Insurance Compliance Across 50 States: Where the Rules Actually Live

Four layers bind a US insurer, and they answer different questions: the state insurance code says what is prohibited, the state administrative regulations say what the process must look like, the department bulletins say how the regulator reads both, and market conduct expectations say what an examiner will actually test. Most compliance stacks cover layers one and two, skip layer three, and meet layer four for the first time during an exam. That is backwards, because layer three moves fastest and is the cheapest to monitor.

This is a working guide for a compliance or product team that operates in more than five states. It covers what lives in each layer, how to route a real question to the right one, and how to watch the layers that change.

TL;DR

• Statutes tell you what is prohibited. State insurance codes are corpusType=STATE, about 1.93 million sections across 52 jurisdictions. They rarely answer an operational question on their own.
• Regulations tell you what the process looks like. State administrative codes are corpusType=REGULATION, about 1.46 million sections across 52 jurisdictions. This is where deadlines, notice content, and filing mechanics usually live.
• Bulletins tell you how the regulator reads the first two. corpusType=STATE_AGENCY_GUIDANCE, 13,178 sections across 49 jurisdictions, refreshed weekly. This is the layer teams skip, and the one examiners quote.
• Market conduct expectations are not a corpus. They live in exam handbooks and in the state's own consent orders and exam reports. Nobody can sell you that layer as clean primary law, and anyone who says otherwise is selling a copyrighted handbook.
• Start with a cross-layer query, not a guess. One POST /us/statutes/search call can pass all three corpus types and a state list at once, so the ranking tells you which layer answers your question before you commit to one.
• Watch the bulletins, not the statute book. Statutes turn over on a legislative calendar. Bulletins can land any week, which is why change monitoring pays off more here than anywhere else in primary law.

This sits inside our US primary law corpus series, which documents each source in its own post.

The developer-facing companions are State Insurance Bulletins API: 49 Insurance Departments in One Query for layer three and State Regulations API: 1.5 Million Administrative Rules Across 52 Jurisdictions for layer two.

The four layers

Each layer sits under the one above it and gets more specific. The authority flows down: a regulation is adopted under a statutory grant, a bulletin interprets one or both, and an exam tests conduct against all three.

The failure mode is reading only the top. A statute that prohibits "unfair claim settlement practices" is real law and answers almost nothing operational. The number of days, the required content of a notice, and the acceptable proof of mailing live further down.

Layer 1: the state insurance code

What it answers: who must be licensed, what conduct is prohibited, what the commissioner has the power to do, and what the penalties are.

Where it lives: corpusType=STATE. About 1.93 million sections across 52 jurisdictions (50 states plus DC plus Puerto Rico). Insurance is usually its own title or code within the state's statute book.

Why you still need it: every regulation and bulletin below traces back to a statutory grant. When you want to argue that a department has overreached, this is where the argument starts.

Check the freshness array before you rely on a state. Some corpora sit paused, meaning complete and officially sourced but not currently re-pulling, most often because the publisher's own access rules require it. Every pause is declared with its reason in the freshness array of the coverage response rather than left for you to find.

Layer 2: state administrative regulations

What it answers: the operational rules. Timeframes, required notice content, form and rate filing procedure, recordkeeping, producer conduct.

Where it lives: corpusType=REGULATION. About 1.46 million sections across 52 jurisdictions, documented in full in the state regulations API post.

Why it matters most for product teams: if you are building claims software or a policy administration system, this is the layer that turns into acceptance criteria. A statute says a practice is unfair. A regulation says a first-party claim gets acknowledged within a stated number of days and tells you what the acknowledgment has to contain.

Layer 3: department bulletins

What it answers: how the commissioner applies layers one and two right now, including to things the code never anticipated.

Where it lives: corpusType=STATE_AGENCY_GUIDANCE. 13,178 sections across 49 jurisdictions, refreshed weekly.

Why teams skip it: because there is no standard name for it. New York issues Circular Letters, Virginia issues Administrative Letters, Washington issues Technical Assistance Advisories, Hawaii issues Commissioner's Memoranda, Florida issues Informational Memoranda, Montana issues Advisory Memos, and Puerto Rico issues Cartas Normativas. A keyword crawler looking for "bulletin" finds none of those. The full naming map and per-state counts are in the state insurance bulletins API post.

