Ethics boards, AI committees, and the NAIC-aligned oversight stack at L5 are the operational governance machinery that turns the seven-domain enterprise policy from Lesson 7 into a running program. The committee structure has to satisfy the board's risk/audit/technology committee on enterprise oversight, the AM Best analyst on governance posture, the NAIC AI Systems Evaluation Tool program-level review on documented committee minutes and decision logs, the state DOI examiner on operational discipline, the ORSA process on AI risk integration into the enterprise risk picture, and the carrier's own internal audit function on accountability traceability. The cadence, charter, escalation paths, and membership composition of the AI committee, the ethics board (where the carrier maintains one), and any subsidiary or function-specific committees are the documented evidence that the program is governed rather than aspirational. This lesson is the oversight-stack design: the AI committee charter, the ethics board structure where applicable, the cadence and escalation discipline, the NAIC AI Systems Evaluation Tool program-level mapping (Exhibits A/B/C/D), the ORSA integration that connects AI risk to the broader enterprise risk picture, the treaty-broker cession-language linkage, the AM Best analyst's read of the oversight stack, the DOI commissioner's expectation, and the documentation discipline that makes the oversight stack defensible at every external review surface.

The AI Committee Charter and Membership

The AI committee is the operational governance body for the AI program. Charter (annex to the seven-domain policy from Lesson 7) specifies: scope, membership, decision rights, cadence, escalation path, reporting destinations, and the interface to adjacent bodies (data council, ethics board where applicable, ORSA committee, board's risk/audit/technology committee).

Membership at a $1.2B specialty carrier: Chief AI Officer or Head of Responsible AI as chair; Chief Actuary, Chief Underwriter, Chief Claims Officer, Chief Distribution Officer, Chief Data Officer, Chief Compliance Officer, CRO, General Counsel, Chief Information Security Officer, and rotating line-of-business representatives. Optional members: head of internal audit (typically attends quarterly, not all sessions), Chief Privacy Officer if separately staffed, head of investor relations on rating-related agenda items.

Cadence: quarterly full committee meetings with documented agenda, minutes, and decision log; monthly working sessions of a smaller subset on operational matters; ad-hoc escalation sessions within 14 days when a kill consideration is flagged (per Lesson 5) or a material incident occurs (per Lesson 7 Domain 6).

The Decision-Rights Grid the Charter Encodes

The charter specifies which decisions the AI committee makes versus which it recommends or merely reviews. Committee-decides: AI use case approval up to a stated materiality threshold, vendor approval up to the concentration cap, model retirement, incident severity classification, policy amendments that do not change board-approved guardrails. Committee-recommends: AI use cases above materiality threshold (board's risk/audit/technology committee decides), vendor concentration cap exceptions (board decides), policy amendments that change board-approved guardrails (board decides), capital allocation above stated thresholds (CFO and board decide). Committee-reviews: subsidiary AI deployments where the subsidiary has delegated authority, line-of-business operational metrics, training-program progression. The grid is the document the general counsel signs to ensure the committee operates within authority granted by the board; ambiguity in the grid produces operational drift and external-reviewer skepticism about who actually controls the program.

The Ethics Board Where the Carrier Maintains One

Some rated carriers and holding companies maintain a standalone ethics board with external advisors - academics, former regulators, customer-advocacy representatives, technology ethicists - to advise on novel-use-case ethics, customer-impact considerations, and broader social-license-to-operate questions. The ethics board is not a substitute for the AI committee; it advises and provides external perspective. Its outputs feed AI committee decisions on novel use cases that touch sensitive ethical surfaces (e.g., L&H underwriting using novel data sources, fraud-detection use cases involving sensitive populations, claims-handling AI involving vulnerable customer segments).

Ethics board membership: typically 5-9 external advisors plus 2-3 internal executives (general counsel, chief AI officer, head of responsible AI). Cadence: quarterly or semi-annual, with topic-driven ad-hoc sessions. Reporting: ethics board recommendations are inputs to AI committee decisions; ethics board does not vote on AI committee matters. Carriers maintaining an ethics board treat it as external-perspective insurance that surfaces concerns the internal committee might miss; the ethics board's existence is part of Layer 7 (external positioning) at trade-press and AM Best moments.

