AI Act for insurers: what falls under it and what does not?
On 2 August 2026, the main body of the EU AI Act becomes fully applicable to high-risk AI systems. Part of the regulation has in fact already entered into force earlier: Chapters I and II (definitions and the prohibited AI practices in Article 5) since 2 February 2025, and the penalty provisions, the governance chapter and the rules for general-purpose AI models since 2 August 2025. For insurers, the relevant question is not whether the AI Act applies to them (it does), but which part of their AI portfolio falls under which regime. For some use cases that is clear. For others it is precisely not, and that is exactly where the workload is heading in the coming months.
The framework: four risk levels and Annex III
The AI Act (Regulation (EU) 2024/1689) divides AI systems into four risk levels: unacceptable, high, limited and minimal. High risk is the category with by far the most obligations. Annex III of the regulation lists eight areas within which AI systems can qualify as high risk.
For insurers, Annex III category 5(c) is the most concrete. The regulation describes this use case as AI systems for 'risk assessment and pricing in relation to natural persons in the case of life and health insurance'. There is no room for debate there. These are high-risk systems. Recital 58 substantiates this: this AI can have far-reaching consequences for people's livelihood, fundamental rights and even health.
For personal injury, non-life insurance and general claims AI it is more complicated. These use cases are not explicitly mentioned in Annex III. Whether a specific system qualifies as high risk depends on what the system does, how far-reaching the output is for the customer, and how it is used in decision-making. Personal injury AI quickly enters the compliance risk zone, but does not always fall under it without debate.
Two exceptions that are relevant for insurers. Annex III category 5(b) classifies AI for creditworthiness assessment as high risk, but explicitly exempts AI for fraud detection in financial services. Recital 58 adds that AI systems prescribed by Union law for fraud detection in financial services and for the prudential calculation of capital requirements of credit institutions and insurance undertakings are not considered high risk under this regulation.
Profiling: not what it seems
A frequently heard claim is that profiling by AI automatically results in a high-risk classification. That is not correct. Article 6(3) first subparagraph actually offers an exception for some Annex III systems that do not pose a significant risk to health, safety or fundamental rights. Paragraph 3 third subparagraph adds that a system that performs profiling of natural persons is, notwithstanding that exception, always considered high risk.
In other words: profiling does not make a system high risk in itself. It only closes off the escape route for systems that already fall under Annex III in the first place. For personal injury AI, you therefore first have to establish whether the use case falls under Annex III. Only then does profiling become legally relevant.
Provider versus deployer: different obligations, different stack
The AI Act distinguishes two roles. The provider develops the system or places it on the market. The deployer uses it in its business operations. Many insurers are deployers, because they procure AI through SaaS packages or fraud detection vendors.
The heaviest obligations sit with the provider. Articles 9 through 15 govern risk management, data governance, technical documentation, logging architecture, transparency and the design of human oversight. An insurer that procures a system does not have to deliver this stack itself, but must be able to demonstrate that its supplier has done so.
The deployer has its own obligations under Article 26: use according to instructions, human oversight by competent persons, checks on input data insofar as it is under its own control, monitoring, log retention (at least six months), and providing information to customers where applicable.
For insurers there is an important nuance here. Article 26 paragraphs 5 and 6 contain a specific arrangement for financial institutions subject to governance requirements under Union financial services law. For those deployers, the monitoring and log-retention obligations are deemed to be fulfilled by compliance with that financial services legislation. Insurers under Solvency II fall under this in principle. That does not save any work, but it does save a separate AI Act paper trail alongside what is already running.
FRIA: who needs one and who does not
Article 27 mandates a Fundamental Rights Impact Assessment (FRIA) for deployers of certain high-risk systems. The obligation affects deployers that are bodies governed by public law or private entities providing public services, plus deployers of systems under Annex III category 5(b) (creditworthiness) and 5(c) (life and health insurance). For other insurance use cases, a FRIA is not automatically mandatory. Whether that changes depends on how the specific system is classified.
Practical advice: do not treat the FRIA as a generic compliance step, but record per system whether Article 27 applies. For some systems it is worth carrying one out even when it is not legally required, because it underpins your own risk assessment and ties in with the DPIA obligation under Article 35 GDPR.
