AI agent training for risk managers in insurance in Brazil

Brazilian insurance risk managers need training that lets them set and test an agent's bounds, not just watch its output. That means understanding depth, the minimum chain and the record, putting claims payouts by Pix behind held approval, and answering SUSEP and the ANPD on how agents are overseen under the LGPD. Risk appetite stays with people.

What occupies an insurance risk manager in Brazil?

The second line at a Brazilian insurer sits between three pressures. SUSEP expects a functioning risk management structure, with operational, underwriting and conduct risks identified, measured and reported. The business wants speed in motor, health and life products where competition is fierce. And fraud is a constant: staged motor accidents, inflated repair invoices and identity misuse in digital sales.

Day to day, risk managers maintain the risk register and control library, run control self-assessments with the business, log and analyse loss events, review new products and outsourcing arrangements, and prepare reporting for the risk committee and board. More of the business now runs on digital channels and instant payments, which compresses the time between a bad decision and a loss.

Where do agents change the risk manager's work?

Agents enter both the business the risk manager oversees and the risk function itself. In the risk function, four uses are realistic:

1. Loss event capture, depth 2. The agent reads claims, finance and incident systems, drafts a loss event entry with cause, amount and affected control, and a risk analyst approves it. This alone closes a common gap: events that never reach the register.
2. Control testing evidence, depth 1. The agent gathers the samples and system extracts a control test needs and lays them out against the test steps. A person concludes on whether the control works.
3. Key risk indicator reporting, depth 2. The agent computes indicators from sealed sources, such as the policy and claims systems, and drafts commentary. The risk manager edits the narrative before it goes to committee.
4. Third-party questionnaires, depth 2. For each outsourcing review, the agent compiles the supplier's answers and flags gaps against the insurer's requirements.

In the first line, the risk manager's job is to decide how far business agents may go. A claims agent that pays out by Pix is acting at depth 4: the money moves in seconds and is hard to recover. The risk manager should insist those payouts are held for a named approver above a low threshold, and that a payee name or account taken from an emailed repair invoice, which is external evidence, can never authorise a payment.

What does the risk manager need to learn, and what stays theirs?

Three capabilities matter. First, reading the record: every verdict names the bound that decided it, and a risk manager should be able to reconstruct any decision from the append-only record without asking IT. Second, judging certification evidence: when an agent is certified to depth 3 on motor claims triage, the risk manager should read what the replay tested, which gates were close to the floor and when the certificate lapses. Third, setting limits: the customer's own limits are where the insurer narrows what an agent may do, and the risk function should own them.

Our guide to how risk managers review an agent's decisions covers the review routine in detail.

What stays with people:

• risk appetite and tolerance, and any decision to accept a risk outside them;
• conclusions on control effectiveness;
• what goes to the board and to SUSEP;
• the decision to raise or lower an agent's depth when evidence is borderline.

The hard lines are listed in what risk managers should never let an AI agent do.

Which Brazilian rules shape oversight and competence?

SUSEP supervises insurers and expects sound governance, internal controls and risk management proportionate to the business. Agents that make or prepare decisions inside underwriting and claims are part of that control environment, and the people supervising them need demonstrable competence. Board and committee reporting should show where agents act and at what depth.

The LGPD governs the personal data agents read, including health data in life and health lines, which receives stronger protection. It gives individuals the right to request review of decisions made solely on automated processing that affect their interests, so any agent that declines a claim or a policy needs a path to a person. The ANPD enforces the LGPD.

Banco Central do Brasil runs Pix. Its rules on fraud and refunds affect what happens after a mistaken payout, but they do not undo a payment the insurer authorised. That is why the hold matters more than the recovery. If you serve EU policyholders or belong to a group with EU operations, check whether the EU AI Act reaches your work; it lists life and health insurance risk assessment and pricing as high-risk.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

How should the 90 days run?

Days 1 to 30: shared vocabulary. The whole second line, plus claims and underwriting leads, completes foundations training on depth, verdicts and provenance. Risk managers map every agent in scope against its depth and certificate.

Days 31 to 60: controls on paper and in practice. Risk managers set the insurer's own limits for each agent, write the Pix payout hold rule, and test it by replaying last quarter's claims. Those who will approve held actions sit the operator exam. Pryme Intelligence Academy's Operator track fits here, with module tests set in insurance and in the risk role.

Days 61 to 90: proof. Two weeks of logged review decisions on live work, followed by calibration. Build a reviewer rota for the risk team so held items never wait on one person. Report to the risk committee which agents are certified, to what depth, and when each certificate lapses. The full role map is in AI agent skills by role.