Oregon Names TK Keen as New Acting Insurance Commissioner

Oregon Insurance Commissioner and Department of Consumer and Business Services (DCBS) Director Andrew Stolfi is moving to a new senior role as Director of the Oregon Employment Department. On May 15, 2025, Gov. Kotek appointed DCBS Deputy Director Sean O’Day as the Acting Director and veteran regulator TK Keen as the Acting Insurance Commissioner. The governor’s office is conducting an “open recruitment” for a new DCBS director, who would then appoint the insurance commissioner.

NAIC Updates

At its May 12, 2025 meeting, the Capital Adequacy Task Force addressed the proposed changes to the RBC preamble to limit the use of RBC to its intended purpose, which is to help regulators identify weakly capitalized companies. Interested parties, including the ACLI and consumer groups, continue to note the importance of RBC for other purposes (e.g., reinsurance agreements, rating agencies, and consumer research and analysis).

While not specifically part of the proposed revisions to the preamble, regulators have also raised the possibility of removing total adjusted capital (TAC) and authorized control level (ACL) (which can be used to determine a company’s RBC ratio) from the annual statement. Mike Yanacheak (Chair-IA) noted that the task force will hold a call in October specifically to address these issues. He encouraged task force members and interested parties to continue discussions in the meantime. Matt Cheung (IL) suggested that regulators consider developing standard language to go along with RBC any time it is used outside of its intended purpose to provide some additional context about what it is and its limitations as a tool to compare the financial strength of companies.

The task force also took the following actions:

• Adopted Proposal 2024-21-L MOD (Tax Credit Investments), which updates the Life RBC instructions and blanks to incorporate changes adopted by the Statutory Accounting Principles Working Group (SAPWG) related to tax credits. The proposal addresses structural and instructional changes and does not propose a potential factor change.
  
• Adopted Proposal 2024-24-L MOD (Principles-Based Bond Project), which incorporates changes to the Life RBC instructions resulting from the principles-based bond project.
  
• Adopted Proposal 2025-01-L C-2 (Mortality Risk), which updates the Life RBC instructions and blanks to allow for direct pulls of information between the annual statement and the new general interrogatory related to mortality risk.
  
• Adopted Proposal 2025-05-L (Asset Concentration L010), which allows Securities Valuation Office (SVO)–designated non-bond debt securities to obtain an asset concentration factor treatment akin to bonds in LR002 of the Life RBC formula.
  
• Adopted Proposal 2024-25-CA, which updates the health and property & casualty formulas to incorporate the principles-based bond definition and changes related to non-admitted collateral loans.
  
• Adopted Proposal 2024-26-CA, which updates the health and property & casualty instructions and blanks to incorporate changes adopted through the New Market Tax Credits project.
  
• Adopted Proposal 2025-07-CA, which makes certain editorial consistency changes related to company action levels across lines of business.
  
• Exposed Proposal 2025-03-CA, which provides the annual update of the underwriting factors for Comprehensive Medical, Medicare Supplement, and Dental & Vision for the investment income adjustment.
  
• Exposed a revised RBC amendment procedure document. The revisions (1) clarify the difference between structural and non-structural changes; (2) provide for an annual update to the Capital Adequacy Task Force’s working agenda; and (3) update the timing for posting of materials on the NAIC website (from business days to calendar days).
  
• Exposed the 2026 proposed charges for the task force and its working groups. Note that RBC Investment Risk and Evaluation Working Group charges have been revised to include (1) facilitating coordination and alignment among NAIC committees/task forces/working groups related to its work in reviewing the current asset risk framework; and (2) evaluating relevant historical data and applying defined statistical safety levels over appropriate time horizons in developing recommendations for revisions to the current asset risk structure and factors.

International Developments

Registration is now open for the International Association of Insurance Supervisors (IAIS) Global Seminar. Registration is free, and the conference will be held virtually on the following dates/times:

• Tuesday, July 8 (7:00 – 9:00 a.m. ET): Sessions include the IAIS Executive Committee leadership dialogue and a soon to be announced keynote address.
  