Why it is the highest-value layer to monitor: a bulletin can land any week and change what compliant behavior looks like without a single word of statutory text changing.

Layer 4: market conduct expectations

What it answers: what an examiner samples, how a finding is written, and what remediation the department will accept.

Where it lives: not in a clean primary-law corpus, and this is where honest vendors stop. The main exam handbook is a copyrighted commercial publication from the NAIC, not open government primary law, so it is deliberately excluded from our corpus and cannot legitimately appear in anyone else's as free text.

What you can actually build on: the state's own published output. Consent orders, exam reports, and enforcement actions are government documents, and the bulletins in layer three are frequently the department writing down an exam expectation in advance. Reading layer three carefully is the closest thing to reading layer four ahead of time.

A worked example: claim acknowledgment and nonrenewal notice

Take a question a multi-state carrier asks constantly: how fast must we acknowledge a first-party claim, and what notice must we give before nonrenewing a personal lines policy? Run it across Texas, New York, Washington, and California, the shape the multi-state comparison recipe generalizes.

The wrong move is to guess a citation and fetch it. Citations are the output of this process, not the input.

Step 1: ask all three layers at once

curl -X POST https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "acknowledge first party claim within days written notice",
    "corpusType": ["STATE", "REGULATION", "STATE_AGENCY_GUIDANCE"],
    "state": ["tx", "ny", "wa", "ca"],
    "matchType": "any",
    "limit": 50,
    "excerptChars": 600
  }'

One call, three layers, four states, 4 credits. The ranking is the diagnosis. If the top hits are regulations, the operational rule lives in the administrative code. If a bulletin outranks them, the department has said something more specific than the rule does, and that is the document your examiner will quote. The compliance mapping recipe shows the same routing as runnable code.

Read the corpusType, state, and actId on each hit, and keep the source URL. Do not paraphrase from the excerpt: pull the full text before anyone relies on it.

Step 2: pull the full text of the hits that matter

curl https://api.vaquill.ai/api/v1/us/statutes/section/{actId}/body \
  -H "Authorization: Bearer vq_key_..."

actId values are stable, which is what makes a finding re-checkable next quarter, but they are not guessable. Take them from the search response and store them. A hand-built id usually 404s.

Step 3: browse the tree once you know where you are

Now that a hit has told you which code and title the answer sits in, walk the neighborhood rather than searching again:

curl "https://api.vaquill.ai/api/v1/us/statutes/divisions?corpusType=REGULATION&state=tx" \
  -H "Authorization: Bearer vq_key_..."

This returns the code tree so you can find the insurance title without guessing a citation format. Pair it with the section neighbors endpoint to read the sections immediately before and after a hit, which is how you catch the exception subsection that the search snippet cut off. The browse hierarchy recipe covers both calls.

Step 4: repeat for the second half of the question

Nonrenewal notice is a different query, and often a different layer. Run it separately rather than cramming both into one search string:

curl -X POST https://api.vaquill.ai/api/v1/us/statutes/search \
  -H "Authorization: Bearer vq_key_..." \
  -H "Content-Type: application/json" \
  -d '{
    "query": "notice of nonrenewal personal lines policy days before expiration",
    "corpusType": ["STATE", "REGULATION", "STATE_AGENCY_GUIDANCE"],
    "state": ["tx", "ny", "wa", "ca"],
    "matchType": "any",
    "limit": 50
  }'

What the output looks like as a compliance artifact

The deliverable is a small table your team can maintain, with one row per state and one column per layer, holding actId values rather than prose:

Storing ids rather than quoted text is the whole trick. Quoted text goes stale silently. An id can be re-fetched, diffed, and watched.

Coverage, and how to check it before you build

GET /us/statutes/coverage is free and self-describing. It returns per-jurisdiction counts, a freshness array that declares every paused corpus with its reason, a currency block stating what each corpus is current through in the publisher's own words, and a measuredAt timestamp.

That last one matters more than the totals. A coverage number without a measurement date is a marketing claim. Run the endpoint on day one of an evaluation and again at the end, and compare. The coverage endpoint reference lists every field it returns.

For context, the whole corpus is 4,150,839 distinct sections indexed as 12,003,716 retrieval passages across 53 jurisdictions, of which the state layers described here are the bulk. The collection layer is published at Vaquill-AI/open-us-law, so the parsers and the JSONL schema are inspectable rather than a black box.

