AI agent training for risk managers in insurance in Spain

Spanish insurers' risk managers need training that equips them to challenge an agent's authority: how depth is certified and lost, which actions must be held for a person, and how agents fit the EU AI Act, DORA and GDPR as the AEPD applies it. Health underwriting and pricing are high-risk under the AI Act, which raises the bar for oversight.

What does a risk manager at a Spanish insurer focus on?

The Spanish market has features that shape the second line. Private health insurance is widespread, with insurers running their own provider networks and authorisation processes for treatment. Funeral expenses insurance is a large, long-standing line with policies held for decades and premiums that rise with age. Bancassurance is a major channel, so conduct risk often sits at the boundary between the insurer and a partner bank.

The risk function maintains the risk map, oversees outsourcing to bank partners and service providers, monitors complaints and conduct, runs the own-risk and solvency assessment, and reports to the board and to the national insurance supervisor. DORA has added ICT risk, incident reporting and third-party oversight to the agenda.

How will agents change the work?

Agents tend to arrive in operations first and in the risk function second. The risk manager needs a view of both.

1. Treatment authorisations in health, depth 2 to 3. An agent checks requests from providers against the policy's cover and the network tariff, and authorises routine procedures within bounds. Anything requiring clinical judgement or outside the network is held.
2. Funeral policy servicing, depth 2. The agent drafts premium review letters and beneficiary updates. Changes to beneficiaries are held, because errors here surface only at the worst moment.
3. Bancassurance conduct monitoring, depth 1. The agent reads sales data from bank partners and flags patterns such as policies sold alongside mortgages and cancelled shortly after. A person decides what to investigate.
4. Third-party register upkeep, depth 2. The agent drafts updates to the register of ICT arrangements and flags missing contractual terms.
5. Incident classification, depth 2. ICT incidents drafted against the insurer's DORA criteria, with a person confirming the classification.

Claims payments and premium refunds are depth 4 and held for named approvers.

What should risk managers learn first, and what stays with them?

A good starting point is what risk managers should learn before working with AI agents. For a Spanish insurer, three skills stand out.

First, challenging certification. Attest certifies an agent by replaying it against the insurer's own cases, and each of its seven gates must clear on its own. A risk manager should ask how the replay sample was drawn: did it include health authorisations from every region, and funeral policies with decades of history?

Second, reading held actions. A held beneficiary change waits for a named person. The risk manager should check that the person named has the authority and the certificate to approve it, which is where an approver authority matrix for the risk team helps.

Third, linking agents to DORA. The agent platform is an ICT third-party service, and an agent failure in claims is an ICT incident that may need classifying.

What stays with people:

• risk appetite and tolerance;
• clinical judgements in health authorisations;
• conclusions about mis-selling in bancassurance;
• what goes to the board and the supervisor.

Which Spanish and EU rules shape oversight and literacy?

The EU AI Act applies directly in Spain. Annex III lists risk assessment and pricing for life and health insurance as high-risk, which brings the deployer obligations of Article 26 and human oversight under Article 14 into play for health underwriting agents. Certain deployers must carry out a fundamental rights impact assessment under Article 27. Article 4 requires deployers to ensure AI literacy among staff using AI systems, across every line.

DORA applies to insurers from 17 January 2025: ICT risk management, incident reporting, resilience testing and ICT third-party risk. EIOPA coordinates supervisory practice across the EU, and the national insurance supervisor applies it in Spain.

GDPR governs policyholder data, and health data is special-category data. The AEPD enforces it in Spain. Article 22 applies where an agent's output leads to a decision with significant effects, such as refusing a treatment authorisation, without a person deciding. Article 35 data protection impact assessments are expected for high-risk processing of this kind. Banco de España supervises the partner banks in bancassurance, so some conduct questions will involve both regulators' expectations.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.

A 90-day plan

The broader role map is in AI agent skills by role, and whether agents will replace risk managers answers the question your team will ask.

Where the Academy fits

Pryme Intelligence Academy gives a Spanish insurer a measurable answer to Article 4: Foundations for everyone, free and tested in insurance, then the Operator track for approvers. The practicum requires two weeks of real review decisions with no missed red line. Certified Pryme Operator lasts 12 months, renewed through an update module and a short quiz.