EU AI Act compliance for insurance AI in 2026

Annex III, point 5(c) covers "AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance" [1]. The legal text is narrow on its face but expansive in practice. Underwriting models, pricing models, telematics-driven life-and-health risk assessment, claim-fraud-screening models that influence pricing, and propensity-to-claim models that feed pricing all fall inside the band when the line of business is life or health.

Property, motor, marine, aviation and transit, commercial liability, and most non-life lines are not named. They sit outside Annex III and therefore outside the high-risk regime by default. They are still inside EIOPA's June 2024 supervisory statement on the use of AI governance principles by insurance and reinsurance undertakings, which sets convergent expectations on data governance, model risk management, and consumer fairness regardless of AI Act classification [2].

Article 43 of the Act and the internal-control procedure of Annex VI apply. The provider runs a self-assessment against Articles 8 to 15, draws up the EU declaration of conformity, affixes the CE marking, and registers the system in the EU database. No notified body is required for the Annex III point 5(c) category. The practical evidence is the Annex IV technical documentation pack and the post-market monitoring plan under Article 72.

Where an undertaking is the deployer of a third-party-built model, Article 26 deployer obligations apply: the system must be used in line with provider instructions, input data must be relevant and sufficiently representative, and human oversight must be assigned to natural persons with the necessary competence and training. The deployer also has to monitor operation and notify the provider of incidents. EIOPA's supervisory statement reinforces these expectations from a prudential angle [2].

Three tests. First, line of business. Life or health triggers point 5(c); the other lines do not. Second, AI function. Risk assessment or pricing triggers; pure operational AI (claim document classification, agent productivity, contact-centre routing) does not. Third, the Article 6(3) carve-out. A model that surfaces patterns for an underwriter without setting any decision parameter can qualify as a "preparatory task," but the carve-out has to be documented in the technical file.

The interaction with Solvency II is the part that catches insurers off guard. The Solvency II Pillar 2 model governance regime - including the use-test, the documentation standards, and the Own Risk and Solvency Assessment - applies to internal models used for capital purposes. AI used for pricing or reserving inside the Internal Model has to satisfy the Solvency II Internal Model approval process in addition to the AI Act conformity assessment. The two regimes do not align cleanly; the documentation packs overlap but are not interchangeable [3].

Annex IV of the AI Act sets the contents [1]. For an insurance AI deployment the contentious parts are Article 10 data governance and Article 14 human oversight design. Training data must be representative across protected categories. The European Insurance Gender Directive (CJEU C-236/09 Test-Achats and Directive 2004/113/EC as interpreted) prohibits the use of gender as a rating factor for new contracts entered after 21 December 2012 [4]. A model that uses correlated proxies for gender has to be evaluated and documented as such; "the model does not see gender" is not sufficient evidence.

For health insurance, the protected-category list extends to data revealing racial or ethnic origin, religious beliefs, genetic data, and biometric data under GDPR Article 9. These categories may not be processed for risk pricing without a specific Article 9(2) lawful basis. The technical file has to evidence that they are not in the feature set, not in the embeddings, and not reconstructable from the proxies.

Article 14 expects the deployer to assign oversight to a natural person with the competence, authority and training to override. For high-volume retail lines the operational pattern is sampled review with full review of edge cases, rather than 100% review. The threshold for "edge case" has to be defined and documented; the EIOPA statement notes that this threshold itself becomes a control that supervisors will test [2].

For low-volume specialty lines, full review is the default. Either way, the override has to be logged with reason code, reviewer ID, and timestamp. Article 86 of the AI Act gives the data subject the right to a clear and meaningful explanation of the role of the AI in any high-risk decision producing legal or similarly significant effects, applying from August 2026 - that explanation artefact is best designed at build time. The Solvency II use-test layers a parallel expectation that the model is actually used by the relevant decision-makers in the way the documentation says it is used [3].

Impetora ships every insurance AI system with a written risk classification analysis (point 5(c) yes or no, with the line-of-business and AI-function reasoning written out), a data-governance description aligned with Article 10 plus the Test-Achats gender-rating prohibition, a draft technical documentation pack aligned with Annex IV, a human-oversight design spec mapped to Article 14 and the EIOPA statement, an Article 86 explanation artefact, and a post-market monitoring plan with named drift metrics, owners and reporting cadence.

For deployments inside a Solvency II Internal Model perimeter, Impetora produces a parallel Solvency II model file that maps the AI Act technical documentation onto the use-test and the documentation standard expected for Internal Model approval. Cross-references: the EU AI Act overview, the insurance industry hub, the decision-support AI use case, and the TRACE methodology.