AI voice agents on insurance claims calls: what the agent must get right

This is for claims leaders, compliance officers and the engineers putting AI voice agents on policyholder lines. The claims duties come from state unfair claims laws, most modeled on National Association of Insurance Commissioners (NAIC) models; verification and recording rest on privacy and wiretap law; and the NAIC's AI bulletin adds expectations for the AI itself. States edit the models as they adopt them, and some go further, so check your own.

Which laws govern what an AI agent says on a claims call?

Your state's unfair claims settlement law, which in most states follows NAIC model law #900, the Unfair Claims Settlement Practices Act of 1990. Its section 4 lists fourteen unfair claims practices, from misrepresenting policy provisions to failing to explain a denial.

States adopt it one at a time. The NAIC's state page for the model (Fall 2022) lists 45 states with laws it treats as adoptions, such as California Insurance Code 790.03(h) and Florida Statutes 626.9541, a reading states may not share. Most day counts live in model regulation #902, for property and casualty claims, which has spread less: the NAIC's page for #902 (Fall 2023) lists 23 adopting states and 11 more with related rules of their own, including California's 10 CCR 2695 and Texas. Life, accident and health claims have their own model regulation, #903.

Two features of #900 matter for an AI agent. It creates no private right of action; the insurance department enforces it. And an act counts as an unfair claims practice only if it's committed flagrantly and in conscious disregard of the law, or "with such frequency to indicate a general business practice" (section 3). States differ on both. Florida lets a damaged person sue an insurer over 626.9541(1)(i) and waives the business-practice proof (Fla. Stat. 624.155(1)), and Nevada makes an insurer liable to its insured for the unfair claims practices it lists (NRS 686A.310(2)).

The frequency test reads differently for software. Under the model, an adjuster who misstates a deductible once has made a mistake. California counts a single knowing violation, and "knowingly" includes what the insurer should have known (10 CCR 2695.1(a), 2695.2(l)); Florida treats one material misrepresentation, made to settle a claim on less favorable terms than the policy provides, as a violation by itself (Fla. Stat. 626.9541(1)(i)2). And an AI agent repeats a misstatement on every call that reaches the same prompt path, so one bad instruction can meet the frequency test on its own.

How should the agent verify the caller before discussing a claim?

Against the policy or claim record, by a tool call, before any claim detail, because claim files hold nonpublic personal information. For insurers, the Gramm-Leach-Bliley Act's privacy rules are enforced by state insurance regulators under state insurance law (15 U.S.C. 6805(a)(6)). In states that adopted the NAIC Insurance Data Security Model Law (#668), an insurer must also exercise due diligence in selecting any third-party service provider that can access that information, a voice vendor included, and require it to protect the data (section 4F). Health coverage adds HIPAA's verification rule, covered in HIPAA and AI voice agents in patient access.

Model regulation #902 defines a claimant to include a designated legal representative and a designated immediate family member (section 3C), so your standard operating procedure (SOP) needs a rule per caller type:

• The named insured: verified against the policy record by a tool call before any claim detail.
• A designated family member or representative: the designation checked in the claim record, not taken on the caller's word.
• A third-party claimant: what they may learn about the insured's coverage varies by state, so a person answers that.
• An attorney: routed to a person.

What counts as misrepresenting a policy or promising an outcome?

Section 4A of #900 prohibits knowingly misrepresenting to claimants and insureds relevant facts or policy provisions relating to coverages at issue. Model regulation #902 adds two duties on the call side: an insurer must fully disclose to first-party claimants all pertinent benefits, coverages or other policy provisions under which a claim is presented (section 5A), and may not tell a third-party claimant their rights may be impaired if a form or release isn't completed within a set time, unless it's giving notice of a statute of limitations (section 7E).

A language model's failure here is filling a gap with a plausible answer. Three rules catch most of it:

1. Coverage, limits and deductibles are stated only from what the policy lookup returned on this call, quoted where the wording matters.
2. The agent never predicts an outcome, an amount or a payment date. "An adjuster will review it" describes a process; "you're covered" and "you'll be fine" are promises.
3. When a question goes past what the tools returned, the agent says so and hands off.

