regulatory inquiries (4.2), and actual exercise of those audit rights (4.3).

Regardless of whether a written AIS Program exists, an insurer under investigation or market conduct action must expect to be asked about the development, deployment and use of its AI Systems and about any specific Predictive Model or application and its outcomes. Section 4 sets out at length what the Department may demand: the written AIS Program itself and evidence of its adoption; the Program's scope, including any AI Systems and technologies deliberately left outside it; how the Program is tailored and proportionate to the insurer's reliance on AI, the risk of Adverse Consumer Outcomes and the Degree of Potential Harm to Consumers; the policies, procedures, guidance and training materials behind adoption, implementation, monitoring and oversight, including the development/acquisition process, constraints and controls on automation, and data governance covering lineage, quality, integrity, bias analysis and minimisation, suitability and Data Currency; the measurements, standards and thresholds used in model development, validation and oversight; protection of non-public information including unauthorised access to the models; pre-acquisition and pre-use diligence, monitoring and auditing of third-party data and systems; evidence of the coordinating bodies actually operating; and the insurer's inventories and descriptions of the Predictive Models and AI Systems capable of producing Adverse Consumer Outcomes. For any model actually under examination the Department may demand documentation of compliance with the insurer's own AI Program policies, the provenance and lineage of the data used, the techniques, measurements and thresholds applied, and validation, testing and auditing records including Model Drift evaluation — with the note that the form of validation should reflect whether the system rests on Predictive Models or on Generative AI. Where third parties are involved, add due-diligence records, the vendor contracts themselves (representations, warranties, data security and privacy, data sourcing, intellectual property, confidentiality and disclosure, and cooperation with regulators), audit or confirmation processes, and third-party validation and Model Drift documentation. The Department states that alternative means of demonstrating compliance are acceptable and that the goal is not to prescribe specific documentation, and it reserves the right to use contracted subject-matter specialists and the full continuum of market actions in the NAIC Market Regulation Handbook.

IGD - - H1 states that the property and casualty rating law applies regardless of the methodology used to develop rates, rating rules and rating plans: an insurer is responsible for ensuring that rates developed using AI techniques and Predictive Models relying on data and Machine Learning are not excessive, inadequate or unfairly discriminatory, across all forms of casualty insurance (including fidelity, surety and guaranty bond) and all forms of property insurance (including fire, marine and inland marine). The statutory tests are specific and testable: premiums are excessive if likely to produce an unreasonably high profit for the insurance provided or if expenses are unreasonably high relative to services rendered; inadequate only if they would endanger solvency or would not be expected to generate a profit on a direct basis and would likely diminish competition; and unfairly discriminatory if, after allowing for practical limitations, price differentials fail to equitably reflect differences in expense requirements or expected losses. Risks may be grouped by classifications identifying objective risk differences, and rates modified for individual risks against objective standards demonstrably affecting losses or expenses — which is the constraint a model-derived classification has to satisfy. Two hard prohibitions bound any AI-derived classification: no risk classification or grouping may be based on the race, creed, national origin or religion of the insured, and no rating system may violate the Unfair Discrimination Against Subjects of Abuse in Insurance Act. Insurers subject to § 44-7508 must file every rating system and every modification with the director and may not issue a contract except in accordance with filings in effect, so a model change that alters the rating system is a filing event.

Federal laws apply: FTC Act § 5, Title VII / ADA, FCRA, COPPA. Document your AI use policies regardless of state law status.

LB 525 was signed April 14, 2026; compliance is required by July 1, 2027. Before that date, ensure your conversational AI clearly discloses it is not human (especially to minors, via a permanent visible notice or repeated per-session alerts) and never claims to be a licensed mental or behavioral healthcare provider. Enforcement is exclusive to the Nebraska AG (no private right of action), with civil penalties of at least $1,000 per violation up to $500,000 per operator per enforcement action.

IGD - - H1 states that the Corporate Governance Annual Disclosure requirements apply to those elements of the insurer's corporate governance framework that address its use of AI Systems to support actions and decisions affecting consumers. The disclosure must be submitted no later than 1 June of each calendar year and must carry the signature of the chief executive officer or corporate secretary attesting, to the best of that person's belief and knowledge, that the insurer or insurance group has implemented the corporate governance practices described and that a copy has gone to the board or the appropriate board committee. Members of an insurance group file with the lead-state director under the NAIC Financial Analysis Handbook procedures. Content is at the insurer's discretion but must carry the material information needed for the director to understand the governance structure, policies and practices, and supporting documentation must be maintained and produced on examination or request. Reporting may be at ultimate controlling parent, intermediate holding company or legal entity level, but the insurer must state which of the three criteria it used and explain later changes in level. Information already supplied in substantially similar form elsewhere — proxy statements under Neb. Rev. Stat. § 44-2132 or other state or federal filings — need not be duplicated, only cross-referenced. Filed material is recognised as proprietary and trade secret, is confidential and privileged, is outside the public-records provisions at §§ 84-712 to 84-712.09, and is not subject to subpoena, discovery or admission in private civil actions, though the director may use it in regulatory or legal action and may share it with other regulators, the NAIC and approved third-party consultants under written confidentiality undertakings.