The transitional regime of Article 111
A common mistake in publications about the AI Act is assuming that all existing AI systems must sit under the high-risk regime in one go on 2 August 2026. That is not correct. Article 111(2) provides that high-risk systems already placed on the market or put into service before that date only fall under the regime from the moment they undergo 'significant changes in their design' after 2 August 2026.
On paper, that offers breathing room. In practice, that is an illusion. Virtually every actively maintained AI system undergoes changes within one to two years that qualify as 'significant': new training data, model replacements, expanded features. Whoever has it mapped out can plan. Whoever does not will run into the regime at the moment of the next upgrade.
For public bodies, incidentally, a harder deadline applies: their existing high-risk AI must comply by 2 August 2030 at the latest, even without a design change.
The fines
Article 99 sets three tiers with maximums:
• Up to €35 million or 7% of worldwide annual turnover for prohibited AI practices (Article 5).
• Up to €15 million or 3% for non-compliance with obligations for providers (Article 16), deployers (Article 26), transparency obligations (Article 50) and several other provisions (Article 99(4)).
• Up to €7.5 million or 1% for supplying incorrect or misleading information to a supervisory authority (Article 99(5)).
How these maximums are applied in practice (per infringement, per system, or cumulatively) is up to the national supervisory authority. In the Netherlands, the Dutch Data Protection Authority takes on a central role, in coordination with DNB and the AFM as far as insurers are concerned. Supervisory practice has not yet crystallised at this point. Good to know: the sanctions chapter itself has already been in force since 2 August 2025.
What this does to the vendor market
At the end of 2025, almost everyone was running AI pilots. Build fast, see what it yields, think about governance afterwards. That phase is over.
From the summer onwards, the question in every tender will increasingly be the same: can you substantiate the classification of this system today? Is there Article 11 documentation? Has bias been measured and will it keep being measured? Does the provider-deployer split you offer match what the law requires? A vendor that cannot answer these questions within a day drops off the shortlist. Compliance teams are already working on this. Procurement follows shortly after.
Where DCSolutions stands
DCSolutions builds platforms for insurers with explainability and human decision-making as the starting point. Concretely:
• Every automated step has a documented purpose, input data and boundaries.
• Decisions are logged at a level that matches what Article 12 requires on the provider side, so that the insurer as deployer can also run its own monitoring under Article 26 (or, for insurers under Solvency II, can keep using the existing governance stack).
• Claims handlers see what the model has done and on what basis, and can intervene or override at any moment.
• Bias testing and monitoring run continuously, not as an annual audit.
That is built that way deliberately. Not because the law enforces it, but because it is the only way to handle this work responsibly. It does make the conversations with compliance teams a lot simpler at the moment.
What you can do now
Three steps, in this order.
One. Create a register of all AI systems running in your insurance chain, including models that come bundled in third-party SaaS packages. Per system: use case, first deployment, provider, deployer role, and the status under Article 111.
Two. Determine the risk classification per system. Not 'high risk just to be safe' (that brings unnecessary obligations), not 'minimal because it is unclear' (that brings risk). Substantiate the choice, explicitly, on paper.
Three. For systems that are or are likely to become high risk: request the Article 11 documentation from your provider, plan your own Article 26 obligations (paying attention to the Solvency II route in paragraphs 5 and 6), and check whether Article 27 applies.
We are happy to speak with insurers working on this right now. One intake, one technical walkthrough of how we classify and substantiate our platforms. After that you know where you stand. Book a conversation via our contact page above.
Sources
• Regulation (EU) 2024/1689 (the AI Act), in particular Annex III, Articles 6, 9-15, 26, 27, 50, 99, 111 and 113. Available via eur-lex.europa.eu/eli/reg/2024/1689/oj or as a PDF on data.europa.eu (ELI: data.europa.eu/eli/reg/2024/1689/oj)
• Recital 58 (recital on the high-risk classification of insurance) and recital 96 (on the FRIA)
• AI Act Service Desk of the European Commission: ai-act-service-desk.ec.europa.eu
• EIOPA, Statement on the use of governance arrangements and risk management in the use of artificial intelligence
• artificialintelligenceact.eu (article-by-article explanation)