Under the EU AI Act, AI systems intended for risk assessment and pricing of natural persons in life and health insurance are classed as high-risk (Regulation (EU) 2024/1689, Annex III, point 5(c)), and since the 2026 amending regulation the main high-risk obligations apply to them from 2 December 2027 instead of 2 August 2026. For a life or health insurer writing business in the EU, that means an inventory of which systems fall in the class, deployer duties for systems it uses, a fundamental rights impact assessment before first use, and the full provider duties for any pricing or underwriting model it builds itself. Commercial property and casualty underwriting sits outside that class, which our commercial lines guide covers. The first task, knowing which systems are in scope, is the one Botminds' AI Governance & Model Inventory keeps current.
The amending regulation, the “Digital Omnibus on AI,” entered into force on 27 July 2026. The European Parliament's Legislative Observatory summarises its effect on the high-risk timetable in one sentence:
“The application of the main high-risk AI requirements is postponed to 2 December 2027 for systems listed in Annex III and to 2 August 2028 for product-related systems under Article 6(1) and Annex I.”
European Parliament Legislative Observatory, summary of Regulation (EU) 2026/1744
Is life insurance AI high-risk under the EU AI Act?
Yes, where the system is intended for risk assessment and pricing of individuals in life or health insurance. Annex III lists it under point 5, essential private and public services, beside creditworthiness scoring of natural persons in point 5(b). The recitals explain the choice: such systems can significantly affect people's livelihoods, and if poorly designed or used can lead to financial exclusion and discrimination, so they are high-risk where other insurance AI is not (Regulation (EU) 2024/1689).
The boundary is narrower than all the AI a life insurer runs. A claims triage model, a call-centre summariser or a marketing propensity score at a life insurer is not, on that basis alone, an Annex III system; nor, according to the recitals, are AI systems provided for by Union law for detecting fraud in financial services or for prudential purposes to calculate insurance undertakings' capital requirements. The class turns on what the system is intended to do: assess the risk of, or price cover for, an individual person.
What did the 2026 Digital Omnibus change for life and health insurers?
The date, above all. Regulation (EU) 2026/1744 postponed the main high-risk requirements for Annex III systems to 2 December 2027, a delay of sixteen months from the 2 August 2026 date in the original Act. It was adopted after Parliament's position of 16 June 2026 and the Council decision of 29 June 2026, published in the Official Journal on 24 July 2026 and in force three days later (EP Legislative Observatory; Official Journal text).
Three other changes matter to insurers. Providers and deployers must still take measures to support AI literacy among staff, but are no longer required to guarantee a particular level of literacy for each individual. The exceptional permission to process special categories of personal data to detect and correct bias, under strict conditions, is extended to deployers of high-risk systems where bias may cause harm or prohibited discrimination. And small mid-cap enterprises join small businesses in using simplified technical documentation.
The EU AI Act's dates for life and health pricing AI, before and after Regulation 2026/1744
- Prohibitions, AI literacy (Feb 2025)6 mo
- General-purpose AI rules (Aug 2025)6 mo
- Annex III high-risk duties (Aug 2026)12 mo
- Prohibitions, AI literacy (Feb 2025)6 mo
- General-purpose AI rules (Aug 2025)6 mo
- Annex III high-risk duties (Dec 2027)28 mo
Is 2 December 2027 a reprieve? No, a runway
It is thirteen months from the end of October 2026, and the work it buys time for is large. Before that date an insurer has to know which of its systems fall within Annex III point 5(c), decide for each whether it is the provider or a deployer, complete the provider duties for models it built, assess fundamental rights impacts for systems it deploys, and put human oversight, monitoring and logging in place. Models trained in 2026 will be in use in 2028; the documentation they need is cheapest to produce while they are being built.
The delay also leaves duties already in force untouched. The prohibitions and the AI literacy duty have applied since February 2025. And an insurer that also writes in the United States meets parallel expectations there now: the NAIC's model bulletin, adopted in 29 jurisdictions as of 8 October 2026, already asks for a written program covering every AI system in regulated practices, with inventories, validation and vendor oversight (NAIC Model Bulletin). Our bulletin guide sets those out.
Provider or deployer? What a life insurer owes in each role
The Act assigns duties by role, and an insurer can hold both. A provider is the body that develops an AI system, or has one developed, and puts it into service under its own name; a deployer is one “using an AI system under its authority.” A life insurer that builds its own underwriting model and uses it is its provider. One that licenses a vendor's accelerated underwriting score is a deployer, and the vendor is the provider.
EU AI Act duties for a life or health pricing system, by the insurer's role
As provider (a model the insurer builds): Make the system meet the high-risk requirements of Chapter III, Section 2.
As deployer (a model the insurer uses): Use it in line with the provider’s instructions, with appropriate technical and organisational measures.
As provider (a model the insurer builds): A quality management system; keep the required documentation.
As deployer (a model the insurer uses): Assign human oversight to people with the competence, training, authority and support to exercise it.
As provider (a model the insurer builds): Conformity assessment, EU declaration of conformity, CE marking, registration.
As deployer (a model the insurer uses): A fundamental rights impact assessment before first use, with its results notified to the market surveillance authority.
As provider (a model the insurer builds): Data governance requirements for training, validation and testing data.
As deployer (a model the insurer uses): Where it controls input data, ensure it is relevant and sufficiently representative.
As provider (a model the insurer builds): Keep logs under its control; take corrective action when needed.
As deployer (a model the insurer uses): Monitor operation; keep logs for at least six months; inform affected persons that the system is used.
