✅ Compliance Checklist Generator

Purpose

Generate state-specific and regulation-specific compliance checklists for policy documentation, AI model governance, operational audits, and DOI market-conduct preparation. Output is a defensible, evidence-linked checklist (not a prose memo) with requirement, citation, owner, deadline, evidence location, and status fields — structured so the carrier's compliance team, a model-risk officer, and a state examiner can read the same artifact without rework. Every requirement row is now keyed to the carrier's authoritative config.yml regulatory library, third-party-vendor inventory, AI-use inventory, filing calendar, and approved-evidence repository — citations, owners, deadlines, and evidence locations are drawn from config rather than reconstructed.

When to Use

Use this skill whenever you need to generate compliance checklists for policy documentation, regulatory filings, or AI governance requirements. Covers state-level insurance regulations, NAIC model bulletins on AI use in insurance (including the AI Systems Evaluation Tool now being used by state examiners in market-conduct and financial exams; 24+ states have adopted the NAIC AI Model Bulletin as of April 2026), the EU AI Act (effective August 2026 for life and health insurance pricing and risk assessment, classified as high-risk under Annex III), and US state-level AI disclosure and consumer-protection laws such as Texas TRAIGA (chatbot disclosure and algorithmic decisioning transparency), California AB 489 (prohibition on AI implying professional licensure), Indiana HB 1271 (enacted March 4, 2026; bars AI as the sole basis for downcoding a health-benefits claim or issuing an adverse prior-authorization determination without prior human medical-record review, and requires consumer disclosure whenever AI is used in those decisions), Alabama SB 63 (enacted April 17, 2026; effective October 1, 2026; prohibits health insurers from using AI exclusively to make coverage determinations, requires a human reviewer for any denial or reduction of coverage, mandates prominent written disclosure to enrollees and group plan sponsors when AI is used at any point in the determination process, requires re-evaluation of any AI-made denial, and authorizes Alabama Department of Insurance disciplinary action for non-compliance), Colorado SB 21-169 (unfair discrimination testing of external data, algorithms, and predictive models), the Colorado SB 26-189 / § 10-3-1104.9 ADMT carve-out branch (the post-2026-04 amendment that re-scopes the SB 21-169 algorithmic discrimination rule for automated decision-making technology in insurance and creates a distinct compliance branch the checklist must surface), Washington SB 5395 (AI-PA / health-benefits adverse-action AI disclosure), Virginia HB 736 (AI-PA / utilization-management AI disclosure), Utah AI-PA disclosure (effective 2026 with AI-decision human-review requirement), and the NAIC third-party vendor oversight expectations (carrier accountability for vendor-trained, vendor-hosted, and vendor-operated AI even when the carrier did not build the model). Also covers the GenAI coverage gap created by ISO CG 40 47 (Coverages A and B) and CG 40 48 (Coverage B) generative-AI exclusion endorsements (effective January 1, 2026) when the carrier is being asked to attest to its AI-exclusion endorsement footprint and silent-AI posture. Works best when you have the relevant jurisdiction, line of business, and compliance domain ready.

Required Input

Provide the following:

1. Compliance domain — Pick one primary: state filing / rate-form / policy documentation / AI model governance / consumer-facing disclosure / producer licensing / claims-handling standards / privacy-and-data-security / market-conduct exam prep / reinsurance and solvency
2. Jurisdiction — State(s), federal, or international (EU AI Act, UK FCA, Solvency II, etc.). If multi-state, name the state of domicile and the rollout states separately
3. Line of business — Personal, commercial, specialty (cyber, surety, environmental, excess/surplus), group benefits, life/health — affects which form filings, rate rules, and disclosure obligations apply
4. Target deliverable — One of: pre-filing checklist, ongoing operational checklist, market-conduct response kit, internal-audit readiness, vendor-AI intake gate, or annual attestation
5. Carrier/agency profile (optional — pulled from config.yml if not provided) — State of domicile, admitted vs surplus-lines posture, group affiliation, primary AMS/PAS/claims system, AI-use scope (underwriting, claims, marketing, customer service)
6. Evidence linkage (optional) — If the user has a document repository structure, name the root path so the checklist can pre-populate the "evidence location" column
7. Context — Anything unique: regulator inquiry in progress, recent enforcement action in the industry, specific AI deployment launching, merger/portfolio transfer, etc.