• Wednesday, July 9 (7:00 – 9:00 a.m. ET): Engagement sessions with Chairs of the Macroprudential, Policy Development, and Implementation and Assessment Committees.
  
• Thursday, July 10 (7:00 – 9:00 a.m. ET): Panels are scheduled to discuss key risks in the insurance sector and natural catastrophe protection gaps.

AI Updates

Last week, the House Energy & Commerce Committee passed its portion of the reconciliation bill. The proposal contains a provision that would put a 10-year moratorium on the development of state-based AI regulatory or enforcement regimes (see below for information on the NAIC’s efforts in this field). The language is intended to avoid creating a patchwork of state-based rules that will complicate a national standard in the future. The Subcommittee on Commerce, Manufacturing and Trade conducted a hearing on May 21 to discuss the issue further.

On May 15, the NAIC’s Big Data and AI Working Group issued a Request for Information to solicit stakeholder input on whether the working group should develop a model law on the use of AI in insurance. The document seeks feedback on general reactions to AI model law development; whether existing laws are sufficient to protect consumers; whether a potential model should consider all lines of business, have varying requirements based on company size, and include third-party vendors; and if any specific state legislation should be considered in the working group’s discussions. The RFI also requests feedback on the development of the AI Regulatory Examination Tool (discussed at the Spring National Meeting), specifically to learn whether any industry standard templates should be considered in developing the tool and if any non-insurance templates could be leveraged for insurance industry use. Comments are due by June 9.

The Big Data and AI Working Group has also published the Health AI/ML (Artificial Intelligence/Machine Learning) Survey Memo and Report. The survey was completed by insurers with more than $250 million of earned premium in 2023 that represent a significant portion of market share in one or more lines of business (comprehensive/major medical and student health plans) for one or more of the 16 participating states. Overall, the survey revealed that 92% of respondents use, plan to use, or plan to explore using AI/ML, which is higher than in the PPA, Homeowners, and Life Insurance surveys. Health insurers are primarily utilizing AI/ML models in strategic operations (79%), and 92% stated they have governance principles in place that model the NAIC AI Principles. The NAIC intends to continue exploring AI/ML model usage, evaluate the regulatory framework regarding the use of third-party models, determine whether additional white papers or best practices would be useful, explore the use of AI/ML at the product level, and collect feedback on the AI regulatory framework.

In other NAIC news, the Aggregation Method Implementation Working Group (AMIWG) will meet on June 9 at 3:30 p.m. ET to discuss the working group’s deliverables and hear project updates. The group has not met since its inaugural meeting in Indianapolis.

Federal Privacy Updates

The Cybersecurity and Infrastructure Security Agency (CISA) issued a set of recommendations to critical infrastructure asset owners (including insurance companies under the “Financial Services Sector” of critical infrastructure) to defend against operational technology (OT) cyber threats. The recommendations include (1) removing OT connections to the public internet; (2) changing default passwords immediately and using strong, unique passwords; (3) securing remote access to OT networks; (4) segmenting IT and OT networks; and (5) practicing and maintaining the ability to operate OT systems manually.

The Consumer Financial Protection Bureau (CFPB) announced that it is withdrawing several Biden-era regulatory initiatives, including its proposed rule requiring data brokers to comply with credit bureau–style regulations under the Fair Credit Reporting Act and its proposed rule limiting certain restrictive terms in consumer financial contracts.

The HHS Office for Civil Rights (OCR) announced its eighth enforcement action on May 15 under its “Risk Analysis Initiative.” The initiative is in place to ensure covered entities and business associates comply with the risk analysis and risk management provisions under the HIPAA Security Rule. Here, OCR settled a HIPAA investigation with a covered entity for $5,000 after determining the covered entity never conducted a HIPAA risk analysis and that it had failed to complete timely breach notification to 21,778 individuals affected by a breach.