Claims handling is not listed as high-risk in the EU AI Act. Annex III names risk assessment and pricing in life and health insurance, not the handling of claims. Most claims agents carry only the lighter duties: transparency and AI literacy. GDPR, conduct rules and the irreversibility of payouts and denials still demand strong controls.
What does the EU AI Act say about insurance, in plain words?
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases. It sorts AI systems into prohibited practices, high-risk systems, systems with transparency duties, and minimal risk. Annex III lists the high-risk uses. For insurance, it names AI used for risk assessment and pricing in relation to natural persons in life and health insurance. It does not name claims handling, motor or property pricing, or fraud detection in claims.
Every AI system, whatever its tier, carries Article 50 transparency duties where they apply, and providers and deployers must take measures for AI literacy under Article 4. For a primer on the Act, see what the EU AI Act is, and for the pricing side, is an insurance pricing agent high-risk.
Who does this affect?
Insurers and claims administrators in the EU, and those outside it whose agents' output is used in the EU. They are usually deployers of claims agents bought from vendors, or providers if they build their own.
Two edge cases can bring a claims agent into the high-risk category. First, if the same agent also performs risk assessment or pricing for life or health cover, for example by re-rating a policy after a claim, that capability is high-risk. Second, Annex III separately lists AI used by or on behalf of public authorities to evaluate eligibility for essential public assistance benefits and services, including healthcare services. A public body, or a firm acting for one, using an agent to decide such eligibility may be in that category. Check both.
What does an agent that acts change in claims?
A claims agent can do far more than score. It can take first notice of loss, request documents, check policy wording, estimate reserves, draft a settlement, flag suspected fraud and, if allowed, pay. The Act's low classification does not make those actions low-impact.
Payouts are money movement. Paying a claim is a depth 4 action: once money leaves, recovering it is hard. An agent that can pay claims needs tight limits and certification, whatever the Act's tier.
Denials are hard to undo for the customer. A wrong denial can leave a policyholder without a car, a roof or treatment while they dispute it. The theme is developed in irreversibility in insurance claims. Denials and partial settlements should be held for a person.
Fraud flags are not findings. An agent's suspicion should route a claim to an investigator, not decline it. A denial based solely on an automated fraud score, with significant effect on the claimant, engages GDPR Article 22.
Health data is special category. Health and income protection claims involve special category data under GDPR, which requires a valid condition for processing and strong safeguards.
Disclosure still applies. An agent that talks to claimants by chat, phone or email must tell them they are dealing with an AI system.
Which controls still matter for claims agents?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Correct classification | Each capability checked against Annex III, including life and health pricing and public benefits | Classification record per capability |
| Transparency (Article 50) | Claimants told they are dealing with an AI agent at first contact | Conversation records |
| AI literacy (Article 4) | Handlers trained on the agent's failure modes and on reading its sources | Training and assessment records |
| No solely automated adverse decisions | Denials and reduced settlements held for a named handler | Held-action records with approver |
| Payout limits | Agent may pay only within certified limits; above that, held | Verdict records naming the limit bound |
| Fraud routing | Fraud flags route to investigators; no automatic decline | Referral records |
| Special category data | Health data reachable only by approved capabilities | Access approvals and DPIA |
| Reconstruction | Every step of every claim recorded | Action record per claim |
For a broader self-check across the Act, see the EU AI Act compliance checklist for AI agents.
What will a supervisor ask?
National insurance supervisors, and EIOPA at EU level, will look at claims agents through conduct and governance as much as through the Act.
- Which claims decisions does the agent make without a person?
- Can the agent decline a claim? Can it pay one, and up to what amount?
- How do fraud flags affect the outcome for the claimant?
- How do claimants learn they are dealing with an AI agent, and how do they reach a person?
- Does any capability re-rate life or health policies?
What does the Act not cover for claims?
It does not impose high-risk duties on most claims agents. It does not replace GDPR, including Article 22 and the rules on health data. It does not replace insurance conduct rules on fair claims handling and complaints. And it does not limit how much autonomy you may give a claims agent; that is your risk decision. Our wider argument on how the Act treats action is in the EU AI Act and agents that act, and the full map is in AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme splits a claims agent into capabilities with their own depth: taking notice of loss can run at depth 3, drafting a settlement at depth 2, and paying at depth 4 only within certified limits. Withheld actions, such as reversing a settled payment on our own rail, stay withheld for every agent.
Questions people ask
Is fraud detection in claims high-risk under the Act?
Annex III does not list claims fraud detection. But using fraud scores to deny claims without human review can breach GDPR Article 22 and fair treatment rules.
Does the Act apply to health insurance claims?
Claims handling is not listed. Risk assessment and pricing for health insurance is, so any capability that prices or re-rates cover is high-risk.
Should claims agents be allowed to pay claims?
They can, within limits certified on your own past claims and with a person holding anything above them. Denials should stay with people.