German insurers' compliance teams can use AI agents to run the compliance monitoring plan, assemble files for premium adjustments in private health insurance, keep outsourcing and ICT registers current for DORA, and check customer letters against policy terms. Decisions on premiums, outsourcing, reportable incidents and remediation stay with named people, supervised by BaFin and shaped by the EU AI Act.
What does a German insurance compliance team spend its time on?
German insurers operate under BaFin's prudential and conduct supervision, within the EU's prudential framework for insurers, with a compliance function that is one of the key functions every insurer must have. That function advises management, monitors compliance with the law, assesses the effect of legal change and identifies compliance risk. Much of the daily work is the monitoring plan: testing processes against requirements on a set schedule.
Some German features add specific load.
Private health insurance premiums. Premium increases in private health insurance follow statutory rules, require supporting calculations and need sign-off from an independent trustee before they apply. Customers must receive letters explaining the change and its reasons. Courts have examined whether those letters were adequate.
Outsourcing. Insurers outsource significant functions, from claims handling to IT, and must notify BaFin of certain outsourcing and keep oversight. Under DORA, ICT arrangements need their own register.
Complaints and the ombudsman. Customers can take disputes to an independent insurance ombudsman, and complaint handling must meet supervisory expectations.
Employee co-determination. Where systems can monitor staff, works councils have rights, which affects agents reading claims handlers' work.
Where can AI agents help?
Depth limits how far an agent may act: 1 reads, 2 drafts for a person, 3 executes routine work within bounds.
- Monitoring plan execution (depth 2). For each scheduled test, the agent pulls the sample, checks it against the requirement and drafts the test result with evidence attached. The compliance officer reviews and concludes. For the concept itself, see what is compliance monitoring.
- Premium adjustment file assembly (depth 2). The agent gathers the calculation documents, trustee correspondence and draft customer letters for each tariff, and checks that each letter states the reasons and the factors the law requires.
- Outsourcing and ICT register (depth 2). The agent reads new contracts and supplier changes, drafts register entries, and flags arrangements that may need notification to BaFin.
- Customer letter checks (depth 1). The agent compares claims and policy letters with the policy terms and flags statements that do not match the contract.
- Legal change tracking (depth 2). The agent reads new BaFin circulars, EIOPA publications and EU texts and drafts impact notes for affected business areas.
The premium adjustment file is the most Germany-specific use. The volume of tariffs, the formal requirements on letters and the legal exposure if letters fall short make it a strong candidate.
What stays with people?
Premium decisions. Whether and how much to adjust premiums, and the trustee's approval, are decisions for actuaries, the trustee and management. A compliance agent never computes or sets a premium. The broader question is covered in can an AI agent set insurance premiums.
Underwriting. A compliance agent does not accept or decline risks. Whether any agent should underwrite is discussed in can an AI agent underwrite an insurance policy.
Outsourcing notifications and incident reports. Notifying BaFin and classifying major ICT incidents under DORA are decisions with deadlines and accountability.
Monitoring conclusions. The agent drafts results. The compliance officer decides whether a test passed and what remediation follows.
Anything affecting staff. Where the agent reads claims handlers' files, its use needs agreement with the works council.
Which rules apply in Germany?
BaFin supervises insurers for prudential and conduct matters. It expects clear accountability for algorithm-based decisions and for outsourced functions, and its supervisory practice applies to agents as to any other process.
EU AI Act (Regulation (EU) 2024/1689). Entered into force on 1 August 2024, with obligations phasing in. Annex III lists risk assessment and pricing in relation to natural persons for life and health insurance as high-risk, which reaches private health insurance pricing directly. A compliance agent that reads and drafts is not itself doing this. Deployers of high-risk systems carry Article 26 obligations, and certain deployers must carry out an Article 27 fundamental rights impact assessment. Article 14 human oversight and Article 12 logging set the standard for pricing systems. See the EU AI Act and AI agents in insurance claims.
DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025: ICT risk management, incident reporting, resilience testing and third-party risk. An agent's provider is an ICT third party.
GDPR. Applies to policyholder and claims data, with health data treated as special category. Article 22 restricts decisions based solely on automated processing with significant effects. Article 35 impact assessments are likely for health data at scale.
EIOPA promotes consistent supervision across the EU, including on governance of AI.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
How to start in the first 90 days
Weeks 1 to 4. Add the agent's provider to the DORA register and assess whether the arrangement needs notification. Brief the works council if the agent will read staff work. Choose the customer letter check for one product line.
Weeks 5 to 8. Replay the agent against letters sent over the past year where complaints or ombudsman cases followed. Check that it flags the statements those cases turned on.
Weeks 9 to 13. Run it live on outgoing letters at depth 1. Begin the premium adjustment file assembly for the next adjustment round. German payment firms answer to BaFin too, with different risks; see compliance agents in German payments. The guide to AI compliance agents explains the principle.
Questions people ask
Is a private health insurance pricing agent high-risk under the EU AI Act?
Pricing for natural persons in health insurance is listed in Annex III as high-risk, so a pricing agent is likely to fall within it. A compliance agent that only reviews files is not.
Can an AI agent write premium adjustment letters?
It can draft them and check them against the required content. The final text is approved by people who stand behind the reasons it gives.
Does BaFin need to be told about a compliance agent?
That depends on whether running the agent is an outsourcing arrangement requiring notification. Assess it under your outsourcing policy and DORA register, and record the outcome.