Insurance sector compliance: GDPR, AI Act, DORA & NIS2

Why the 'Insurance' sector is concerned

Insurance handles personal data at scale and, across many lines of business, health data: underwriting questionnaires for life and borrower insurance, claims data, and medical information. This data falls under the GDPR's special category regime, the processing of which is prohibited except under strictly framed exceptions.

AI is at the heart of the business: actuarial pricing, automated underwriting, fraud detection, and claims management. The AI Act expressly classifies risk assessment and pricing in life and health insurance, with respect to natural persons, among high-risk use cases — carrying the heaviest obligations. Fraud detection is excluded from this classification, but remains subject to GDPR.

As a financial entity, an insurer falls under DORA for its digital operational resilience. NIS2, which also covers the financial sector, applies on a residual basis: DORA, as the sector-specific instrument, prevails for ICT risk management and incident notification.

DORA — the insurer's operational resilience

Insurance and reinsurance companies are financial entities fully subject to DORA since 17 January 2025: ICT risk management, incident management and reporting, resilience testing, management of third-party ICT providers via an information register, and information sharing.

A proportionality principle modulates obligations according to size and risk profile.

Key obligations

• ICT risk management framework steered by senior management.
• Classification and notification of major ICT incidents.
• Resilience testing programme.
• Information register and contractual governance of ICT providers.

AI Act — high-risk life and health pricing

Risk assessment and pricing in life and health insurance, when applied to natural persons, are classified as high risk by the AI Act. The systems concerned carry heavy obligations: risk management, data quality and representativeness, bias control, human oversight, and documentation.

Fraud detection is excluded from this classification in the same way, but remains subject to GDPR; internal or conversational uses fall under lighter regimes.

Key obligations

• Classify systems (life/health pricing = high risk).
• Data quality and bias control.
• Human oversight and policyholder information.
• Technical documentation and conformity assessment.

GDPR — health data and profiling

The insurer is the data controller for data that is often sensitive: health data in borrower insurance, provident and supplementary health cover. It must identify an exemption for processing health data, govern profiling and automated decision-making, and maintain control over retention periods and security.

Certain practices (medical questionnaires) are also governed by national sector-specific rules.

Key obligations

• Legal exception for the processing of health data.
• Governance of profiling and automated decision-making.
• Tailored retention periods (claims, contracts).
• High-level security and traceability.

NIS2 — financial sector, articulated with DORA

The financial sector, including insurance, falls within the scope of NIS2. However, for ICT risk management and incident reporting, DORA takes precedence as the sector-specific regulation. NIS2 retains residual application; the key challenge is to articulate both frameworks without duplicating measures.

Key obligations

• Understanding the NIS2 / DORA interplay (DORA prevails for ICT).
• Consistency of security measures with DORA.
• Coordination of incident notifications.

Comparative overview of regulations

How these regulations interact

Two structural articulations govern an insurer's compliance. First, NIS2 / DORA: DORA, as the sector-specific regulation, takes precedence for ICT risk management and incident notification by financial entities; the insurer therefore structures its resilience around DORA and applies NIS2 only on a residual basis.

Next comes GDPR / AI Act, particularly prominent in insurance: life and health pricing combines sensitive personal data (health) — thus a GDPR exception, along with disclosure requirements and profiling controls — and a high-risk system within the meaning of the AI Act (data quality, bias management, human oversight, documentation). Both regulatory regimes must be addressed jointly, or the risk of uncontrolled discrimination will remain.

Application timeline

• 1DORA. Applicable since 17 January 2025.
• 2GDPR. In force; vigilance required on health data and profiling.
• 3AI Act. High-risk: Main obligations from 2 August 2026 for life/health insurance pricing.
• 4NIS2. Residual application, DORA taking precedence for ICT risk.

Applicable penalties

The regimes are cumulative: GDPR up to €20M or 4% of global turnover, AI Act up to €35M or 7%. DORA falls under a prudential regime (supervisory and sanctioning powers of authorities, periodic penalty payments for critical providers). NIS2 provides for up to €10M or 2%, but its application is residual in the insurance sector.

The sector-specific risk lies in health data and pricing: a bias in a pricing model may simultaneously constitute a breach of the AI Act, a GDPR violation, and a discriminatory practice.

Compliance roadmap

• 1Structuring resilience around DORA. Build the ICT risk management framework, incident classification and vendor register, articulating NIS2 on a residual basis.
• 2Mastering high-risk AI. Identify life/health pricing systems and deploy risk management, data quality, bias control, oversight and documentation.
• 3Securing health data. Frame the GDPR exception, hosting, profiling, and retention requirements for health data.
• 4Addressing GDPR and AI Act together. Align information requirements, profiling, and high-risk obligations around pricing and underwriting.
• 5Steer at management level. Embed resilience and compliance at board level, in line with prudential requirements.

How Data Comply One supports the sector

Data Comply One covers GDPR, AI Act, NIS2 and DORA on a single platform, with outsourced DPO and CISO — the full spectrum of insurance regulatory requirements. The integrated approach streamlines the NIS2/DORA interface and the joint management of GDPR/AI Act overlap in pricing use cases.

DCO offers templates tailored to financial entities and health data (ICT third-party register, incident procedures, health DPIA, AI Act documentation for pricing).

Frequently asked questions