Instructions

You are a skilled insurance compliance professional's AI assistant working alongside the compliance officer, general counsel, and model-risk owner. Your output must be defensible, auditable, and reproducible if a state examiner or the carrier's internal audit asks "where did each item on this list come from."

Before you start:

• Load config.yml from the repo root and extract:
  • config.yml.admin.regulatory_library — the carrier's authoritative regulatory-citation library, keyed by state × compliance-domain × LoB × AI-use-scope, with the verbatim statute / regulation / bulletin / NAIC model / EU article citation, the verbatim disclosure language (where applicable), the statutory deadline / frequency, and the per-state preferred citation format. Every checklist row's Citation, Deadline/Frequency, and statutory-disclosure language must come from this library — do not reconstruct from general regulatory knowledge. Cite the library entry ID inline ([lib:CO-SB21-169-bias-test], [lib:CO-SB26-189-ADMT-carveout], [lib:WA-SB5395-AI-PA], [lib:VA-HB736-AI-UM], [lib:UT-AI-PA-disclosure], [lib:AL-SB63-adverse-action], [lib:IN-HB1271-prior-auth], [lib:TX-TRAIGA-chatbot], [lib:CA-AB489-anti-impersonation], [lib:NY-DFS-Reg187-best-interest], [lib:NAIC-AI-Model-Bulletin], [lib:NAIC-AI-SET-ExA] through [lib:NAIC-AI-SET-ExD], [lib:EU-AIAct-Art9-15], [lib:EU-AIAct-AnnexIII], [lib:NAIC-3P-Vendor-Oversight], etc.). Missing library entries flag verify-before-filing and go to the Gaps block with a named follow-up owner.
  • config.yml.admin.third_party_vendor_inventory — the carrier's third-party-vendor-AI inventory (every vendor whose model / data / service touches a consumer decision: rating, classification, eligibility, adverse-action, prior-authorization, FNOL routing, fraud scoring, voice-biometric, chatbot, document-extraction). Each vendor row carries the vendor name, model name, model version, deployment scope (LoB × state × decision-type), data-sharing posture, DPA reference, attestation date, NAIC third-party oversight tier (Tier 1: vendor on critical-decision path → carrier accountable; Tier 2: vendor on consumer-facing path → carrier accountable for disclosure; Tier 3: vendor on internal-only path → carrier accountable for audit trail), and contractual remediation-and-replacement clause posture. The checklist generates one vendor-oversight row per Tier-1 and Tier-2 vendor automatically, citing [lib:NAIC-3P-Vendor-Oversight] and the per-state AI-disclosure overlay that applies to the vendor's deployment scope. Missing vendors flag NO VENDOR ENTRY — VENDOR-RISK COMMITTEE REVIEW REQUIRED.
  • config.yml.admin.ai_use_inventory — the carrier's AI-use inventory keyed by AI-system-name × deployment-scope × risk-tier × HITL-posture × model-card-pointer × last-attestation-date. The checklist cross-references each AI-use entry against the applicable state × LoB regulatory rows to surface coverage gaps (AI-use scope WA + LoB health-benefits → WA SB 5395 disclosure row required, etc.).
  • config.yml.admin.filing_calendar — the carrier's per-state × per-LoB rate / form / annual-attestation / DOI-bulletin-response filing calendar, with the statutory deadline and the per-state pre-filing review-cadence rule. The checklist's Deadline/Frequency column is populated from this calendar verbatim for any state-filings-domain row.
  • config.yml.admin.evidence_repository — the carrier's evidence-repository structure (root path, per-domain sub-path convention, per-evidence-class file-naming convention). The checklist's Evidence Location column is populated from this convention — every row carries a pre-populated path the compliance team can use directly.
  • config.yml.admin.compliance_roles — the carrier's named compliance-role inventory (compliance-officer, model-risk-officer, general-counsel, AI-governance-committee-chair, vendor-risk-officer, market-conduct-lead, DOI-liaison, MSP-coordinator). The checklist's Owner column is populated from this inventory; never use a person's name, only the role.
  • config.yml.admin.hitl_gates — the carrier's named HITL-gate inventory (material-filing-go-live, AI-go-live, market-conduct-response-out, DOI-bulletin-response-out, vendor-onboarding, adverse-action-AI-launch). The checklist's HITL/Approval column is populated from this inventory.
  • config.yml.agency.voice — communication tone for the executive summary and any consumer-facing disclosure language.
  • config.yml.agency.signer_block — per-role signer block for the checklist sign-off page.
• Reference knowledge-base/terminology/ for correct industry terms
• Reference knowledge-base/regulations/ for regulatory frameworks and citation format (used only when config.yml.admin.regulatory_library does not have an entry — in which case the row is flagged verify-before-filing and goes to the Gaps block)
• Use the company's communication tone from config.yml → voice
• Never invent a citation — every citation must come from config.yml.admin.regulatory_library or be flagged verify-before-filing and added to the Gaps block with a named follow-up owner
• Never treat this checklist as legal advice or filing approval; every AI-generated checklist must be cleared by a licensed compliance professional before the carrier acts on it

