Twice a year, most of the clocks in your house fix themselves. Your phone, your laptop and the TV all wake up on the right time the morning daylight saving ends. The microwave doesn't, and neither does the clock in the car, which in plenty of households stays an hour off until spring because nobody remembers which two buttons to hold down.
The difference has nothing to do with how good the clock is. The ones that fix themselves are connected to something. The ones you set by hand only know what you told them, on the day you told them.
On October 1, the CMS marketing rules for Medicare Advantage and Part D changed. Your carriers will update their templates, and your FMO's compliance team has probably sent you something already. Those are the connected clocks. The prompts, Custom GPTs, Claude Projects and AI assistants your agency built over the last two years are the car clock. They still say whatever you told them in 2024 and 2025, and some of what you told them stopped being true on October 1. AEP opens October 15, which leaves about two weeks to reset them before they start writing to beneficiaries every day.
What changed on October 1
The changes come from the CY2027 Medicare Advantage and Part D final rule, which CMS released in April. The marketing provisions took effect October 1, and three of them reach straight into the work AI does in an agency.
The third-party marketing organization disclaimer moved. If you sell for more than one MA organization, the standardized disclaimer used to belong in the first minute of a sales call. Now it has to come before any discussion of benefits, which isn't the same thing if your opener gets to a plan's extras in the first thirty seconds. It also has to go out in email, online chat and other electronic communication with a beneficiary. And its wording no longer mentions the State Health Insurance Assistance Program. It points people to Medicare.gov or 1-800-MEDICARE.
The 48-hour wait after a Scope of Appointment is gone. You still agree on the scope and record it before the appointment, and an in-person appointment still needs it in writing.
Call recordings have a new retention schedule. Marketing and sales calls, including the audio of calls held over video platforms, are recorded and kept for six years. The first three years have to be audio. For years four through six, you can keep the audio or a complete and accurate transcript.
What didn't change matters just as much. CMS asked for public comment on AI in last November's proposed rule and didn't write an AI-specific marketing rule into the final one. Don't read that as a pass. Marketing is defined by what a communication is meant to do and what it says, so an email your AI drafted is marketing on exactly the same terms as one you typed yourself.
I'm not a compliance officer, and this isn't legal advice. Everything above comes from the regulation text as it stands this week. Your FMO's compliance team and your carriers have the final word, including on any requirement stricter than CMS's, so confirm with them before you change anything a client will see.
Not every outdated prompt carries the same risk
I'd rather you fix the dangerous ones today than all of them next month, so it's worth sorting them before you start.
Some old instructions are wrong and risky. An assistant that writes the disclaimer with the old SHIP wording. A call-script prompt that saves the disclaimer for after the plan highlights. An email or chat assistant that never adds the disclaimer at all, because until this month it didn't have to. Each of those puts noncompliant language in front of a beneficiary, and AEP is when they'll do it most often.
Others are only slow. A scheduling assistant that still holds every appointment 48 hours after the Scope of Appointment isn't breaking a rule, since waiting is still allowed. It's costing you appointments in the eight weeks you can least afford to lose them.
The last kind stays quiet until someone checks. If an AI note-taker's output is what your agency treats as the record of a call, look at what it actually keeps. A summary isn't a transcript, and for the first three years the rule wants the audio anyway. (Is Your AI Notetaker HIPAA Compliant? covers the other question that tool raises.) Nothing breaks the day you get this one wrong. You find out at an audit.
The afternoon audit
It fits in an afternoon. Four steps, in order.
- Find every place an instruction lives. Custom GPTs, Claude Projects, Gemini Gems, the prompt doc your team copies from, the instructions behind your website chat, the AI features inside your CRM or email platform. Then ask your producers what they built on their own, and make it safe to answer. The tools nobody else knows about are the ones nobody has updated, which is the whole trouble with Shadow AI in an agency.
