Under the EU AI Act, insurance AI is high-risk where it is intended for risk assessment and pricing of natural persons in life and health insurance, listed in Annex III, point 5(c); AI used in commercial property and casualty underwriting is not on that list. Commercial underwriting AI is not ungoverned, though. In the EU the Act's AI-literacy duty, its transparency duties for some systems, and the insurance sector's own governance rules still apply, and the high-risk rules themselves now start on 2 December 2027, after a 2026 amendment. In the US, the NAIC's model bulletin on insurers' use of AI, adopted in 29 jurisdictions as of 8 October 2026, and New York's Circular Letter No. 7 expect written programmes, testing and explainable adverse decisions, and New York notes that commercial policies can reach sole proprietors. For a tool such as Botminds' Underwriting Authority & Referral Management, which reads submissions and guides and places accounts on an authority ladder for a person to sign, the practical rules are governance, citation and human decision.
This page reads the legal texts directly and quotes them; it is a guide, not legal advice. Product examples come from the solution's fictional sample branch.
Three regimes, one commercial underwriting desk
| Question | EU AI Act | NAIC model bulletin | New York Circular Letter 7 |
|---|---|---|---|
| Is commercial P&C underwriting AI in scope? | Not high-risk: Annex III lists only life and health pricing of natural persons. Literacy and, for some systems, transparency duties still apply. | Yes in principle: the program covers underwriting, rating and pricing; its tests centre on consumer outcomes. | Yes for New York insurers; commercial P&C may or may not affect consumers, for example sole proprietors. |
| What it asks for | For high-risk systems: risk management, human oversight, logs, and for some deployers a rights impact assessment. | A written AI program with governance, controls, testing and third-party oversight, proportionate to risk. | Governance, testing for unfair discrimination, documentation and specific reasons for adverse decisions. |
| When | High-risk rules from 2 December 2027; other duties already apply. | Adopted by each state; 29 jurisdictions listed as of 8 October 2026. | Issued 11 July 2024. |
| Who enforces | National market-surveillance authorities; for insurers, their financial supervisor unless the member state names another. | The adopting state’s insurance department, including through market conduct exams. | The New York Department of Financial Services. |
Is insurance underwriting high risk under the EU AI Act?
Insurance underwriting is high-risk under the EU AI Act only in one case: AI intended for risk assessment and pricing of natural persons in life and health insurance. Underwriting a warehouse, a fleet or a contractor's liability is not listed, so an AI system used for it is not high-risk under Annex III, whatever it does.
The listing is deliberately narrow. The Act's recitals explain that life and health pricing was singled out because such systems "can also have a significant impact on persons’ livelihood and if not duly designed, developed and used, can infringe their fundamental rights and can lead to serious consequences for people’s life and health, including financial exclusion and discrimination." The same recital sets the creditworthiness of natural persons beside it. Commercial lines insure businesses, and the Act's high-risk list is about decisions that shape individual people's access to essential services.
What does Annex III say about insurance?
Annex III, under the heading of access to essential private and public services, lists "AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance;" That is point 5(c), and it is the only insurance entry. Article 6(2) makes every Annex III system high-risk, subject to one exception.
The exception in Article 6(3) matters even to life and health insurers. An Annex III system is not high-risk where it does not pose a significant risk of harm, including where it is intended to perform "a narrow procedural task" or "a preparatory task to an assessment relevant for the purposes of the use cases listed in Annex III." The exception has a hard edge: such a system "shall always be considered to be high-risk where the AI system performs profiling of natural persons." A provider relying on the exception must document its assessment before the system is placed on the market.
One duty attaches to deployers specifically. Article 27 requires deployers of the high-risk systems in points 5(b) and (c), credit scoring and life and health pricing, to carry out a fundamental-rights impact assessment before deploying them. A carrier using AI only in commercial property and casualty underwriting has no such duty under the Act.
When do the EU AI Act high-risk obligations apply?
