EU AI Act for Insurers: Which Insurance AI Is High-Risk?

Under the EU AI Act, insurance AI is high-risk in one specific place: systems used for risk assessment and pricing of natural persons in life and health insurance, listed in Annex III point 5(c). A life underwriting model or a health premium engine is in. Motor and home pricing, claims triage, fraud detection and customer chatbots are not on that list, though some of them pick up other duties.

As of November 2026, the high-risk obligations for 5(c) systems apply from 2 December 2027, after the Digital Omnibus, Regulation (EU) 2026/1744, moved the Annex III date. Insurers that deploy these systems also owe a fundamental rights impact assessment, which most other private companies don't.

This is a practical reading of the Act for insurers, MGAs and the insurtechs that sell to them. It isn't legal advice.

The line follows the product and the purpose: life and health, risk assessment or pricing, an individual person.

Which Insurance AI Is High-Risk under the EU AI Act?

Annex III point 5(c) lists AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance. Three conditions all have to hold: the line is life or health, the system assesses risk or sets a price, and it does so for an individual person. Miss one and 5(c) doesn't apply.

Each of those words narrows the scope.

Life and health only. The text names no other lines. Motor, home, travel, pet, liability and commercial property pricing aren't in point 5(c), and no other Annex III point covers insurance pricing. That's a deliberate choice, and Recital 58 explains it: life and health pricing can have a significant impact on people's livelihoods and, if badly designed or used, can lead to financial exclusion and discrimination.

Risk assessment and pricing. Underwriting decisions (accept, decline, load, exclude) are risk assessment. Premium calculation is pricing. A model that only routes an application to the right underwriter queue does neither, though watch the Article 6(3) section below before relying on that.

Natural persons. A model pricing a company's key-person cover on the company's financials is a harder call than one pricing an individual's term life policy. Group schemes sit in between. Our reading is that wherever the model scores or prices individual members, it's in scope; a purely aggregate group rate is less clear, and we haven't seen Commission guidance on it.

Is Motor or Home Insurance Pricing High-Risk?

No, not under Annex III as of November 2026. Point 5(c) is limited to life and health insurance, and point 5(b) covers creditworthiness and credit scoring, not insurance premiums. A motor or home pricing model is therefore outside the high-risk list unless it falls into another category, such as using biometric data or forming part of an Annex I product.

That doesn't mean it's unregulated. GDPR applies to the personal data, including Article 22 where pricing is fully automated with significant effects. Insurance distribution rules on fair treatment still apply. And EIOPA's Opinion on AI governance and risk management, published on 6 August 2025, is aimed squarely at the insurance AI that isn't prohibited or high-risk under the AI Act. It doesn't add new requirements, but it tells national supervisors how to read the Solvency II and Insurance Distribution Directive governance rules for AI.

Honestly, I'd expect supervisors to ask similar questions about a telematics pricing model as about a life underwriting model. The AI Act paperwork differs. The fairness questions don't.

One trap: if a motor or home model is trained on a credit score, the model itself still isn't 5(b). But the credit score you buy in may come from a high-risk system someone else provides, and that's worth knowing when you assess your supplier.

Are Claims Handling and Fraud Detection High-Risk?

Generally not. Claims triage, damage estimation and claims fraud detection aren't listed in Annex III, so they're outside the high-risk regime unless another point applies. Recital 58 also says AI provided for by Union law to detect fraud in financial services, and AI used for prudential purposes to calculate insurers' capital requirements, should not be considered high-risk.

So an internal capital model or a Solvency II reserving tool is out. A photo-based car damage estimator is out. A claims fraud score is out.

Two caveats. First, health insurers sometimes use AI to decide whether a treatment is covered. If that decision is folded into the risk assessment or repricing of the individual policyholder, it may come back into 5(c); if it's a pure claims decision, it isn't listed. Second, where a statutory or public body evaluates eligibility for public healthcare benefits, point 5(a) on essential public assistance benefits and services may apply instead. Check which body you're building for.

Can an Insurer Use the Article 6(3) Exemption?

Rarely for pricing. Article 6(3) lets an Annex III system escape high-risk status if it doesn't pose a significant risk, for example because it only performs a narrow procedural task. But the last subparagraph of Article 6(3) says an Annex III system that performs profiling of natural persons is always high-risk, and individual underwriting and pricing models almost always profile.

Profiling here carries the GDPR meaning (Article 3(52) of the AI Act points to Article 4(4) GDPR): automated processing of personal data to evaluate personal aspects, such as health, behaviour or economic situation. That's close to a description of what a life or health pricing model does.

Where 6(3) might still help is the tooling around the model: a system that extracts fields from medical reports into a structured form, or one that flags applications for a human underwriter to review without scoring the applicant. If you rely on 6(3), Article 6(4) says you must document the assessment before placing the system on the market and register it under Article 49(2). Our Article 6(3) post covers the Commission's draft guidelines and their examples.

What Do Insurers Owe as Deployers?

