The quick take
In 2026, agencies face two parallel pressures:
- Stricter expectations for safeguarding customer data, and
- Faster adoption of AI tools—often without clear rules.
Insurance is explicitly called out as part of the financial products/services ecosystem, and GLBA-related expectations include safeguarding sensitive customer information. Federal Trade Commission
This post gives you a practical, agency-friendly checklist (not legal advice) to reduce risk, tighten operations, and protect your reputation.
Step 1: Treat your agency like the data business it already is
Even small agencies handle:
- driver’s license numbers
- DOBs, addresses, VINs
- loss histories
- banking/payment info (sometimes)
- business financial details
The FTC’s GLBA guidance highlights that covered entities must safeguard sensitive customer data and maintain an information security program.
Action: Appoint a single owner for “security ops” (even part-time). If everyone owns it, no one owns it.
Step 2: Your 2026 “minimum viable security program”
You don’t need enterprise complexity—you need consistency.
Baseline controls
- MFA on email, agency management system, CRM, cloud storage
- Password manager + no shared logins
- Device encryption (laptops)
- Patch management (automatic updates)
- Role-based access (CSR vs producer vs admin)
Process controls
- New hire security onboarding (30 minutes, documented)
- Quarterly phishing reminder + sample screenshots
Documented incident response plan (“if this happens, do this next”)
Step 3: Vendor management is no longer optional
Agencies run on vendors (AMS, rating, e-signature, email marketing, IT support). Security incidents often start there.
Vendor checklist
- Who has access to customer data?
- Do they have MFA?
- How do they report an incident to you?
- Do you have a written agreement in place?
Step 4: Create an agency AI policy (simple, strict, enforceable)
AI tools can help productivity—but they can also create privacy/E&O risk if staff paste client data into the wrong place.
Start with 5 clear rules
- Don’t paste customer PII into public AI tools.
- If you use AI to draft emails, remove identifying details first.
- Treat AI output as a draft—human review required.
- Never let AI “decide coverage.” It can summarize, not advise.
- Document how you use AI in workflows (for consistency and training).
Why now? Regulators and carriers are paying more attention to AI governance. The NAIC has published guidance on insurer AI use, and many states have adopted the NAIC AI model bulletin framework—meaning expectations around governance and documentation are becoming more common in the market.
Step 5: Build a 30-day rollout plan
Week 1: MFA everywhere + password manager + disable shared inbox logins
Week 2: Vendor list + access review + terminate stale accounts
Week 3: Publish 1-page AI policy + staff training (record it)
Week 4: Incident response checklist + tabletop drill (30 minutes)
How Agents United fits
Standardizing a security + AI policy is easier when you have shared playbooks, training, and a network focused on modern operations. Agents United is built to help independent agencies grow with tools, training, and support while staying competitive.