The NAIC AI Systems Evaluation Tool Program-Level Review

The NAIC AI Systems Evaluation Tool - piloted early 2026 across CA, CO, CT, FL, IA, LA, MD, PA, RI, VT, VA, WI with re-exposure September-October 2026 and adoption expected at NAIC Fall National Meeting November 2026 - covers program-level governance review in addition to model-level review. The program-level scope: the carrier's AI governance posture, the AI committee structure and minutes, the algorithm inventory currency, the third-party AI vendor schedule, the fairness pipeline operation, the incident-response runbook, the regulatory-calendar posture. The four exhibits structure the response: Exhibit A - program governance; Exhibit B - talent and governance discipline; Exhibit C - model-level evaluation per material model; Exhibit D - incident and remediation history.

The AI committee's documentation is the AISET program-level response artifact. Committee minutes show: who attended, what was discussed, what decisions were made, what dissent was recorded, what was escalated. Decision logs show: AI use case approvals, exception approvals, kill decisions, vendor concentration discussions, governance posture refreshes. Without documented minutes and decision logs, the carrier cannot respond to the AISET program-level scope at sufficient depth - and AISET response is part of the multi-state regulatory expansion the carrier will face quarterly across the next several years as 25+ jurisdictions adopt NAIC Model Bulletin §4.1-§4.4 by mid-2026.

The DOI Commissioner's View

State DOI commissioners reading the AISET response packet care about three structural questions. First, does the carrier's AI committee operate independently of vendor interests - meaning does the committee make decisions on use cases the vendor would prefer to see continue, including kill decisions when vendor performance disappoints? Second, does the committee's documentation show genuine deliberation - recorded dissent, escalated questions, policy amendments based on observed operational reality - rather than rubber-stamp approval of management proposals? Third, does the committee's regulatory calendar integration mean the carrier responds to AISET, Colorado Reg 10-1-1, NY DFS Circular Letter 2024-7, Connecticut MC-25-8, and Nevada Bulletin 24-006 requests inside required windows with substantive responses? Commissioners and chief market-conduct examiners read the carrier's responses across multiple cycles and form a judgment about whether the program is real or paper. The carrier maintaining the cadence over multiple years produces commissioner-confidence; the carrier scrambling at each request produces commissioner-skepticism that compounds.

ORSA Integration and AI Risk on the Enterprise Risk Picture

The carrier's Own Risk and Solvency Assessment (ORSA) is the comprehensive enterprise risk evaluation regulated entities maintain. ORSA covers underwriting risk, reserve risk, credit risk, market risk, operational risk, strategic risk, reputational risk. As AI capability scales, AI risk integrates into the operational risk and (depending on materiality) strategic risk categories.

The AI committee's role in ORSA: provides the AI-related risk inputs (algorithm inventory currency, vendor concentration, incident history, governance posture, fairness pipeline outputs, regulatory exposure mapping) to the ORSA committee or chief risk officer for integration. The ORSA filing references the AI committee's structure, cadence, and minutes as governance evidence. The CRO's role at the AI committee is the bridging point - the same executive holds AI committee membership and ORSA committee membership, ensuring AI risk flows into the ORSA picture without committee bifurcation.

Specific ORSA integration patterns: vendor concentration risk (28% cap from Lesson 1) flows to operational risk; material AI incidents flow to operational risk with potential strategic risk implications; AM Best readiness composite trajectory flows to strategic risk; regulatory exposure (AISET, Colorado Reg 10-1-1, NY DFS Circular Letter 2024-7, state DOI bulletins) flows to operational risk; treaty-renewal AI clause posture flows to reinsurance counterparty risk and strategic risk.

The Escalation Discipline From AI Committee to Board

The escalation cadence from AI committee to the board's risk/audit/technology committee: quarterly standing report on program status, regulatory developments, AI committee summary, material incidents, vendor concentration, talent depth, AM Best readiness composite trajectory. Ad-hoc escalation when a material event requires board-level visibility (Lesson 7 Domain 6 severity tier 3 or 4 incident, treaty renewal AI clause material movement, AM Best rating action or analyst inquiry, regulatory enforcement action, M&A decision requiring board approval).

The discipline that protects the cadence: every quarterly board package has a defined structure (program status, regulatory developments, committee summary, incidents, vendor scorecard, talent, readiness composite); deviation from structure signals that the program is losing operating cadence. The chief AI officer or AI committee chair prepares the package; the CRO and chief compliance officer review for accuracy; the chief executive officer or chief risk officer presents to the board committee.