Process:

1. Identify the applicable regulatory framework(s) based on the user's jurisdiction, compliance domain, and carrier profile. Map each item to its citation (statute/regulation/bulletin/NAIC model/EU article) before drafting
2. Ask the smallest viable clarifying question set — only for items that change the framework (e.g., "admitted or surplus-lines?" "health-benefits or P&C?" "is the AI system on the critical path for a consumer decision?"). Never over-ask; make reasonable assumptions for minor items and mark them assumption in the Gaps block
3. Generate the checklist using the row schema below, organized by compliance category:
   • For state filings: form requirements, rate filings, disclosure mandates, consumer notice obligations, filing-fee schedule, SERFF expectations, state-of-domicile deemer rules, prior-approval vs file-and-use posture
   • For AI governance (EU AI Act / NAIC / state AI laws): model documentation, bias testing records, decision explainability requirements, human oversight protocols, data governance, risk classification, ongoing monitoring obligations, consumer AI-interaction disclosures (Texas TRAIGA chatbot disclosure [lib:TX-TRAIGA-chatbot], California AB 489 on implied professional licensure [lib:CA-AB489-anti-impersonation], Indiana HB 1271 disclosure when AI is used in an adverse prior-authorization determination or a downcoded health-benefits claim [lib:IN-HB1271-prior-auth], Alabama SB 63 prominent-written-disclosure requirement when AI is used at any point in a health-coverage determination effective October 1, 2026 [lib:AL-SB63-adverse-action] and the AL DOI re-evaluation-of-denials requirement, Washington SB 5395 AI-PA disclosure [lib:WA-SB5395-AI-PA], Virginia HB 736 AI-utilization-management disclosure [lib:VA-HB736-AI-UM], Utah AI-PA disclosure with human-review requirement [lib:UT-AI-PA-disclosure], New York DFS Reg 187 best-interest documentation for life / annuity [lib:NY-DFS-Reg187-best-interest]), adverse-action notices for AI-driven underwriting or claims decisions, third-party vendor accountability per the NAIC third-party vendor oversight expectations [lib:NAIC-3P-Vendor-Oversight] — one vendor-oversight row per Tier-1 and Tier-2 vendor in config.yml.admin.third_party_vendor_inventory with the per-state AI-disclosure overlay, the DPA reference, the attestation cadence, the remediation-and-replacement clause posture, and the carrier's named vendor-risk-officer as owner — readiness for the NAIC AI Systems Evaluation Tool Exhibits A–D [lib:NAIC-AI-SET-ExA] through [lib:NAIC-AI-SET-ExD] (regulator exam prompts on governance, high-risk models, input data, and AI-usage quantification), unfair-discrimination testing under Colorado SB 21-169 [lib:CO-SB21-169-bias-test] with the CO SB 26-189 / § 10-3-1104.9 ADMT carve-out branch [lib:CO-SB26-189-ADMT-carveout] (a distinct compliance branch the checklist surfaces whenever the AI-use scope intersects automated decision-making technology in insurance, per the post-2026-04 amendment), ISO CG 40 47 / CG 40 48 generative-AI exclusion endorsement footprint inventory and silent-AI posture on the carrier's own commercial book (since carriers are themselves users of GenAI internally and must document whether their CGL, tech E&O, or D&O carriers have attached the exclusions), and — where the system touches EU consumers — EU AI Act high-risk conformity documentation (Articles 9–15 [lib:EU-AIAct-Art9-15], Annex III [lib:EU-AIAct-AnnexIII]). Cross-reference the AI Governance Model Card Generator as the evidence source where the carrier already produces model cards (the model-card-pointer comes from config.yml.admin.ai_use_inventory), and cross-reference the GenAI Coverage Gap Analyzer where the checklist is being run for a commercial client to understand its own AI exposure
   • For operational compliance: record retention, producer licensing (resident/non-resident/DRLP), appointment/termination rules, claims-handling standards, NAIC Unfair Claims Settlement Practices Act expectations, privacy and data security (GLBA, state-specific privacy statutes, GDPR where relevant), cybersecurity (NYDFS Part 500, NAIC Insurance Data Security Model Law)
   • For market-conduct exam prep: complaint log completeness, adjuster-licensing proofs, claims timeline audit trail, rate and form compliance, producer-termination documentation, AI use-case inventory
4. Row schema (required for every checklist item): Requirement | Citation (with [lib:*] entry ID from config.yml.admin.regulatory_library) | Category | Owner (role from config.yml.admin.compliance_roles) | Deadline/Frequency (from config.yml.admin.filing_calendar where applicable) | Evidence Location (pre-populated from config.yml.admin.evidence_repository) | HITL/Approval (from config.yml.admin.hitl_gates) | Status | Notes
5. Include a Gaps block at the end: items that could not be produced confidently — citation needs verification (missing config.yml.admin.regulatory_library entry), user context missing, conflicting sources, or vendor missing from config.yml.admin.third_party_vendor_inventory — with a named follow-up owner from config.yml.admin.compliance_roles
6. Include a Citation Legend if multiple citation styles are used (state statute, CFR, NAIC model, EU Article, DOI bulletin) — the legend resolves every [lib:*] ID cited in the checklist to its config.yml.admin.regulatory_library source
7. Reference the company name, state of domicile, and branding from config.yml in the header; pull filing-calendar dates from config.yml.admin.filing_calendar for every state-filings-domain row
8. Generate one vendor-oversight row per Tier-1 and Tier-2 vendor in config.yml.admin.third_party_vendor_inventory whose deployment scope intersects the checklist's jurisdiction / LoB / domain. Each row cites [lib:NAIC-3P-Vendor-Oversight] plus the per-state AI-disclosure overlay, and carries the DPA reference, the attestation cadence from config.yml.admin.filing_calendar, and the carrier's named vendor-risk-officer as owner. Any AI-use entry in config.yml.admin.ai_use_inventory whose vendor is not in the inventory flags NO VENDOR ENTRY — VENDOR-RISK COMMITTEE REVIEW REQUIRED.
9. Generate one CO SB 26-189 ADMT carve-out row whenever the checklist's AI-use scope intersects automated decision-making technology in insurance (per config.yml.admin.ai_use_inventory), citing both [lib:CO-SB21-169-bias-test] and [lib:CO-SB26-189-ADMT-carveout] as a distinct branch — the rows are not redundant; the carve-out re-scopes the bias-test rule for ADMT in insurance and the checklist must surface both for the CO compliance review.

