Life and health insurance pricing is high-risk under the EU AI Act: Annex III lists AI used for risk assessment and pricing of natural persons in those lines. An agent that reads health disclosures, assesses risk or proposes a premium is inside it. Providers owe the high-risk design duties; deploying insurers owe oversight, monitoring and a rights impact assessment.
What does Annex III say about insurance, in plain words?
The EU AI Act (Regulation (EU) 2024/1689) entered into force on 1 August 2024 and applies in phases; dates for high-risk duties have been subject to proposed changes, so plan on substance. Annex III names uses that are high-risk. One is AI intended for risk assessment and pricing in relation to natural persons for life and health insurance.
The reason is access and fairness. Life and health cover protects families and pays for treatment. A system that prices people out, or prices them on proxies for protected characteristics, can do lasting harm that the person cannot see or easily challenge. The same reasoning puts creditworthiness assessment in Annex III, as explained in Annex III credit scoring and AI agents in lending.
The listing is narrow. Motor, home, travel and commercial insurance pricing are not in it, nor is claims handling. The short answer for pricing agents is in is an insurance pricing agent high-risk under the EU AI Act.
Who has to meet the high-risk duties?
Providers of the agent carry the heavier set: a risk management system (Article 9), data governance (Article 10), automatic logs (Article 12), information to deployers (Article 13), design for human oversight (Article 14) and accuracy, robustness and cybersecurity (Article 15), with conformity work before release. An insurer that builds its own underwriting agent is its provider.
Deploying insurers must use the agent as instructed, assign oversight to competent people, monitor it, keep logs and inform people affected (Article 26). Deployers of systems for life and health insurance risk assessment and pricing must also complete a fundamental rights impact assessment before first use (Article 27).
Why is an agent in underwriting high-risk even when a person signs off?
The Act lets a provider argue that a listed system is not high-risk if it performs only a narrow procedural task or does not materially influence the outcome. That argument is not available for systems that profile natural persons, and an agent that reads an applicant's medical disclosures, lifestyle answers and history to assess their risk is profiling them.
Take an illustrative underwriting agent for income protection cover. It reads the application, requests a medical report where answers suggest it, extracts conditions, applies the insurer's underwriting rules and drafts a decision: accept, load, exclude or decline. An underwriter reviews. The agent is part of risk assessment for a health-related product, and its draft shapes the outcome. It is high-risk.
Agents also create risks a pricing model does not. The agent decides which follow-up questions to ask, so two applicants with similar risk can face different scrutiny. It may draw on sources that act as proxies for protected characteristics. And if it is allowed to issue terms at depth 3, it is setting prices for people without a person in the loop.
How do you meet the duties when the agent is high-risk?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Risk management | Risks per capability: wrong extraction, inconsistent questioning, proxy discrimination, overreach into decisions | Risk register per capability |
| Data governance | Sources defined and checked for relevance, gaps and bias; proxies reviewed | Source register with review notes |
| Automatic logs | Every question, extraction, rule applied and draft decision recorded | Append-only record per application |
| Human oversight | Agent drafts terms at depth 2; trained underwriter decides and can override | Decision records with overrides |
| Accuracy and robustness | Agent replayed on real past applications before release and after change | Certification results with pass floors |
| Fundamental rights impact assessment | Assessment of affected groups and harms before first use | Signed FRIA, updated on change |
| Special category data | Health data handled under a valid GDPR condition with safeguards | DPIA and access controls |
| Information to applicants | Applicants told an AI system is used; reasons available for adverse terms | Notices and reason statements |
What will a supervisor ask?
National insurance supervisors and EIOPA will look at these agents through conduct as well as the Act.
- Which agents take part in life or health underwriting or pricing, and are you provider or deployer?
- Show us the FRIA and the groups you identified as at risk.
- How do you know the agent asks comparable applicants comparable questions?
- What sources does it use, and could any act as a proxy for a protected characteristic?
- How often do underwriters override its draft terms?
What does Annex III not cover?
It does not cover non-life pricing or claims handling. It does not replace GDPR rules on health data and solely automated decisions, or insurance conduct rules. It does not apply outside the EU: a US health insurer faces HIPAA and state insurance regulation instead, as discussed in HIPAA and AI agents handling protected health information. For the full map, see AI agent regulation mapped to controls.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Where Pryme fits
Pryme separates an underwriting agent's capabilities, so reading disclosures can run at depth 1, drafting terms at depth 2, and issuing terms is refused unless certified. Each fact carries its provenance, which separates declared answers from medical reports signed by a clinician, and every step is filed for logging and review.
Questions people ask
Does Annex III cover group life or health schemes?
The listing refers to natural persons. Where an agent assesses or prices individuals within a group scheme, it is likely in scope; where it prices the scheme as a whole, check carefully.
Is critical illness or income protection cover included?
These are life or health-related products in most markets, so agents assessing risk or pricing them for individuals should be treated as in scope.
Can a pricing agent ever run at depth 3?
Only with strong evidence on your own cases and a design that still meets the Act's oversight duty. Most insurers will keep the final terms with an underwriter.