The Cross-Committee Interface the L5 Leader Engineers

The L5 leader engineers the interfaces between the AI committee and adjacent bodies so they do not produce duplicated work or conflicting decisions. Five interfaces:

AI committee ↔ Data council: data council reports to AI committee on AI-related data matters; AI committee certifies AI-related decisions that consume data council certifications. Quarterly cross-attendance: data council chair attends AI committee quarterly meeting; AI committee chair attends data council quarterly meeting.

AI committee ↔ Ethics board: ethics board recommendations are inputs to AI committee decisions on novel use cases; AI committee chair attends ethics board sessions when ethics board reviews AI-specific cases.

AI committee ↔ ORSA committee: CRO carries AI risk inputs from AI committee to ORSA committee; ORSA filing references AI committee structure and minutes.

AI committee ↔ Board's risk/audit/technology committee: quarterly standing reporting plus ad-hoc escalation; chair of AI committee briefs board chair semi-annually one-on-one.

AI committee ↔ Internal audit: audit attends AI committee quarterly; audit conducts annual governance audit on AI committee minutes, algorithm inventory, model card refresh discipline, vendor scorecard, incident-response runbook.

Adjacent Committees That Also Touch the AI Stack

Beyond the five interfaces above, the L5 leader engineers light-touch coordination with additional committees that hold AI-adjacent authority. The credit-and-counterparty committee touches AI vendor concentration and reinsurance counterparty AI exposure. The product committee touches AI use cases in new-product development. The HR committee touches employee conduct on AI tools under Domain 7 and credentialing investment under the AI training program. The disclosure committee touches NAIC Form B language and investor-relations communications referencing AI capability. Each adjacent committee receives a defined slice of AI committee output; redundant authority is engineered out through the decision-rights grid; conflicting authority is escalated to the board's risk/audit/technology committee for resolution.

The Cadence Discipline - Quarterly, Monthly, and Ad-Hoc

The cadence is the discipline that turns the charter from paper into operating governance. Quarterly full committee meetings carry the structural agenda: prior-quarter follow-up review, regulatory developments since last meeting, AI use case portfolio status, vendor scorecard and concentration review, incident summary, talent and credentialing progression, AM Best readiness composite update, AISET response status across the response calendar (12-state pilot through early 2026, September-October 2026 re-exposure, NAIC Fall National Meeting November 2026 adoption), Colorado Reg 10-1-1 (Oct 15, 2025 expansion; July 1, 2026 first compliance report) trajectory, treaty-broker preparation status when in renewal cycle. Monthly working sessions handle operational items: vendor incident reviews, model card refresh approvals, training-program progression check-ins, fairness pipeline outputs review, runbook tabletop after-actions. Ad-hoc 14-day escalation handles kill considerations, material incidents, and regulatory-action surprises.

The cadence's structural integrity is the test external reviewers apply. Skipped meetings, delayed minutes, missing decision logs, and stalled action items each signal that the cadence is collapsing under operating pressure. The L5 leader protects the cadence at the budget conversation each year, the staffing conversation when the chief AI officer or head of responsible AI moves, and the priority conversation when material AI initiatives compete for executive attention with operational fires. The cadence is the visible discipline that earns analyst and commissioner confidence over multiple cycles.

Documentation Discipline - Minutes, Decision Logs, Action Tracking

The documentation discipline that makes the oversight stack defensible: minutes capture attendance, agenda, discussion summary, dissent, decisions, follow-up actions. Decision logs index AI use case approvals, exception approvals, kill decisions, vendor decisions, governance posture refreshes - each entry includes date, decision, vote outcome if applicable, dissent, follow-up. Action tracking maintains the open-action list with owner, target date, and status; quarterly review by the chair surfaces stalled actions.

Documentation retention: minutes and decision logs retained for the carrier's full regulatory retention period (typically 7-10 years; longer for some specialty lines). Annual archival to the governance repository. Quarterly attestation by the chair that minutes and decision logs are current and accurate. The retention discipline matters because external reviews (AISET response, AM Best analyst review, state DOI exam, market-conduct exam, internal audit, ORSA filing) may reference minutes from prior years; without retained documentation, the carrier cannot respond at sufficient depth.