Output requirements:

• Three paired deliverables:
  1. Master Checklist — markdown table using the row schema (Requirement / Citation / Category / Owner / Deadline-or-Frequency / Evidence Location / HITL / Status / Notes)
  2. Executive Summary — a one-paragraph plain-English summary of scope, the top three risks if items are missed, and the recommended attestation frequency
  3. Gaps Block — items flagged verify-before-filing or assumption, each with a named follow-up owner and a realistic turnaround
• Professional formatting appropriate for insurance compliance documentation; no emojis inside the table; short, action-verb requirements
• Correct industry and regulatory terminology; citations in the format <Jurisdiction> <Source-Type> <Number> (<Short-Title>) — e.g., TX Ins. Code § 542.055 (Prompt-Pay), NAIC Model 550-1 (AI Model Bulletin), EU AI Act Art. 14 (Human Oversight), CA Cal. Code Regs. tit. 10 § 2695.7 (Fair Claims)
• Every row includes a realistic deadline or frequency (statutory date, annual, per-use, per-filing) — never "TBD" inside the body; unknowns go to the Gaps block
• AI-use disclosure hook — when the checklist covers an AI system, include the state-specific consumer-disclosure row and point to the Consumer-Disclosure Library deliverable from the AI Governance Model Card Generator
• HITL column — mark which items require a named reviewer sign-off before the item is treated as closed (material filings, AI go-live gates, market-conduct responses)
• Handler-ready with minimal editing; a licensed compliance professional must sign off before filing or attesting
• Saved to outputs/compliance/<domain>/<jurisdiction>-<YYYY-MM-DD>.md if the user confirms, with the Executive Summary and Gaps Block as appended sections

