The 28-State NAIC Data Security Law: Why Your CRM Vendor's Security Posture Is Now Your Liability

As of early 2026, at least 28 jurisdictions have enacted some version of the NAIC Insurance Data Security Model Law (MDL-668). For agencies licensed across state lines, that means compliance with its provisions is effectively mandatory regardless of where you're headquartered — you must satisfy the most restrictive requirements in every state where you hold an appointment.

If you're licensed in New York, Texas, and Connecticut, you're operating under three different versions of the same model law simultaneously, and your information security program must account for all of them. Most agency owners built one program for their home state and assumed it covered their footprint. That assumption, as Compass MSP and the NAIC have both noted, is almost always wrong.

The 2026 Agenda Adds Two New Obligations

The original Model Law addressed information security programs, risk assessments, and breach notification. The NAIC's 2026 regulatory agenda adds two new obligations the original didn't cover in depth: governance of artificial intelligence tools used in insurance operations, and enhanced third-party data and model management requirements that are significantly more specific than anything existing programs were built to satisfy.

For an agency, that means the vendor-security question isn't optional anymore. If your CRM vendor uses AI to score leads, generate content, or summarize client records, you're now responsible for governing how that vendor uses AI on your data. The NAIC's Model Bulletin on the Use of Artificial Intelligence by Insurance Companies makes clear that decisions or actions supported by AI must comply with all applicable insurance laws — and the liability flows to the licensee, not the vendor.

Why Your CRM Vendor Is Your Compliance Liability

The practical consequence of MDL-668 is that you can't outsource the liability of a breach. When your CRM is compromised, the notification, the forensic review, and the regulatory response belong to you. A vendor that can't produce evidence of a written information security program, a recent risk assessment, and updated vendor-management controls is a vendor that transfers regulatory risk onto your license.

This is exactly why Kaffeine's security and compliance framework was built to be auditable rather than merely advertised. Defense-grade encryption, zero-trust architecture, and row-level security aren't features we list on a pricing page — they're controls we can document for your next regulatory examination.

What a Compliance-Ready Vendor Looks Like

When you're selecting or re-evaluating a CRM platform under MDL-668, the minimum bar is now:

• A documented information security program you can review
• Encryption at rest and in transit as a default, not an add-on
• Clear data-isolation guarantees across tenants
• A Business Associate Agreement that covers breach response
• AI governance that lets you see how automated features touch your data

If your current vendor can't produce those five things in writing, your onboarding and data migration process should include a vendor-security review before any records move. Our case studies show what a migration looks like when the receiving platform was designed for compliance from day one.

The Takeaway

The NAIC has made vendor security your problem, not just your vendor's. The agencies that survive the next round of examinations will be the ones who treated their security and compliance posture as a procurement criterion rather than an afterthought — and who chose platforms built to be examined.

— G. David Humphries, Kaffeine Security