Leave denials to a person with the file. #900 requires a prompt, reasonable and accurate explanation of a denial or compromise offer (section 4L), and #902 a written denial citing the provision relied on (section 7A).

When does a phone call start the acknowledgment clock?

When it reasonably tells the insurer the facts of a claim and the policy accepts notice that way. First notice of loss (FNOL) is the policyholder's first report of a loss, often the first job an AI agent gets on a claims line. Under #902 (model text), a notification of claim is any notice, written or by other means acceptable under the policy, that reasonably apprises the insurer of the facts pertinent to a claim, and notice to an insurer's agent is notice to the insurer (sections 3I and 6A). The insurer then has 15 days to acknowledge it, and an acknowledgment not made in writing must be noted, with its date, in the claim file. It must also promptly provide claim forms, instructions and reasonable assistance (section 6D).

States set their own clocks. Florida's property insurance statute requires review and acknowledgment within 7 calendar days, with a dated claim-file note when it isn't in writing, and treats a communication to an insurer's representative as one to the insurer (Fla. Stat. 627.70131).

So where the policy accepts notice by phone, a loss described to the agent is notice whether or not its claim tool worked. Where the policy makes written notice a condition, #902 lets the insurer deny for late written notice (section 5D), so the agent should say what must be sent in writing and by when. Check that the claim-creation call returned success, that a dated acknowledgment note was written, and that forms went out. An agent that says "I've opened your claim" after a failed tool call has started a clock nobody in claims can see.

What must the agent say when a caller disputes a decision?

How the decision can be reviewed, and nothing that talks the caller out of it; the binding notices go in writing. For property and casualty claims, #902 creates no appeal right. What it requires, once an insurer rejects a claim and the claimant objects, is written notice that the state insurance department can review the matter, with the department's address and phone number (section 7H). Before continuing to negotiate with an unrepresented claimant whose rights a statute of limitations may affect, the insurer must give written notice of that limit: at least 30 days before it expires for first-party claimants and 60 days for third-party claimants (section 7D).

Employer health and disability plans follow federal rules, and one clock starts on the phone. When a member's call to a group health plan names the patient, the condition and the treatment but doesn't follow the plan's pre-service claim procedure, the plan must explain the right procedure within 5 days, or 24 hours for urgent care, and may do it orally (29 CFR 2560.503-1(c)(1)). A written denial must describe the plan's review procedures, time limits and the right to sue ((g)(1)(iv)), group health plans must allow at least 180 days to appeal ((h)(3)(i)), and most non-grandfathered health coverage adds external review, which denial notices must describe (45 CFR 147.136).

Write the SOP rule for the moment a caller disputes a decision: acknowledge it, explain how it can be reviewed (by the insurance department, or through the plan's appeal and external review), trigger the written notice through a tool, and never call a decision final while a review is open. The written notices are the requirement; saying it aloud is good practice. On a health plan line, explaining the pre-service procedure before the call ends is an SOP choice that meets the 5-day rule on the spot.

Do claims calls need all-party consent to record?

Federal law allows recording with one party's consent (18 U.S.C. 2511(2)(d)); some states require everyone's. California makes it a crime to record a confidential communication without the consent of all parties (Penal Code 632), with a separate section for calls involving cell or cordless phones (632.7). Florida allows interception when all parties have given prior consent (Fla. Stat. 934.03(2)(d)). Washington requires the consent of all participants and accepts a recording announcement as consent, provided the announcement is itself recorded (RCW 9.73.030).

You rarely know where a caller is, so the workable rule is a recording disclosure at the start of every call, on the recording. The AI vendor raises a second question. In February 2025 a federal judge let a California Invasion of Privacy Act claim proceed against Google over its Contact Center AI, which transcribed and analyzed calls to other companies' service lines, reasoning that a vendor capable of using call data for its own purposes can be an unauthorized third party (Ambriz v. Google). The order only let the claim proceed, but it's reason to read your voice vendor's data-use terms.

