AI governance for insurance companies
Insurance companies already have model governance processes, making adaptation more an extension than a new build. The sensitive point is that Annex III of the AI Act directly affects the core of the business: risk assessment and pricing.
The regulatory framework
- AI Act, Annex III: risk assessment and pricing in life and health insurance are classified as high risk
- IVASS regulations on governance and internal controls
- EIOPA guidance on the ethical use of data and models
- GDPR, with particular attention to health data
- ISO/IEC 42001 as a management framework
Use cases and their risk level
| Use case | Classification | Note |
|---|---|---|
| Life and health pricing | High risk, Annex III | Full obligations, including human oversight and technical documentation |
| Underwriting risk assessment | High risk for life or health | Purpose determines the classification |
| Automated claims management | Assess case by case | Relevant when it affects entitlement to a benefit |
| Claims fraud detection | Assess case by case | Consider the effects on the individual |
| Assistants for agency networks | Limited risk | Article 50 transparency obligations |
Where to start
- 1Map the actuarial models already in use and establish which fall within the definition of an AI system, which is broader than commonly assumed
- 2Extend existing model governance to cover data, traceability and human oversight requirements instead of opening a separate workstream
- 3Review the supplier chain, because many pricing models come from third parties and the contractual role must be defined in advance
What we do for the sector
The path is always the same and the content changes: it starts from the use case map, assesses impact before investing, validates with a prototype, and only then reaches production. Rapid prototyping runs through protot.ai, our validation unit.
Use case definition
We start from the map of systems already in use, including actuarial models that fall within the regulation's definition, and build the portfolio of candidate use cases across pricing, claims, fraud and network support. Each entry carries its risk class and the company's role.
Impact assessment
We assess economic impact and impact on people, particularly sensitive in life and health lines because of the data involved. Where an actuarial validation process already exists we extend it rather than duplicate it, because that process has been tested by a supervisory authority.
Prototyping and validation
With protot.ai we validate the hypothesis on a contained perimeter before full investment. In claims, that means verifying on real files how much the system actually reduces handling time, against a baseline measured before starting.
Production and oversight
Moving to production touches policy and claims systems, the part pilots almost always underestimate. We support integration, decision traceability, human oversight and documentation, with a system owner in the technical function rather than in IT.