The EU AI Act's high-risk obligations apply to Annex III systems, including life and health pricing, from 2 December 2027, after the Digital Omnibus on AI moved the date from 2 August 2026. Systems in products covered by Annex I follow on 2 August 2028. The amendment, Regulation (EU) 2026/1744, was published on 24 July 2026 and replaced the Act's application dates with "2 December 2027 as regards AI systems classified as high-risk pursuant to Article 6(2) and Annex III".
The EU AI Act's dates as they stand after the 2026 amendment
- 1 August 2024The AI Act enters into force, twenty days after its publication on 12 July 2024.
- 2 February 2025Chapters I and II apply: definitions, AI literacy and the prohibited practices.
- 27 July 2026The Digital Omnibus on AI, Regulation (EU) 2026/1744, enters into force and moves the high-risk dates.
- 2 August 2026The Act’s general date of application.
- 2 December 2027High-risk rules apply to Annex III systems, including life and health risk assessment and pricing.
- 2 August 2028High-risk rules apply to AI in products covered by Annex I.
Two duties did not wait. The Act's general provisions, including AI literacy, have applied since 2 February 2025, and the amended Article 4 now reads "Providers and deployers of AI systems shall take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf". A commercial underwriting team using AI tools is a deployer for that purpose, whatever the tools do.
Does the EU AI Act apply to commercial insurance at all?
Yes, but lightly: for commercial underwriting AI that is neither prohibited nor high-risk, the Act adds transparency and literacy duties and leaves governance to insurance law. The European Insurance and Occupational Pensions Authority states the position in its 2025 opinion: such systems "continue to operate subject to existing sectoral legislation without new requirements, with the exception of certain transparency requirements (e.g. need to inform the customer that she/he is interacting with an AI system), the need to promote staff AI literacy, and the development of voluntary codes of conduct."
The rest of that opinion explains how Solvency II and the Insurance Distribution Directive already govern such systems, from data governance to human oversight, and it insists it "does not set out new requirements". For a European carrier, then, a commercial underwriting tool is governed mainly as any other model or process is: documented, proportionate, overseen by people with defined roles.
the relevant risks arise primarily from data selection, data governance and underwriting or pricing policies, rather than from the GLM/GAM model architecture as such.
EIOPA, letter to the European Commission on Annex III, point 5(c), 10 July 2026
That letter shows how the line is still moving. In April and again in July 2026, EIOPA asked the Commission to exclude life and health pricing systems relying solely on generalised linear and additive models, used under human supervision, from Annex III. Its argument, that risk comes from data and underwriting policy rather than model type, is the one a commercial desk should take to heart: governance attaches to the decision and its inputs, not to a label on the software.
Does the NAIC AI bulletin cover commercial lines?
The NAIC's model bulletin is written for insurers' use of AI across regulated practices, and it lists underwriting, rating and pricing without limiting them to personal lines; its tests, though, are framed around consumers, a term it does not define. Each adopting state decides how it applies. As of 8 October 2026 the NAIC's map lists 29 jurisdictions as having adopted it, and four more, California, Colorado, New York and Texas, with their own guidance.
The bulletin asks each insurer for a written AI program and says that program "should address the use of AI Systems across the insurance life cycle, including areas such as product development and design, marketing, use, underwriting, rating and pricing, case management, claim administration and payment, and fraud detection." Its definitions make the consumer the measure: an adverse consumer outcome is a decision that harms the consumer in a way that breaks the insurance standards the bulletin lists (NAIC model bulletin). For a commercial book written largely to companies, the practical exposure sits where commercial policies meet individuals, which is New York's point below.
Where New York’s Circular Letter 7 reaches commercial underwriting
New York's Circular Letter No. 7 requires insurers using AI systems or external consumer data in underwriting and pricing to govern them, test them for unfair or unlawful discrimination, document them, and give specific reasons for adverse decisions. It applies to all insurers authorized in New York, and it addresses commercial lines directly: "For example, commercial property/casualty insurance is issued to sole proprietors."