What does the NAIC AI bulletin expect, and where has it been adopted?

It expects insurers to govern the AI they use, vendors' systems included, under the laws that already apply, and 25 states and the District of Columbia had adopted it as of August 31, 2026. The NAIC adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers on December 4, 2023. It's framed as a reminder: decisions and actions that AI makes or supports must comply with existing law, including the unfair trade practices and unfair claims settlement practices acts, "regardless of the methods the Insurer used." What it expects:

• A written AI systems program covering the whole insurance life cycle, including claim administration.
• Oversight of vendor-built AI too, with due diligence and, where appropriate, audit rights and regulator cooperation in the contract.
• Notice to consumers that AI systems are in use.
• Records an examiner may request, including validation, testing, auditing and model drift.

As of August 31, 2026, the NAIC's adoption map lists the District of Columbia and 25 states as adopters: Alaska, Arkansas, Connecticut, Delaware, Hawaii, Illinois, Iowa, Kentucky, Maryland, Massachusetts, Michigan, Mississippi, Nebraska, Nevada, New Hampshire, New Jersey, North Carolina, Oklahoma, Pennsylvania, Rhode Island, Vermont, Virginia, Washington, West Virginia and Wisconsin. California, Colorado, New York and Texas have their own insurance-specific AI regulation or guidance instead.

A voice agent that takes FNOL or answers coverage questions supports claim handling and is usually a vendor's system, so it's prudent to assume the bulletin reaches it. What an examiner would ask for looks like call QA: what the agent was supposed to do, how often it did, and whether a release changed that. Loops keeps that kind of record, grading every call against the customer's approved rules and comparing each rule's miss rate between agent releases.

What does a graded claims call look like?

Like this, with each verdict tied to a timestamp or a tool result.

Agent: Thanks for calling Cedar Mutual claims. I'm an automated assistant, and this call is recorded. What's your policy number?

1.1 met · recording disclosed at 00:05, before any claim detail

1.2 met · automated assistant disclosed at 00:04, per the SOP's AI-notice rule

Caller: AM-448120. A pipe burst in our kitchen last night.

Agent: I'm sorry to hear that. To confirm it's you, what's the ZIP code on the policy and your date of birth?

Caller: 33614, and April 9, 1971.

1.3 met · verify_policyholder returned a match at 00:31

Agent: Thank you, Ms. Alvarez. I've opened claim 26-117045 for water damage at your home.

3.1 met · create_claim returned success at 00:52; dated acknowledgment note written

Caller: Is this covered? I need to know before I call a plumber.

Agent: Sudden pipe bursts are covered under your policy, so you'll be fine. Go ahead and book the plumber.

2.1 missed · coverage stated at 01:10; policy_lookup was never called

2.2 missed · "you'll be fine" predicts the claim outcome

Agent: An adjuster will reach out within two business days.

2.3 needs review · transcript can't show whether "two business days" matches the claim system's assignment rule

Agent: I'm also texting you a link with your claim forms and instructions.

3.3 met · send_claim_packet returned success at 01:31

The agent got the procedure right, then answered the question a policyholder remembers. Coverage can turn on exclusions and facts no adjuster has seen yet, and the agent never read the policy. If the claim is denied, that recording is evidence of a coverage misstatement. If the same prompt says it on every burst-pipe call, that's the frequency section 3 describes, and in California one knowing misstatement is already enough.

This is general information, not legal advice; confirm with counsel how your states' versions of these models apply.

Write your claims SOP as numbered rules like these, each tied to its model section or state statute and to the tool call or quoted line that proves it. Then grade a month of real calls and look for rules missed at a rate, not once; our guide to auditing AI voice agent calls against your SOP covers the method. Loops grades every call this way and marks calls a transcript can't settle for review rather than guessing (how it works). A free 30-day audit delivers its first report within 72 hours of rule approval.