In brief
- Regulation: AI Act.
- Insurers are concerned as deployers and, if they develop their own models under their own brand, as providers.
- Classify systems.
- Mastering data and biases.
- Document and assess.
- Up to €35M or 7% of turnover for prohibited practices and €15M or 3% for high-risk non-compliance, in addition to GDPR risk relating to health data and profiling.
Regulatory deadlines
The key dates of this regulation.
August 2024
Entry into force
In forceFebruary 2025
Ban on prohibited practices
In forceAugust 2025
General-purpose AI models (GPAI) & governance
In forceAugust 2026
High-risk system obligations (Annex III)
In forceAugust 2027
High-risk embedded in products (Annex I)
UpcomingWhat does the AI Act cover?
The AI Act classifies, in its Annex III, risk assessment and pricing with respect to natural persons in life and health insurance as high-risk. High-risk systems carry obligations relating to risk management, data quality, transparency, human oversight, and robustness.
Fraud detection is expressly excluded from this category; internal uses fall under lighter regulatory regimes.
Is the 'Insurance' sector affected?
Insurers are involved as deployers and, where they develop their own models under their own brand, as providers. Life and health pricing for natural persons is the emblematic high-risk use case.
Non-life lines or conversational use cases most often fall under lighter regimes, but remain subject to GDPR.
Detailed obligations
Classify systems
Mapping AI uses and isolating high risk (life/health pricing).
Control data and biases
Ensuring data quality and representativeness and controlling for bias, a central challenge in avoiding discrimination.
Document and assess
Build the technical documentation and carry out the conformity assessment.
Ensuring human oversight
Enable effective human oversight of pricing and underwriting decisions.
Inform policyholders
Ensure transparency on AI usage, in conjunction with the GDPR.
Sanctions & risks
Up to €35M or 7% of turnover for prohibited practices and €15M or 3% for high-risk non-compliance, in addition to GDPR risk relating to health data and profiling.
A biased pricing model exposes organisations to penalties and a discrimination risk with serious consequences.
Application timeline
- 1Entry into force. 1 August 2024.
- 2High risk. Main obligations from 2 August 2026 for life/health insurance pricing.
Common mistakes in the sector
- 1High risk not identified. Treating life/health pricing as an ordinary use case.
- 2Uncontrolled biases. Ignoring biases, a source of discrimination and non-compliance.
- 3Cumulative GDPR forgotten. Failing to align the AI Act and GDPR on health data and profiling.
- 4Superficial oversight. Displaying oversight with no real means of influencing the decision.
Practical case
A health insurer deploys a pricing model based on underwriting data. Classified as high-risk, it requires documentation, bias control, and human oversight. The insurer aligns these requirements with the GDPR exception for health data and the obligation to inform policyholders about profiling, addressing both regulations together.
Compliance roadmap
- 1
Inventory. Inventory AI use cases (pricing, underwriting, fraud, claims, customer relations).
- 2
Qualify. Isolating high-risk systems (life/health pricing).
- 3
Strengthen reliability. Addressing data quality and biases.
- 4
Document. Producing technical documentation and conformity assessment.
- 5
Frame. Implementing oversight and information measures, coordinated with GDPR.
Frequently asked questions
In life and health insurance, with regard to natural persons, yes. Fraud detection is excluded from this category.
Take action on AI Act
Free assessment or a chat with an expert dedicated to insurance.
They already trust us
See how organisations in the insurance sector secured their compliance with DCO.