- Search them for the old rules. Look for "first minute," "SHIP," "State Health Insurance," "48 hours" and any call retention period. Rewrite every hit from your FMO's current template. Don't ask the AI for the new wording. A model whose training data predates April may hand you the old version with total confidence.
- Put the rule in one place. Don't paste the new disclaimer into fourteen prompts. Put it in one reference document, or one skill, that every Medicare-facing assistant reads. If you're already moving Custom GPTs over to skills before OpenAI retires them, do this as part of the move.
- Put a name on the last step. Nothing goes to a beneficiary until a named person has read it. I made the case for that rule in Before AEP Opens, Decide What Your AI Never Decides, and a rule change two weeks before AEP is the best argument for it I can think of.
Why one skill beats fourteen better prompts
Step three is the one that keeps paying off, so it's worth slowing down on.
In PRICE, the brief you give an AI before it works for you, compliance lives in the Constraints: industry rules, plus human review before anything reaches a client. Most agencies wrote those Constraints into each prompt separately. That's exactly why a rule change now means hunting through every one of them, and why the one you miss is the GPT a producer built in 2024 and never mentioned. A skill pulls the Constraints out into a single file the whole crew reads. Change the file and every assistant that reads it has the new rule the next time it runs. It's the car clock, finally connected to something.
Of the eight skills I'd have an insurance agency build first, the Medicare marketing copy reviewer is the one this rule change makes urgent. It reads every outbound Medicare draft before a person does. It checks that the disclaimer is there where it's required and that it's the current wording, that a call script doesn't reach benefits before the disclaimer, and that nothing reads like a plan recommendation. Then it hands the draft to a named person with its flags attached. It never approves anything. That decision stays with the person whose name is on the license.
Before October 15
The car clock is a small thing right up until the morning you trust it and walk into a meeting an hour late. An outdated prompt fails the same way. It looks fine for months, because it was right on the day you set it, and then it's wrong in front of a beneficiary during the busiest week of your year.
The quiet days before AEP are short this year, and this is a good use for one of them. If you want prompts built for the season itself, the AEP Prompt Book walks through it chapter by chapter, from the ANOC weeks to December 8th. Run whatever you take from it past your reviewer and your FMO's current templates first, the same as everything else your crew writes this fall.
Frequently asked questions
Does the disclaimer have to go on emails my AI assistant drafts? If your agency sells for more than one MA organization and the email goes to a beneficiary, yes, as of October 1. The rule covers email, online chat and other electronic communication, and it doesn't care who or what wrote the message. If you represent a single MA organization, this disclaimer requirement doesn't apply to you, though your carrier's own rules still do.
Did CMS create any rules specifically for AI? No. It asked for comment on AI in the November 2025 proposed rule and left AI out of the final marketing provisions. That also means there's no separate, lighter standard for AI-drafted material. Every existing rule applies in full.
Can we keep an AI-generated transcript instead of the call recording? Not for the first three years, which have to be audio. For years four through six, a complete and accurate transcript is allowed. A meeting summary or a set of AI notes doesn't count as one.
Is a Scope of Appointment still good for 12 months? Yes, and that part didn't change on October 1. If your scheduling assistant already treats a signed scope as valid for a year, leave that logic alone. Only the 48-hour wait came out.
The Skills series
Every post in the series on custom GPTs, Gems and skills, in the order it ran.
- OpenAI Is Retiring Custom GPTs. Here's the Official Record.
- How to Migrate a Custom GPT to a Skill (ChatGPT or Claude)
- On ChatGPT Plus? Your Custom GPT Options After December 11
- Skills vs Projects vs Connectors vs Plugins, Explained for Agency Owners
- 8 AI Skills Every Insurance Agency Should Build First
- Your Medicare AI Prompts Are Still Running Last Year's Rules (you're here)
- Before You Install That AI Skill, Run This Checklist
- Google Is Retiring Gemini Gems. Here's What Moves to Skills, and When.
