Gramm-Leach-Bliley Act (Insurance NPI) — Regulatory Reference

GLBA Title V requires insurance companies to protect the privacy and security of nonpublic personal information (NPI). When AI agents access NPI — claims data, policyholder records, underwriting files — the Safeguards Rule mandates access controls that limit who and what can retrieve sensitive data, and for what declared purpose. AI agents are treated as internal systems subject to the same controls as employees. Insurers must ensure each agent's data access is scoped to its function, logged, and traceable. The NAIC Model Regulation #672 extends these obligations to the state level for most insurers, meaning compliance requirements apply regardless of whether a federal or state regulator is primary.

GLBA applies to insurance companies that are financial institutions under federal law — those engaged in activities that are financial in nature as defined by the Bank Holding Company Act. In practice, most property-casualty, life, and health insurers fall within scope for NPI privacy obligations. State implementation through the NAIC Privacy Model Regulation (#672) means that even where federal jurisdiction is secondary, equivalent protections are typically required. When an insurer deploys AI agents that access policyholder data, claims records, or any personally identifiable financial or health information, GLBA and corresponding state rules govern how that access must be authorized, restricted, and audited.

GLBA's Safeguards Rule requires covered entities to oversee service providers — including AI vendors and third-party model providers — through contractual safeguards and ongoing monitoring. Insurers must select providers that maintain appropriate security measures, include protective provisions in contracts, and periodically assess compliance. For AI deployments, this means any vendor system that touches NPI must be registered with an explicit data scope, its access must be governed by written policy, and the insurer must retain audit evidence. Failure to document vendor AI data access creates direct regulatory exposure during examinations by state insurance commissioners, who increasingly review third-party AI arrangements as part of market conduct exams.

AutoPIL enforces access controls at the retrieval layer — before NPI enters an AI agent's context window. Insurance NPI is classified at HIGH sensitivity in AutoPIL's source registry, and AI agent access is gated against policy `INS-GLBA-NPI-001`, which conditions access on declared purpose. Every access decision is written to a tamper-evident audit log, giving examiners a complete, cryptographically verifiable record of what each agent accessed and under what policy. For vendor AI oversight, AutoPIL's agent registry captures each third-party provider, its data scope, and the governing policy (`INS-GLBA-VND-001`), satisfying the documentation requirement that GLBA imposes on insurer-vendor relationships involving NPI.

GLBA enforcement in insurance flows primarily through state insurance departments, which can issue cease-and-desist orders, impose fines, and in severe cases revoke licenses. The FTC also holds residual authority over non-bank financial institutions. Regulators increasingly focus on AI-related NPI exposure during market conduct examinations — an insurer unable to demonstrate that AI agent access to policyholder data was authorized and logged faces findings that can escalate to formal enforcement. Beyond regulatory penalties, a breach involving inadequately governed AI access triggers consumer notification obligations under state insurance privacy laws aligned with the NAIC model, adding reputational and legal costs. The combination of state exam risk and breach liability makes documented access controls a practical compliance necessity.