Only for life and health insurance. Annex III of the EU AI Act lists AI systems used for risk assessment and pricing in relation to natural persons for life and health insurance as high-risk. An agent pricing those policies for individuals is a high-risk system. Motor, home and commercial cover are not in that listing.
What exactly falls in the listing?
The Annex III entry has three elements, and all must be present:
- Life or health insurance. Term life, whole of life, critical illness, private medical and similar products. Motor, home, pet and commercial lines are outside it. Mixed products, such as travel cover with a medical element, need a reasoned decision.
- Natural persons. Pricing a group scheme for a company's staff needs analysis, since individuals' data may still drive the price; pricing purely on company-level data is a different case.
- Risk assessment or pricing. Underwriting decisions, loadings, exclusions and premiums all count. Answering a policyholder's question about their existing premium does not.
The detail of the listing is examined in EU AI Act Annex III life and health insurance pricing and AI agents, and the general test in is an AI agent a high-risk AI system under the EU AI Act.
This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.
Who carries the duties, and what are they?
The provider of the agent carries design duties: risk management, data governance, automatic logs, information to deployers, human oversight by design, and accuracy, robustness and cybersecurity (Articles 9 to 15). The insurer deploying it carries Article 26 duties: follow the instructions for use, assign competent human oversight, monitor the agent and keep its logs. Deployers using AI to assess risk and price life and health insurance must also carry out a fundamental rights impact assessment under Article 27 before use.
Health data is also special category data under GDPR, so the data protection side runs in parallel.
Why does an agent raise the stakes compared with a rating model?
A rating model applies factors to a completed application. An agent conducts the application. It decides which follow-up questions to ask, reads medical reports and GP letters, interprets an applicant's free-text answers, and proposes loadings or exclusions. Each step can change the price. Two consequences follow:
- Oversight must cover the questions, not only the price. An agent that asks some applicants more health questions than others can produce unequal outcomes before any price is set.
- Records must show reasoning. If an applicant is loaded for a condition, the insurer must be able to show what the agent read and why it concluded what it did.
What may the agent do, and what stays with a person?
| Step | Agent | Stays with a person |
|---|---|---|
| Collect application answers | Asks set questions; flags gaps | Changes to the question set |
| Read medical evidence | Summarises with citations | Interpretation of complex or unclear evidence |
| Apply standard rates | Within approved tables | Any loading, exclusion or decline |
| Explain the outcome to the applicant | Drafts the explanation | Approves it for adverse outcomes |
| Handle a challenge | Gathers the file | Underwriter review |
An illustrative example
Take a life insurer in the Netherlands using an agent for protection policies. Applications with no disclosures go through at standard rates, issued by the agent. Any disclosure triggers a summary of the medical evidence, a proposed loading and a hold for an underwriter.
During its fundamental rights impact assessment, the insurer tests the agent on past applications and finds it asks more follow-up questions of applicants who write in less formal language. That pattern could lead to unequal treatment. The insurer fixes the agent to a set question tree, re-tests and records the result. The underwriting team, now spending its time only on disclosures, is trained on the agent's known weaknesses under Article 4.
Which controls meet the high-risk duties?
- A classification record per product line, with mixed products reasoned through.
- Fixed question sets and approved rating tables the agent cannot depart from.
- Holds on loadings, exclusions and declines for named underwriters.
- Logs and source trails for every application.
- An Article 27 assessment before use, repeated on material change.
- Outcome monitoring across groups of applicants.
For comparison, see whether a credit scoring agent is high-risk and whether a customer support chatbot is high-risk. The concept is explained in what a high-risk AI system is, and the full map is in AI agent regulation, mapped to controls.
Questions people ask
Is a motor insurance pricing agent unregulated, then?
No. It is outside this Annex III listing, but insurance conduct rules, data protection law and Article 50 transparency, if it interacts with people, still apply.
Does a claims agent in health insurance count as pricing?
Claims handling is not risk assessment or pricing. A health claims agent is not high-risk under this entry, though it handles special category data and needs strong controls.
Can an agent issue standard-rate policies automatically?
Yes, if the oversight design is sound and the deployer duties are met. Most insurers allow it for clean applications and hold anything that changes the price.