Insurers become deployers of high-risk AI systems under the EU AI Act when an agent assesses risk or sets prices for individuals in life or health insurance. Article 26 then requires them to give oversight to people with the necessary competence, training and authority. That means underwriters and pricing staff who can read, challenge and overrule the agent.
What does Article 26 require of an insurer?
In substance, a deployer must use the high-risk system according to the provider's instructions; assign human oversight to natural persons with competence, training and authority, and support them; ensure input data it controls is relevant and sufficiently representative; monitor operation, inform the provider of risks and suspend use if a serious risk appears; report serious incidents; keep logs under its control for an appropriate period; inform workers' representatives before using the system at work; and inform people subject to its decisions where required. Some deployers, including certain insurers, also carry out a fundamental rights impact assessment under Article 27 before using these systems.
Whether the insurer or a technology firm is the provider, and what each owes, is covered in who is the provider and who is the deployer of an AI agent.
Which insurance agents are high-risk?
The Act lists risk assessment and pricing in relation to natural persons for life and health insurance as high-risk. An agent that underwrites a life policy application, sets a health premium, or decides acceptance terms for an individual is high-risk for that purpose.
Other insurance work is not listed: motor and home pricing, commercial lines, and claims handling. Those agents may still raise questions under the GDPR, including Article 22 where decisions are solely automated, and under insurance conduct rules, but Article 26's specific duties do not attach to them. Insurers' own recruitment and workforce management agents may be high-risk under the workforce uses.
That boundary shapes the training plan. Life and health underwriters and pricing staff need Article 26 competence first; claims and non-life teams need strong practice but not, in law, the same duty.
What does competence look like in life and health insurance?
Underwriters deciding held applications must read the agent's risk assessment and the evidence behind it. In life and health, evidence varies sharply in strength: a medical report from a treating doctor is signed; answers on the application form are declared; a document the applicant uploads is external until checked. Underwriters must know which class of evidence the agent's decision rests on and when to ask for more. They must recognise where health and lifestyle factors stand in for protected characteristics, and refuse to rely on them.
Pricing staff overseeing an agent that sets individual premiums must monitor outcomes across groups, spot drift after a change in sources, and suspend automatic pricing when results look wrong.
Distribution staff and advisers who present agent-priced quotes must be able to explain the price in plain language and route questions to an underwriter.
Authority means an underwriter can accept, rate or decline against the agent within mandate without a second signature, and that accepting a case the agent would have declined is as easy as declining one it would have accepted.
Training follows the agent. An agent's certificate lapses after 90 days and is renewed against the insurer's real cases; a run that clears no depth drops it to depth 1 the same day, which turns automated underwriting into manual underwriting at once. Underwriting capacity planning must allow for that, and briefings at each renewal must tell underwriters what changed.
How does an insurer meet Article 26's competence duty?
| Requirement | Control | Evidence it leaves |
|---|---|---|
| Identify high-risk uses | Inventory marking life and health pricing and underwriting capabilities | Inventory signed by the underwriting owner |
| Oversight assigned to named people | Named underwriters and pricing leads per product | Assignment register |
| Necessary competence | Assessment on the insurer's own past applications, including seeded errors | Assessment records before approval rights |
| Necessary authority | Underwriting mandates allow overrides either way without extra sign-off | Mandates; override records with reasons |
| Training kept current | Briefing at each agent recertification or change | Briefing records linked to agent changes |
| Monitor and suspend | Pricing leads trained to read outcomes by group and suspend | Monitoring reports; suspension events |
| Inform policyholders | Notices where the Act requires them | Notice templates and records |
The idea of proof that runs through this table is set out in what evidence of competence is, and the definition of the role in what a deployer is under the EU AI Act.
What will a supervisor ask?
National insurance supervisors, working within frameworks coordinated through EIOPA, and market surveillance authorities may ask: which of your agents are high-risk, and how did you decide? Who oversees life and health underwriting decisions, and how were they assessed? Show declines and ratings with the evidence behind them. What are override rates by underwriter? How do you monitor pricing outcomes across groups? When did you last suspend automatic pricing? What did the impact assessment say about human oversight?
What does Article 26 not cover?
It does not apply to non-life pricing or claims, though conduct and data protection rules do. It does not set underwriting or pricing rules, which come from insurance law. It does not prescribe training content or credentials. And it does not shift responsibility to a reinsurer or technology provider whose models the insurer uses under its own authority. Some insurers include external credentials, such as Pryme Intelligence Academy's Operator certificate, in their evidence, but judging competence remains the insurer's job. Comparable treatments are in Article 26 duties in banking and in payments, and the general model in AI literacy and certification for people who work with agents.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Questions people ask
Does Article 26 apply to motor insurance pricing?
Motor pricing is not among the listed high-risk uses, so Article 26's specific duties do not attach. Fair treatment and data protection rules still apply, and the same oversight practice is sensible.
Can an agent accept a life application on its own?
Simple applications within narrow criteria, on strong evidence, can be accepted at depth 3 if the agent is certified for them. Declines, ratings and anything resting on weak evidence should be held for an underwriter.
Who should own the pricing agent?
A named pricing lead with authority to suspend it. Ownership should sit with someone who understands both the pricing and the agent, not only with IT.