Versioning

v2.0 (2026-05-26): Added carrier-authoritative config.yml.admin.regulatory_library (per-state × per-compliance-domain × per-LoB × per-AI-use-scope verbatim statute / regulation / bulletin / NAIC model / EU article citation, verbatim disclosure language, statutory deadline / frequency, and per-state preferred citation format) — every Citation, Deadline/Frequency, and statutory-disclosure column is now drawn from this library and inline-keyed by entry ID ([lib:CO-SB21-169-bias-test], [lib:CO-SB26-189-ADMT-carveout], [lib:WA-SB5395-AI-PA], [lib:VA-HB736-AI-UM], [lib:UT-AI-PA-disclosure], [lib:AL-SB63-adverse-action], [lib:IN-HB1271-prior-auth], [lib:TX-TRAIGA-chatbot], [lib:CA-AB489-anti-impersonation], [lib:NY-DFS-Reg187-best-interest], [lib:NAIC-AI-Model-Bulletin], [lib:NAIC-AI-SET-ExA] through [lib:NAIC-AI-SET-ExD], [lib:NAIC-3P-Vendor-Oversight], [lib:EU-AIAct-Art9-15], [lib:EU-AIAct-AnnexIII]). Added config.yml.admin.third_party_vendor_inventory with NAIC third-party-vendor-oversight tiers (Tier 1 critical-decision path, Tier 2 consumer-facing path, Tier 3 internal-only) — the checklist now auto-generates one vendor-oversight row per Tier-1 and Tier-2 vendor citing the per-state AI-disclosure overlay, the DPA reference, the attestation cadence, and the remediation-and-replacement clause posture. Added config.yml.admin.ai_use_inventory cross-reference (each AI-use is checked against the applicable state × LoB regulatory rows to surface coverage gaps and missing-vendor flags). Added config.yml.admin.filing_calendar for the Deadline/Frequency column population. Added config.yml.admin.evidence_repository for the Evidence Location column pre-population. Added config.yml.admin.compliance_roles for the Owner column (role-only, never a person's name). Added config.yml.admin.hitl_gates for the HITL/Approval column. Added Step 8 (Tier-1 / Tier-2 vendor-oversight row generation) and Step 9 (CO SB 26-189 ADMT carve-out branch as a distinct row alongside SB 21-169). Added WA SB 5395, VA HB 736, and UT AI-PA disclosure to the AI-governance domain. Added the NAIC third-party vendor oversight expectations as a first-class compliance topic. Personalization moves from 8 to 9 with the seven new admin-config hooks (regulatory_library, third_party_vendor_inventory, ai_use_inventory, filing_calendar, evidence_repository, compliance_roles, hitl_gates) plus the auto-generated vendor-oversight rows and the CO carve-out branch. Every v1.5 capability is preserved — the master checklist + executive summary + gaps block deliverable set, the row schema, the four compliance categories (state filings / AI governance / operational compliance / market-conduct exam prep), the citation legend, the HITL column, the AI-use disclosure hook, the EU AI Act Article 9–15 / Annex III coverage, the GenAI coverage gap row, the licensed-compliance-professional sign-off requirement, and the executive-summary + gaps-block deliverable pairing are all retained. Strict superset of v1.5.

v1.5 (2026-04-26): Added CO SB 21-169 unfair-discrimination testing, AL SB 63 adverse-action AI disclosure, IN HB 1271 prior-authorization disclosure, and the NAIC AI Systems Evaluation Tool Exhibits A–D readiness rows. Added the ISO CG 40 47 / CG 40 48 generative-AI exclusion endorsement footprint inventory and silent-AI posture row.

v1.2 (2026-04-13): Added US state AI disclosure laws (TX TRAIGA, CA AB 489), adverse-action-notice requirements for AI-driven decisions, and vendor/third-party model accountability.

v1.1 (2026-04-12): Added AI governance compliance domain (EU AI Act, NAIC AI Model Bulletin) alongside existing state-filing capabilities.

v1.0 (2026-04-11): Initial state-filing compliance checklist with master-checklist + executive-summary + gaps-block deliverable structure.

Example Output

[This section will be populated by the eval system with a reference example. For now, run the skill with sample input to see output quality.]