GDPR Article 22 and training reviewers for meaningful human review in insurance claims

Insurers using AI agents on claims must watch GDPR Article 22 wherever the agent decides alone. Paying a small claim automatically is rarely a problem. Denying a claim, cutting a settlement or referring a policyholder for fraud investigation can significantly affect them. Claims handlers must be trained to review those decisions and overrule the agent when the evidence says so.

What does Article 22 require of a claims operation?

Under Article 22, a person has the right not to be subject to a decision based solely on automated processing, including profiling, with legal or similarly significant effects. Insurers may make such decisions if necessary to perform the insurance contract, if authorised by law with safeguards, or with explicit consent. Under the contract and consent routes, the policyholder must at least be able to obtain human intervention, express their view and contest.

Claims decisions are often contractual, so insurers may argue necessity for some automated handling. That argument is strongest for fast payment of simple claims and weakest for denials. Adverse claims decisions usually involve judgement about policy wording, evidence and circumstances, which is exactly where a person adds most.

Health, life and income protection claims add special category data. Article 22 restricts solely automated decisions based on health data to cases with explicit consent or substantial public interest under law, with suitable safeguards. Most insurers will want a person on every adverse health-related claim decision.

Which claims decisions are significant?

• Denial of a claim in whole or part.
• Settlement amount, where the agent's valuation sets what the policyholder receives.
• Fraud referral to a special investigations team, which delays payment and can lead to cancellation.
• Total loss and repair decisions on motor and property claims.
• Policy avoidance or cancellation following a claim.

Automatic payment of a valid claim in full is the least likely to be significant in an adverse sense, though insurers should still sample it.

Who does it apply to?

Insurers, managing agents, claims administrators and outsourced handlers acting on individuals' claims. Reviewers in scope are claims handlers, team leaders with settlement authority, loss adjusters relying on agent-prepared files, special investigations staff and complaints teams. The case for certifying claims handlers before AI agents go live argues that competence should be shown before release rights are granted, not after.

What makes claims review meaningful?

The test in what meaningful human review is has three parts: authority, competence and information. In claims these translate as follows.

Authority. Handlers need settlement and decision authority matched to the claims they review. A handler who can approve up to a low amount cannot meaningfully review an agent's denial of a larger claim. Route by value and type.

Competence. Handlers must understand policy wording, the agent's reasoning, and the agent's limits. An agent that reads a policy exclusion literally may miss how the insurer applies it in practice, or how a court has read similar wording.

Information. Handlers must see the agent's evidence and reasons, not only its recommendation. That includes the provenance of each fact. A repair estimate from an approved garage is signed. A policyholder's description of events is declared. Photos sent by email are external until checked for tampering.

Set agent capabilities accordingly. At depth 1 it reads the claim and policy. At depth 2 it drafts an assessment and a decision letter. At depth 3 it may pay simple claims within limits the insurer has set, once certified on the insurer's own past claims. Paying above those limits is depth 4 money movement and held for a person. Denials, reduced settlements and fraud referrals are held for a named handler every time.

What must claims handlers be trained to do?

1. Test each reason in the agent's assessment against the policy and the evidence.
2. Read exclusions in context, not literally.
3. Weigh evidence by provenance, and check external documents.
4. Treat a fraud indicator as a reason to investigate, not a finding.
5. Recognise vulnerable policyholders, especially after bereavement, injury or loss of a home.
6. Overrule the agent when warranted and write down why.
7. Re-decide contested claims on the policyholder's new evidence.
8. Sample automatic payments for leakage and for unfair outcomes.

How do you meet it and show it?

What will a supervisor or auditor ask?

• Which claims does the agent pay, deny or refer without a person?
• Show us denied claims: who reviewed them, and with what authority?
• How do handlers treat fraud indicators from the agent?
• What happens to health claims?
• How often do handlers overturn the agent?
• What training and assessment did these handlers complete?

The audit method is set out in how auditors test that AI agent reviewers are qualified.

What does Article 22 not cover?

It does not set claims handling standards, which insurance conduct rules do, with EIOPA coordinating supervision across the EU. It does not apply to claims decisions a person meaningfully makes. It does not cover underwriting and pricing directly, though risk assessment and pricing for life and health insurance are listed as high-risk under Annex III of the EU AI Act, which brings separate oversight duties. Compare review in customer support and credit decisions. The guide to AI literacy and certification covers training for reviewers generally.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.