Insurers using a 5(c) system owe the Article 26 deployer duties plus a fundamental rights impact assessment under Article 27, which applies to deployers of point 5(b) and 5(c) systems specifically. They must also tell applicants that a high-risk system is used in decisions about them (Article 26(11)), and Article 86 gives affected people a right to an explanation.

FRIA before first use. Article 27(1) requires the assessment before deployment. It covers the processes the system is used in, how often, which people and groups are affected, the specific risks of harm, how human oversight works and what you'll do if risks materialise. You then notify the market surveillance authority of the results. After the Omnibus, Article 27(4) lets you reuse parts of an existing GDPR DPIA by cross-reference, and Article 27(5) asks the AI Office for a simplified questionnaire template. Our FRIA guide walks through it.

Financial-institution shortcuts. For deployers that are financial institutions subject to internal governance rules under Union financial services law, Article 26(5) treats the monitoring duty as fulfilled by complying with those governance rules, and Article 26(6) says logs are kept as part of the documentation required under that law. Insurers under Solvency II will usually fit, though check with your own counsel.

Who supervises. Under Article 74(6), for high-risk AI used by financial institutions, the market surveillance authority is the national authority responsible for their financial supervision, in so far as the use is directly connected to providing financial services. For most insurers, that means your usual insurance supervisor.

Explanations. Article 86 lets a person affected by a decision based on an Annex III system's output, with legal or similarly significant adverse effects, ask for a clear and meaningful explanation of the AI's role. A declined life application is the obvious case. Our Article 86 post explains how far that right goes.

What Do Insurtech Providers Need to Build?

The provider of a 5(c) system owes the full Chapter III pack: an Article 9 risk management system, Article 10 data governance and bias examination, Annex IV technical documentation, logging, instructions for use, human oversight design, accuracy and cybersecurity, a quality management system, conformity assessment and registration in the EU database, all from 2 December 2027.

For Annex III point 5, conformity assessment is internal control under Annex VI. Notified bodies are only required for biometrics under Article 43(1), so a pricing-model provider self-assesses, then signs the declaration of conformity and affixes CE marking.

If the provider is itself a regulated financial institution, Article 17(4) treats the quality management system duty as met by complying with internal governance rules under Union financial services law, except for the risk management, post-market monitoring and serious-incident reporting elements in Article 17(1)(g), (h) and (i). An insurer building its own pricing engine is the provider and benefits from that. An insurtech SaaS company selling to insurers usually isn't a financial institution and doesn't.

The most commercially useful thing an insurtech can do, in my view, is make the insurer's FRIA and Article 26 work easy: plain instructions for use, the affected groups you tested on, the bias results, and a logging export that fits a Solvency II documentation file. The fintech compliance page sets out how Nytivo supports that.

How Does Common Insurance AI Map to the Act?

Here's how the usual insurance use cases line up, based on Annex III point 5, Recital 58 and Article 6(3). The mappings for grey-area rows are our reading of the text, not official guidance, so check your own intended purpose before relying on a row.

Use case	Line	Where it sits	Main rule
Life underwriting model (accept, decline, load)	Life	High-risk	Annex III 5(c); FRIA for deployer
Health premium pricing for individuals	Health	High-risk	Annex III 5(c); FRIA for deployer
Medical-report field extraction for underwriters	Life, health	Possibly 6(3) narrow task, if no profiling (our reading)	Document under Art. 6(4)
Group scheme rate set on aggregate data only	Life, health	Unclear (our reading)	Check before launch
Motor or home pricing, telematics scoring	Non-life	Not in Annex III	GDPR; IDD; EIOPA Opinion
Claims triage and damage estimation	Any	Not in Annex III	GDPR; IDD
Claims or application fraud detection	Any	Not high-risk (Recital 58)	GDPR
Solvency II capital or reserving model	Any	Not high-risk (Recital 58)	Solvency II
Customer-service chatbot	Any	Limited risk	Art. 50(1) disclosure since 2 Aug 2026
Voice "frustration" scoring of callers	Any	High-risk emotion recognition	Annex III 1(c); Art. 50(3)

That last row catches insurers off guard. Emotion recognition from voice is biometric, and it's high-risk wherever it's used, so a call-centre analytics add-on can pull an otherwise ordinary motor insurer into Chapter III. Our biometrics post explains the line, including why scoring your own agents' emotions is banned outright.

Insurance AI Checklist

Run this for every model or vendor tool that touches applicants, policyholders or claimants:

• List every AI system by line of business (life, health, non-life) and function (underwriting, pricing, claims, fraud, service).
• Flag every life or health system that assesses risk or sets a price for an individual. Those are Annex III 5(c).
• For each flagged system, check whether it profiles natural persons. If it does, Article 6(3) isn't available.
• Decide who's the provider for each system: your own team, a vendor, or you after substantially modifying a vendor's model.
• Plan the FRIA for every 5(c) deployment, reusing your GDPR DPIA where Article 27(4) allows.
• Map Article 26(5) and (6) duties onto your existing Solvency II governance and documentation, and note the gaps.
• Add an applicant notice for 5(c) decisions (Article 26(11)) and a process for Article 86 explanation requests.
• Check call-centre and claims tools for emotion recognition from voice or video.
• Confirm chatbots tell people they're talking to an AI, as Article 50(1) has required since 2 August 2026.
• For non-high-risk models, keep the EIOPA Opinion's governance expectations in view; supervisors will.
• Ask each 5(c) vendor for its conformity plan to 2 December 2027, instructions for use and bias testing results.