Insurers get one accommodation. Article 26 deems the monitoring duty fulfilled for deployers that are financial institutions by complying with internal governance rules under Union financial services law, and lets them keep logs as part of the documentation those rules require. The recitals say “The same regime should apply to insurance and re-insurance undertakings and insurance holding companies under Directive 2009/138/EC,” the Solvency II directive, and that financial supervisors should in principle act as market surveillance authorities for AI used by the firms they supervise. A life insurer's AI supervision may therefore sit with its existing insurance supervisor.
The fundamental rights impact assessment: life and health insurers' own duty
Article 27 names life and health insurers expressly. Before deploying a high-risk system in point 5(b) or 5(c) of Annex III, a deployer must assess the impact the system's use may have on fundamental rights. Most private deployers have no such duty; insurers and lenders using these systems do. The assessment applies to first use, may rely on an earlier assessment or the provider's in similar cases, and must be updated when any element changes. Its results are notified to the market surveillance authority on a template the AI Office is to provide.
What a fundamental rights impact assessment must contain under Article 27
- The processes it is used in
A description of the deployer’s processes in which the system will be used in line with its intended purpose.
- When and how often
The period of time within which, and the frequency with which, the system is intended to be used.
- Who is affected
The categories of natural persons and groups likely to be affected in the specific context.
- The specific risks of harm
Risks likely to affect those persons or groups, using the information the provider gives under Article 13.
- Human oversight
How the oversight measures in the instructions for use are implemented.
- What happens if the risks materialise
The measures to be taken, including internal governance arrangements and complaint mechanisms.
Every element depends on knowing the system in detail: what it is used for, on whom, how often, with what oversight. That is a model card under another name. In the fictional sample used across these guides, the model card writer in AI Governance & Model Inventory drafts each system's purpose, where it runs, inputs, output, training data, users, risk reason and known limits, citing a document for every line; the same content feeds an impact assessment.
A model card in AI Governance & Model Inventory: the raw material of an impact assessment
Does the EU AI Act apply to health insurance in the same way?
Yes. Point 5(c) covers risk assessment and pricing of natural persons in life and health insurance alike, so a health insurer's individual underwriting or pricing model is high-risk on the same terms and from the same date, and Article 27's impact assessment applies to its deployers. Health insurers should also note the AI Act's right to explanation: a person affected by a decision taken on the basis of an Annex III system's output, which produces legal effects or similarly significant adverse effects, may obtain “clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken” (Article 86).
Deployers of Annex III systems that make or assist decisions about natural persons must also tell those persons that they are subject to the system's use (Article 26(11)). For a life or health insurer that is a disclosure duty at the point of underwriting and pricing, and one that matches the notice the NAIC bulletin and New York's Circular Letter No. 7 expect of insurers in the United States.
Which EU AI Act high-risk use cases touch insurers?
Two of Annex III's points reach insurers directly: 5(c), life and health risk assessment and pricing, and 5(b), creditworthiness of natural persons, where an insurer or its group lends. Others reach them as employers, such as AI used in recruitment or to make decisions about workers. The rest of an insurer's AI is not high-risk because of its industry, though transparency duties apply to systems that interact with people or generate content, and AI literacy applies to all.
That shapes the inventory. An insurer needs a field marking which systems are Annex III and why, a field for its role as provider or deployer, and for deployed systems the date of the impact assessment and its last update. Our inventory template lists the core fields; the EU fields sit beside them.
Preparing a life or health book for December 2027
Start with the list, then the roles, then the documents. In AI Governance & Model Inventory the rule mapper maps every system to the rules of each jurisdiction and line where it is used, and the EU AI Act is a rule set that can be switched on for life and health business in the EU, alongside the NAIC bulletin states, New York and Colorado. The test evidence checker lists the tests each tier needs; the change watcher reopens sign-off when a model is refit or a vendor retrains it, which is also when an Article 27 assessment may need updating.
Oversight is a design question as much as a policy. The sample insurer's response to a newly found High-risk vendor system was an interim control approved by the business owner: the person sets their own figure first, sees the model's suggestion after, and large differences go to a supervisor. That is the kind of human oversight Article 26 asks deployers to assign to people with the competence and authority to exercise it.
Human oversight, approved in writing: an interim control in AI Governance & Model Inventory
Questions people ask
What is the EU AI Act?
Regulation (EU) 2024/1689, the EU's horizontal law on artificial intelligence. It prohibits some practices, sets obligations for high-risk systems listed in its annexes, adds transparency duties for some others, and regulates general-purpose AI models. It was amended in 2026 by Regulation (EU) 2026/1744.
When do the EU AI Act high-risk obligations apply?
For systems listed in Annex III, including life and health insurance pricing, from 2 December 2027 after the 2026 amendment. For product-related high-risk systems under Article 6(1) and Annex I, from 2 August 2028.
Is all AI at a life insurer high-risk?
No. Only systems intended for risk assessment and pricing of natural persons in life and health insurance fall under Annex III point 5(c). Claims, service and marketing AI is not high-risk for that reason, though AI literacy and transparency duties still apply.
Does the EU AI Act apply to US insurers?
It applies to providers placing systems on the EU market and to deployers using them in the EU, so a US group with an EU life or health subsidiary is in scope for that business. Its US operations meet the NAIC bulletin, New York's Circular Letter No. 7 and Colorado's regulation instead.
Who supervises insurers' AI under the EU AI Act?
The recitals say the authorities that supervise financial institutions, insurance supervisors under Solvency II among them, should be designated as market surveillance authorities for AI those institutions provide or use, unless a Member State designates another authority.