Its notice expectations are the most concrete part for an underwriting desk. In a declination, limitation, rate differential or other adverse underwriting decision, the reasons given "should include details about all information upon which the insurer based any declination, limitation, rate differential, or other adverse underwriting decision, including the source of the specific information upon which the insurer based its adverse underwriting or pricing decision." A tool that cannot say which document and page a fact came from cannot support that notice.
Do you need to explain an AI underwriting decision?
Where the decision is adverse and the insured is a person, in New York, yes, with the source of the information; and for schedule-rating debits, some states require an explanation whatever tool made the decision. Utah requires a rate-modification plan to provide that, when a risk is debited, the insured or applicant, or their agent or broker, "upon request, will be advised by the insurer of the factors that resulted in the adverse rating".
Explaining is cheap when the decision was built from cited rules and expensive when it was not. In the solution's sample branch, every verdict on an account names the letter paragraph or guide page behind it, and every fact names the submission page it came from. The referral note quotes the rule word for word. If a broker asks why an account went to the home office, the answer, a New York location outside the region under paragraph 6 of the underwriter's letter, is already on the file. Why the person, not the software, should sign that decision is argued in underwriter sign off.
Answers with their passages: asking the guides in Underwriting Authority & Referral Management
What a commercial underwriting desk should do now, in either regime
A commercial underwriting desk should know which AI it uses and for what, keep a person on every decision, make every automated verdict cite its rule, and be able to give a reason with its source. None of that waits for 2027, and all of it serves the EU, NAIC and New York regimes at once.
Six steps that satisfy all three regimes for a commercial desk
- Inventory every AI use by task
Intake, appetite, authority, pricing support, referrals. New York expects an up-to-date inventory; it is good practice anywhere.
- Classify each use against Annex III
Commercial P&C uses are outside point 5(c); a group that also writes life or health business should check those uses separately.
- Write down the human role
Who decides, who prepares, who checks, and what the software may never do.
- Make every verdict cite its rule and source
Letter paragraph, guide page, version and the submission page behind each fact.
- Put audit and cooperation terms in vendor contracts
The NAIC bulletin and New York both expect insurers to oversee third-party AI.
- Train the people who use it
AI literacy has been an EU duty since February 2025, and is sound practice elsewhere.
In Underwriting Authority & Referral Management, agents never approve: they read the submission and the guides, place the account on the rung that can sign it, and draft the referral, and a person signs. That is a design choice rather than a legal requirement for commercial lines, and it keeps the decision where every one of these frameworks already looks for it. How the solution's settings keep each rule's version and owner is shown in underwriting automation software; the solution itself is at Underwriting Authority & Referral Management.
A referral drafted by Underwriting Authority & Referral Management, decided by people
Questions people ask
Is property and casualty insurance high-risk under the EU AI Act?
No. Annex III lists only risk assessment and pricing of natural persons in life and health insurance. Property and casualty uses, commercial or personal, are not high-risk under that annex, though the Act's literacy duty, its transparency duties for some systems, and insurance-sector governance still apply.
When does the EU AI Act apply to insurers?
In stages. Definitions, AI literacy and prohibited practices have applied since 2 February 2025; the general date of application was 2 August 2026; high-risk rules for Annex III systems, including life and health pricing, apply from 2 December 2027 under the 2026 amendment.
Do insurers need a fundamental rights impact assessment?
Only as deployers of the Annex III systems Article 27 names, which for insurers means AI for risk assessment and pricing of natural persons in life and health insurance, and creditworthiness. A carrier using AI only in commercial property and casualty underwriting is not covered by that article.
Is a rules engine an AI system under the EU AI Act?
Probably not, if it only executes rules people wrote: the Act's recitals say the AI definition should not cover systems based on rules defined solely by natural persons. Software that reads guides and infers which rule applies is more likely to be an AI system, high-risk or not.
Which US states have adopted the NAIC AI bulletin?
The NAIC's map lists 29 jurisdictions as of 8 October 2026, from Alaska and Connecticut to Washington and Wisconsin, with South Carolina and North Dakota the most recent, in September and October 2026. California, Colorado, New York and Texas have their own guidance instead.