Start by identifying what the system does: price a policy, assess risk, assist a claims handler or communicate with a policyholder. Those purposes can lead to different obligations and different review needs.
Insurance AI Regulatory Context
Annex III point 5(c) covers risk assessment and pricing for natural persons in life and health insurance. Ordinary claims management is not included in that point merely because it can lead to denial or payment: Commission guidance distinguishes it from risk assessment and pricing. Assess other relevant use cases and Article 6 exceptions separately. Do not classify every insurer's AI system by industry alone.
What Insurance Regulators Ask For
Prepare for review around the actual insurance process and jurisdiction. Assemble decision records, relevant source data, model versions, review decisions and complaint handling; ask the responsible compliance owner which additional sector evidence is required.
Building Audit-Ready Decisioning
Separate the model's recommendation from the decision that changes a policyholder's position. Make the responsible actor and the point of approval visible in both the workflow and its records.
Decision evidence records
Link the decision to the relevant policy terms, source information and system version. Preserve the outcome and any correction, while controlling access to personal or sensitive material.
Explainability for policyholder disputes
Provide a review route that can identify the rule and source behind a disputed outcome. Check that staff can correct an error and explain the actual decision; a plausible model-written explanation is not a substitute for evidence.
Human oversight for high-stakes decisions
Define when a person must review an action, what they may inspect and whether they can stop or override it. Test unavailable-reviewer and incomplete-evidence cases instead of relying on a nominal approval button.
GDPR Article 22 concerns decisions based solely on automated processing that produce legal or similarly significant effects. Its exceptions and safeguards require a separate assessment; legitimate interest alone is not an Article 22(2) exception. Where Article 22(3) applies, safeguards include human intervention, expressing a view and contesting the decision. A nominal human approval does not resolve a workflow that is effectively automated.
The Discrimination Problem in Insurance AI
Choose outcome checks suited to the intended use and lawful access to data. Examine error patterns, proxy variables and affected groups, document limitations and investigate differences before declaring the process fair.
FAQ
Is every claims-handling tool high-risk under Annex III point 5(c)? No. That point concerns life and health insurance risk assessment and pricing. A claims workflow still needs its own privacy, decision-rights and sector assessment.
Review updated 1 October 2026: the AI Omnibus entered into force on 27 July 2026. The high-risk requirements in Chapter III Sections 1-3 apply from 2 December 2027 for Article 6(2)/Annex III systems and 2 August 2028 for Article 6(1)/Annex I systems, subject to the Act's transitional provisions. Other obligations have separate application dates.
EU AI Act: consolidated text, 27 July 2026 | European Commission: AI Omnibus entry into force | GDPR: Regulation (EU) 2016/679 | European Commission AI Act Service Desk: essential services