The AM Best and Treaty Broker Narrative on Oversight

The AM Best analyst at the annual rating meeting references the oversight stack as evidence on the talent and governance categories of the readiness composite. Sample narrative: "AI committee chaired by Chief AI Officer with documented quarterly meetings and decision log; ethics board with external advisors providing semi-annual review on novel use cases; AI risk integrated into ORSA via CRO bridging point; algorithm inventory and model card refresh discipline current; vendor concentration below 28% threshold; incident-response tested quarterly; AM Best readiness composite trajectory documented quarterly with chief actuary attribution methodology." The narrative reads as managed governance - exactly what AM Best calibrates to. The 41% / ~60% headline numbers from the April 2026 Best's Special Report calibrate the carrier's posture - the readiness assessment folded into the Performance Assessment framework as a survey-plus-readiness composite, not a standalone AI rating methodology.

The treaty broker references the oversight stack in cession-language preparation. The 2026 renewal cycle introduced explicit AI clauses (use-case disclosure, governance attestation, incident notification, audit rights) in cession language across multiple major programs. AI clauses in reinsurance renewals describe the carrier's governance posture; mature governance means clauses ratify existing practice rather than impose new burden. The treaty broker's preparation pack includes AI committee charter, ethics board structure where applicable, and incident-response runbook excerpts as evidence supporting cession-language negotiation with reinsurers at Munich Re, Swiss Re, SCOR, Hannover Re, Berkshire Hathaway Reinsurance, and Lloyd's syndicates.

Key Takeaways

• The AI committee is the operational governance body for the AI program. Charter as annex to seven-domain policy; chaired by CAIO or Head of Responsible AI; cross-functional membership including Chief Actuary, CUO, CCO (Claims), CDO (Distribution), CDO (Data), CCO (Compliance), CRO, GC, CISO, rotating LoB. Quarterly full + monthly working sessions + ad-hoc 14-day escalation. Decision-rights grid encoded in charter to prevent operational drift.
• Ethics boards (where carrier maintains one) include external advisors - academics, former regulators, customer-advocacy, technology ethicists. Advises on novel-use-case ethics, customer-impact considerations, social-license-to-operate. Recommendations feed AI committee decisions; ethics board does not vote on committee matters.
• The NAIC AI Systems Evaluation Tool covers program-level review in addition to model-level. Four exhibits: Exhibit A (program governance), Exhibit B (talent and governance), Exhibit C (model-level), Exhibit D (incident history). Piloted early 2026 across 12 states (CA, CO, CT, FL, IA, LA, MD, PA, RI, VT, VA, WI); re-exposure September-October 2026; adoption expected NAIC Fall National Meeting November 2026; 25+ jurisdictions adopting Model Bulletin §4.1-§4.4 by mid-2026.
• DOI commissioners read AISET responses across cycles, forming judgment on whether the AI committee operates independently of vendor interests, shows genuine deliberation (recorded dissent, escalated questions), and responds substantively inside required windows. Multi-cycle cadence produces commissioner-confidence; scrambling at each request produces compounding skepticism.
• ORSA integration: AI risk flows into operational risk (vendor concentration, incidents, regulatory exposure) and strategic risk (AM Best composite trajectory, treaty implications) categories. CRO bridges AI committee and ORSA committee membership; ORSA filing references AI committee structure and minutes.
• Escalation discipline from AI committee to board's risk/audit/technology committee: quarterly standing report (program status, regulatory developments, committee summary, incidents, vendor scorecard, talent, readiness composite) plus ad-hoc escalation for material events.
• Five primary cross-committee interfaces: AI committee ↔ data council, ethics board, ORSA committee, board RAT committee, internal audit. Plus light-touch coordination with credit-and-counterparty committee (vendor concentration and reinsurance AI exposure), product committee, HR committee, disclosure committee (NAIC Form B). Each has defined reporting cadence, cross-attendance discipline, and decision-rights boundary.
• Documentation discipline: minutes (attendance, agenda, discussion, dissent, decisions, follow-up); decision logs (AI use cases, exceptions, kills, vendors, governance refreshes); action tracking with quarterly stall review. Retention for the carrier's full regulatory period (7-10 years typically).
• AM Best analyst and treaty broker reference the oversight stack as evidence on talent and governance categories. Mature governance produces narrative of managed program; AI clauses in 2026 treaty renewals (use-case disclosure, governance attestation, incident notification, audit rights) ratify existing practice rather than impose burden. April 2026 Best's Special Report's 41% / ~60% anchors calibrate carrier's posture.