AI agent training for internal auditors in insurance in France

Auditors at French insurers need enough AI literacy to test agents that price health cover, process reimbursements and search for life insurance beneficiaries. That means reading verdicts, certificates and provenance in the record, and knowing when a use is high-risk under the EU AI Act. The opinion stays with them. The ACPR, CNIL, GDPR and DORA shape the work.

What does an internal auditor at a French insurer spend time on?

French insurance is split between large life and savings books, health complementary cover, and property and casualty. Internal audit follows that mix. In life, auditors test how unit-linked and euro-denominated contracts are administered, how surrender requests are handled, and whether the insurer searches properly for beneficiaries of contracts whose holders have died. In health, they test high volumes of small reimbursements, often paid directly to providers. In property and casualty, the focus is claims leakage and delegated authority.

Auditors also support the board's oversight under the EU prudential regime for insurers, which requires an independent internal audit function, and they prepare for ACPR inspections. ICT has become a standing part of the plan since DORA, including third-party providers that run claims or policy systems.

Where do agents enter the audit universe?

Insurers deploy agents where volume is high and rules are written down. Each new deployment is an audit object, and audit can use agents too.

For its own work, audit can use an agent at depth 1 to test the full population of verdicts in the append-only record, and at depth 2 to draft workpapers that an auditor signs.

What must auditors learn, and what stays with them?

Classification first. Under the EU AI Act, risk assessment and pricing for life and health insurance is listed as high-risk. An auditor must be able to tell whether a given agent falls into that use and, if it does, test the deployer duties that follow. This is a judgement about the use, not the technology, and auditors are often the people best placed to challenge a business view that "the agent only drafts".

Then the mechanics. Auditors should know the minimum chain, in which every action meets role scope, certificate, sources, the insurer's limits and the platform guardrails, and the lowest wins. They should know that depth is earned through Attest and that certificates lapse after 90 days. Our guide to how internal auditors review an AI agent's decisions turns this into test steps.

Provenance is the third skill. A medical invoice received by email is external. A reimbursement table from the policy library is sealed. An auditor should test that no reimbursement above the routine limit rested on external evidence alone.

What stays with the auditor: deciding what to audit, the opinion, the rating of findings, and the conversation with the audit committee. Our piece on whether AI agents will replace internal auditors explains why the role grows with agents rather than shrinking.

Which rules in France shape oversight and literacy?

The EU AI Act applies directly. Article 4 requires AI literacy among staff who operate AI systems. For high-risk uses, Article 26 sets deployer duties, including human oversight by people with the necessary competence, Article 14 describes what oversight must achieve, and Article 12 requires automatic logs. Annex III lists risk assessment and pricing for life and health insurance among high-risk uses.

GDPR governs policyholder data, and health data is special-category data. Article 22 restricts solely automated decisions with significant effects, and Article 35 requires a data protection impact assessment where processing is high-risk. The CNIL supervises data protection.

DORA applies to insurers. Its ICT risk management, incident reporting, resilience testing and third-party risk requirements reach the agents and the provider that runs them. The ACPR supervises insurers in France, and EIOPA sets supervisory convergence across the EU.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How should the audit team train over 90 days?

1. Weeks 1 to 3. All auditors cover the basics of governed agents: depth, certification, the minimum chain, the verdicts and the record. Managers update the audit universe to list every agent and its certified capabilities.
2. Weeks 4 to 7. Two auditors run a pilot audit of health reimbursement checking. They test full populations from the record, certificate currency and approver authority, and log every issue.
3. Weeks 8 to 10. The team reviews whether pricing support is being treated as high-risk, and tests the DORA third-party register entry for the agent provider.
4. Weeks 11 to 13. Write the agent audit programme, agree a rating scale for agent findings, and set a routine for banking corrections to audit's own agent.

Our training plan template for internal auditors gives fields for each step.

Where the Academy fits

Pryme Intelligence Academy offers the Foundations badge free to every auditor, which documents baseline literacy for Article 4. Audit managers who will test high-risk uses gain most from the Operator track, where they learn how held actions are reviewed and recorded. Certificates show their expiry on a public register, which helps auditors check reviewers' credentials.