Change monitoring is where insurance differs

For most primary law, an annual or quarterly re-check is fine. Insurance is not most primary law, because layer three moves on no calendar at all.

Three mechanics do the work, and none of them is a point-in-time query:

GET /boards is free and lists every watchable source with lastRetrievedAt, cadence, and retrievalStatus. This is how you audit a freshness claim instead of trusting one.

Watches turn a board into change events you receive rather than poll for, and a per-section diff shows what moved inside a specific section. That is the difference between "something in Texas changed" and "this subsection gained a sentence." The delivery and diff mechanics are on the alerts page.

yearFrom and yearTo filter on the last amendment year the publisher credits, so they track the law rather than our rebuild date. One caveat that trips people up: about a fifth of sections carry no amendment credit at all, because some publishers print none, and those sections drop out of results once either bound is set. Use the filter to narrow recent activity, never to prove a section is old.

What does not exist: an as_of=DATE query. Ask for a citation and you get the text in force today, not a version history you can index into. If you need to prove what a regulation said on the day a claim was denied in 2021, you need an archive product, not this one. Amendment history, lastAmendedYear, change events, and diffs give you the trail going forward, not a reconstruction going backward, and the point-in-time post works through why.

FAQ

What are the layers of insurance regulation in the US?

Four: the state insurance code (statutes), the state administrative regulations adopted under it, the department bulletins interpreting both, and the market conduct expectations an examiner applies. Authority flows downward and specificity increases downward. Operational answers almost always live in layers two and three rather than in the statute.

Which layer answers an operational question like a claim deadline?

Usually the state administrative regulations, and then a bulletin that narrows or clarifies them. The statute typically establishes only that a category of conduct is prohibited. Running one search across all three corpus types at once is faster than guessing which layer to open.

Why do insurance bulletins get skipped so often?

Because there is no shared name for them. New York issues Circular Letters, Virginia issues Administrative Letters, Washington issues Technical Assistance Advisories, Hawaii issues Commissioner's Memoranda, and Puerto Rico issues Cartas Normativas. A crawler or a search tuned to the word "bulletin" misses most of them.

How many states are covered for statutes and regulations?

52 jurisdictions each: 50 states plus DC plus Puerto Rico. State statutory codes run to about 1.93 million sections and state administrative regulations to about 1.46 million. Insurance bulletins are a separate corpus at 49 jurisdictions and 13,178 sections.

Can I check what a rule said on a past date?

Versioning here runs off the amendment record rather than a date parameter. A citation returns the rule as it stands today, and no as_of parameter is offered. Amendment history, a lastAmendedYear field, a yearFrom/yearTo currency filter, change events on each refresh, and per-section diffs on watched boards are what exist instead.

What does it mean when a state corpus is paused?

It means the text is complete and officially sourced but is not being re-pulled, most often because the publisher's own access rules require it. Each pause and its reason are declared in the freshness array of the coverage response, so you find out from the API rather than from an incident.

Is NAIC model law text available through the API?

No, and it will not be. NAIC model acts and handbooks are copyrighted commercial publications rather than open government primary law. Only each state's own published statutes, regulations, and bulletins, issued under that state's own authority, are in scope.

How should a compliance team store the results of this research?

Store actId values, not quoted text. Ids are stable and re-fetchable, so a finding can be diffed and watched later. Quoted text in a spreadsheet goes stale without telling anyone, which is how a compliance matrix ends up confidently wrong two amendments later.

How much does one of these searches cost?

A search call is 4 credits regardless of how many states or corpus types you list, which is why a single cross-layer, multi-state call beats fanning out. Coverage and boards are free, and failed calls are not charged. Pricing detail is in the post on legal API credits and pricing.

Priyansh Khodiyar builds the US primary law corpus at Vaquill AI. Disclosure: we build the API used in the examples above. The section counts were measured live on 2026-08-30 and are re-checkable against the free coverage endpoint. Nothing here is legal advice, and the weight a given state gives to department guidance is a question of that state's own administrative law.

Priyansh Khodiyar

Co-Founder & CTO

Priyansh leads engineering and AI at Vaquill, from the matter workbench to drafting, document comparison, document matrix, and citation-verified research.