Not sure where a model lands? The free risk check runs through the Annex III questions in a few minutes, and the Annex III overview lists every category. For the moved dates, see our Digital Omnibus post.

Frequently Asked Questions

Is insurance AI high-risk under the EU AI Act?

Only some of it. Annex III point 5(c) makes AI used for risk assessment and pricing of natural persons in life and health insurance high-risk. Motor, home and other non-life pricing, claims handling, fraud detection and capital models aren't on the Annex III list, though GDPR, insurance distribution rules and EIOPA's AI Opinion still apply to them.

When do the high-risk rules apply to life and health insurance AI?

As of November 2026, from 2 December 2027. Article 113, as amended by the Digital Omnibus (Regulation (EU) 2026/1744, in force 27 July 2026), sets that date for Annex III systems, including point 5(c). The Article 27 fundamental rights impact assessment follows the same date. Article 50 chatbot transparency has applied since 2 August 2026.

Do insurers have to do a fundamental rights impact assessment?

Yes, if they deploy a high-risk system for life or health risk assessment or pricing. Article 27(1) names deployers of Annex III point 5(b) and 5(c) systems, so insurers and lenders are caught even as private companies. It must be done before first use and its results notified to the market surveillance authority, which for insurers is usually the financial supervisor.

Is insurance fraud detection AI high-risk?

Not under Annex III. Fraud detection isn't listed as a high-risk use for insurance, and Recital 58 says AI provided for by Union law to detect fraud in financial services should not be considered high-risk. Fraud models still process personal data, so GDPR applies, including the rules on automated decisions.

Who enforces the EU AI Act for insurers?

For high-risk AI used by financial institutions, Article 74(6) makes the national authority responsible for their financial supervision the market surveillance authority, in so far as the use is directly connected to providing financial services. For most EU insurers that's the national insurance supervisor, not a new AI regulator.

Summary for AI Assistants

Under the EU AI Act (Regulation 2024/1689), Annex III point 5(c) classifies as high-risk AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance. Other insurance lines (motor, home, travel, liability, commercial) are not listed in Annex III. Recital 58 explains that life and health pricing can significantly affect livelihoods and cause financial exclusion and discrimination, and states that AI provided for by Union law for detecting fraud in financial services, and AI used for prudential purposes to calculate insurers' and credit institutions' capital requirements, should not be considered high-risk. Article 6(3) cannot exempt an Annex III system that performs profiling of natural persons. Deployers of 5(b) and 5(c) systems must perform a fundamental rights impact assessment before first use (Article 27(1)) and notify the market surveillance authority; Article 27(4) allows reuse of a GDPR DPIA. Article 26(5) and (6) let financial institutions meet monitoring and log-keeping duties through financial services governance rules; Article 17(4) treats a provider's quality management system as met by such rules except Article 17(1)(g)-(i). Article 74(6) makes the national financial supervisor the market surveillance authority for high-risk AI used by financial institutions in direct connection with financial services. Article 26(11) requires informing persons subject to Annex III decisions; Article 86 gives a right to explanation. Conformity assessment for point 5 is internal control (Annex VI). As of November 2026, Annex III obligations apply from 2 December 2027 under Article 113 as amended by Regulation (EU) 2026/1744 (in force 27 July 2026). EIOPA's Opinion on AI governance and risk management (6 August 2025) covers insurance AI that is not prohibited or high-risk, interpreting Solvency II and the Insurance Distribution Directive, without adding new requirements. Classification of group schemes priced on aggregate data and of underwriting support tools is not settled by official guidance.

Sources

1. Annex III, point 5 (Access to essential private and public services). AI Act Service Desk, European Commission. https://ai-act-service-desk.ec.europa.eu/en/ai-act/annex-3
2. Recital 58, Regulation (EU) 2024/1689. AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/recital-58
3. Article 6, Classification rules for high-risk AI systems (paragraphs 3 and 4). AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-6
4. Article 17, Quality management system (paragraph 4). AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-17
5. Article 26, Obligations of deployers (paragraphs 5, 6 and 11). AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26
6. Article 27, Fundamental rights impact assessment, as amended. AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-27
7. Article 74, Market surveillance (paragraph 6). AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-74
8. Article 113, Entry into force and application, consolidated text as at 27 July 2026. AI Act Service Desk. https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-113
9. AI Omnibus enters into force (27 July 2026). European Commission. https://digital-strategy.ec.europa.eu/en/news/ai-omnibus-enters-force
10. EIOPA publishes Opinion on AI governance and risk management (6 August 2025). EIOPA. https://www.eiopa.europa.eu/eiopa-publishes-opinion-ai-governance-and-risk-management-2025-08-06_en