For a risk manager at an Irish insurer, AI agent training means three things: knowing how depth is earned and lost, so you can challenge an agent's certification; mapping agents into DORA's ICT risk framework and the EU AI Act's deployer duties; and evidencing staff literacy to the Central Bank of Ireland. Risk acceptance and board reporting stay human.
What does an insurance risk manager in Ireland actually do?
Dublin hosts insurers and reinsurers that write business across Europe from a single licence, alongside domestic motor, home and health carriers and a cluster of captives. That shapes the second line. A risk manager here deals with cross-border conduct exposure, complex intragroup outsourcing, and a supervisor that expects the Irish entity to own its risks rather than defer to a parent abroad.
The routine is familiar: the risk register and appetite statements, operational risk events, emerging risk reviews, outsourcing oversight, the own-risk and solvency assessment, and reporting to the board risk committee. DORA has added a layer of ICT risk management, incident classification and third-party oversight that now sits partly with the risk function.
Where do agents enter the picture?
Agents arrive first in claims and underwriting, then in the risk function itself. The risk manager needs a view of both.
- In claims, depth 3 to 4. An agent that triages and settles small property claims within bounds is acting at depth 3; one that releases payments is at depth 4 and its payments should be held above the insurer's own limit.
- In underwriting, depth 2. Agents that draft quotes and referral notes from broker submissions. Submissions are external evidence and the agent must treat them that way.
- ICT incident classification, depth 2. In the risk function, an agent drafts the classification of an ICT incident against the insurer's DORA criteria, with the evidence attached, and a person confirms it before any report is made.
- Third-party register maintenance, depth 1 to 2. The agent reads contracts and supplier attestations and drafts updates to the register of ICT third-party arrangements, flagging missing clauses.
- Emerging risk scans, depth 1. The agent reads internal incident and complaint data and summarises patterns for the quarterly review.
What should risk managers learn, and what do they keep?
The core skill is challenge. A risk manager should be able to open an agent's certificate and ask the right questions: which of the seven gates came closest to its floor, how many cases the replay drew from Irish business versus the rest of the book, what the stable gate showed. They should know that depth is earned, not configured: the role sets a ceiling, the evidence sets the depth, and the lower one wins. And they should know that a run that clears no depth drops the agent to depth 1 the same day.
The second skill is turning findings into lasting change. When a risk review finds that the claims agent treated a broker's emailed loss estimate as if it were the adjuster's report, the fix belongs in the agent's sources and bounds, not in a memo. Our guide to teaching risk managers to bank corrections explains how.
What stays with the risk manager and the board:
- setting and changing risk appetite;
- accepting residual risk where a control is weak;
- classification of a major ICT incident for reporting;
- the risk opinion on any new agent use or depth increase.
The case for this division is in why risk managers are the real control.
Which rules in Ireland shape oversight and literacy?
The Central Bank of Ireland supervises insurers, with EIOPA setting supervisory convergence across the EU. An agent that settles claims is part of the control environment the Central Bank supervises, and the people who oversee it should be able to explain how it decides.
The EU AI Act applies as a regulation. Annex III lists risk assessment and pricing in life and health insurance as high-risk, so insurers using agents there face the full set of deployer obligations under Article 26, including human oversight by competent people under Article 14 and, for certain deployers, a fundamental rights impact assessment under Article 27. Article 4 requires AI literacy among staff, which applies to every line, not just high-risk ones. Article 12 record-keeping is met in substance by an append-only record of every verdict.
DORA applies to insurers from 17 January 2025 and requires ICT risk management, incident reporting, resilience testing and oversight of ICT third parties. An agent platform is an ICT third-party service and belongs in the register. GDPR governs policyholder data, with health data treated as special-category data, and the Data Protection Commission enforces it. Article 22 matters wherever an agent's output leads to a decline without a person deciding.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
What does a 90-day training plan look like?
| Weeks | Who | Outcome |
|---|---|---|
| 1 to 3 | Whole risk function, claims and underwriting heads | Shared vocabulary; inventory of every agent with its depth, certificate and lapse date |
| 4 to 6 | Risk managers | Map each agent to DORA third-party and incident processes; challenge one certificate end to end |
| 7 to 9 | Approvers in the risk team | Operator exam; daily review of held items |
| 10 to 12 | Approvers | Two-week practicum; board paper on agent oversight and literacy evidence |
The training plan template for risk managers gives a format you can adapt. The wider role map is in AI agent skills by role.
Where the Academy fits
Pryme Intelligence Academy gives an Irish insurer an evidence trail for Article 4. Foundations is free and tested in insurance. Risk managers who approve held actions take the Operator track; those who lead multi-agent deployments across the group can go on to Certified Pryme Architect, which includes a board review with two Pryme assessors and lasts 24 months. The admin view shows every certificate and expiry.
Questions people ask
Is an agent platform a critical ICT third party under DORA?
That depends on what the agent supports. If it supports claims settlement or another critical function, treat the arrangement with the care DORA requires for critical or important functions, and confirm the classification with counsel.
How should the risk function report agent risk to the board?
Report which agents act, at what depth, which certificates lapse in the coming quarter, and which held actions waited longest. Boards understand that picture faster than a list of models.
Does a reinsurer face the same Annex III exposure?
The Annex III listing concerns life and health risk assessment and pricing of natural persons. A reinsurer's exposure depends on what its agents do; ask counsel before assuming it falls outside.