AI in the Insurance Industry: Is Regulation Just an Obstacle?

Simple motor claims are today assessed and settled fully automatically, often in minutes instead of days. Algorithms detect manipulated claims notifications before a claims handler even opens the file. In customer service, AI systems sort enquiries by urgency on their own. Artificial intelligence in the insurance business is long past the pilot-project stage.

At the same time, the industry operates in one of the most strictly regulated environments in Europe. The EU AI Act classifies AI systems for risk assessment in life and health insurance as high-risk. This brings substantial documentation and audit obligations.

The usual narrative reads: innovation versus regulation, speed versus audit duties. That narrative falls short. Those who take the rules seriously early on can turn them into an advantage. This article traces where AI stands in the insurance industry, what regulation actually demands, and why the industry that sells trust can also win with trust in AI.

Where Insurers Use AI Today

The use cases span the entire value chain:

• Claims settlement: AI analyses claims photos, matches them against claims databases and proposes settlement amounts. Simple motor claims largely run through automatically.
• Risk modelling: Geoinformation systems such as ZÜRS calculate flood risks at building level. More buildings in Germany are insurable against natural hazards today than ever before.
• Fraud prevention: Algorithms recognise patterns that indicate manipulated claims notifications – faster and more consistently than manual review.
• Customer communication: AI-supported systems recognise whether an enquiry is simple or needs human advice, and route it accordingly.
• Pricing and underwriting: With sufficient training data, models analyse risks more precisely and improve price structures and actuarial models.

The successes are measurable. According to the German Insurance Association (GDV), erroneous and time-consuming routing of customer enquiries can be reduced by up to 40%. For risk pre-enquiries, processing time likewise drops by up to 40%. More than 50% of CEOs expect investments in generative AI to pay off within three to five years; the market for AI in the industry is projected to grow to 79 billion US dollars by 2032.

From Loss Compensation to Risk Prevention

The GDV position paper “Artificial Intelligence in the Insurance Industry” (2026) describes a change that goes beyond efficiency: insurers are evolving from settlers of claims into proactive partners for risk prevention. AI-supported analyses provide early warnings of risks – for example weather alerts to protect property or hints for health prevention. This protects the individual and lowers costs for the entire risk community.

At the same time, the GDV names a limit: personalisation should improve advice and product selection, but must not lead to risks being individualised ever further. Insurance remains a collective principle. Three principles set the standard: the human being is at the centre, AI should create tangible added value, and final responsibility remains in human hands.

Regulation: Burden or Lever?

What the AI Act concretely demands

The AI Act has been in force since August 2024. The first obligations apply since February 2025; further requirements phase in step by step up to 2027. Systems for risk assessment of individuals and for setting insurance premiums in life and health insurance fall into the high-risk category. This entails obligations for risk management, data governance, documentation, human oversight and ongoing monitoring.

The GDV considers this classification disproportionate, since insurers already operate in one of Europe’s most strictly regulated sectors, and addresses further demands to the legislator:

• Simplify regulation instead of expanding it: Requirements from the AI Regulation, GDPR and DORA partially overlap and lead to duplicate documentation and reporting duties. Before new rules, the effect of existing ones should be evaluated.
• Rethink GDPR interpretation for health data: Fair, non-discriminatory AI needs a diverse data basis. Putting a dental bill in the same risk class as a cancer diagnosis is, in the GDV’s view, not appropriate.
• Enable automated individual decisions: Fully automated decisions should be permissible for standardised, rule-based and low-risk processes. The freed-up capacity would benefit customers with complex claims.

This criticism is justified. But it does not change the situation of individual companies: the obligations apply now, in parallel to Solvency II and data protection law.

The opportunity behind the obligations

This is where the second argument of this article comes in. For an industry whose most important currency is trust, traceability, fairness and data sovereignty are not burdens but product features. An insurer that can document how its pricing decides, that its models are tested bias-free and that customer data remains in European data centres holds something that counts in sales: verifiable trust.

BaFin’s control of fair pricing makes this concrete. Risk-based pricing is not discrimination but the foundation of fair insurance – provided the criteria are traceable, legally audited and free of impermissible characteristics. Those who provide this evidence in an automated, systematic way can settle claims faster and score with supervisors, auditors and customers alike. The new EU Product Liability Directive (2024/2853) adds another layer: those who have already anchored risk management and continuous auditing in their operations are prepared for the new liability questions.

In short: compliance effort, delivered once, becomes a usage advantage. Those who see it only as a cost item pay for it twice.

What Other Regulated Industries Already Show

Insurance is not the only industry that can use AI only under confidentiality obligations. Law firms face a structurally similar situation, just with different sections. §203 of the German Criminal Code (StGB) protects the confidentiality of special relationships of trust, including lawyer–client confidentiality. §43 of the Federal Lawyers’ Act (BRAO) obliges lawyers to maintain confidentiality about what is entrusted to them in the practice of their profession. Loading client data into an arbitrary cloud AI tool hosted in the USA is not an option.

The consequence in the legal sector is the same as in insurance: not the question “AI yes or no” decides, but whether the deployed tool is compatible with professional and data protection duties. Law firms therefore assess AI solutions against criteria such as data sovereignty, encryption, traceability of answers and location-bound hosting.

Added to this is a second, often underestimated layer: the contractual safeguarding of the entire chain. Lawyer–client confidentiality does not end at the service provider’s door. Those who deploy an AI solution must agree the obligations contractually with every party involved – from the provider via subcontractors and data-centre operators to support. For law firms this means concretely: a contractual framework that fixes confidentiality, data sovereignty, deletion concepts and control rights across all levels. For insurers the same pattern applies via data processing agreements (Art. 28 GDPR) and the AI Act’s accountability and control obligations, which must also be fulfilled towards third-party providers. In both industries the rule holds: whoever has not contractually closed the chain has not fulfilled the obligations, but merely shifted them.

For insurers, looking beyond their own field is worthwhile because a market has emerged from it: tools built for the strictest requirements usually fulfil the demands of the insurance industry as a by-product. How regulation, data integrity and AI use interact in another heavily regulated industry is shown in our article Artificial Intelligence in the Pharmaceutical Industry. The foundation for this is a solid AI governance framework.

Tool Selection: Where the Right Systems Help

Whether AI projects reach the implementation phase is often decided at tool selection. The most common pattern in practice: a tool convinces the business department but fails on data protection, traceability or supervisory requirements. The project never reaches operations and sales.

One example of the other path is aiuno (appoco GmbH), a retrieval-based AI solution for document and information management from Germany, developed for regulated environments. It illustrates the selection criteria that apply to insurers and law firms alike:

• Data sovereignty: processing and storage in European, preferably German data centres, no transfer to the USA, multiple encryption. In the legal sector this is the basis for compatibility with §203 StGB and §43 BRAO; for insurers with health data and financial information it is often the prerequisite for any approval.
• Traceable answers: retrieval-based AI works with references to the underlying sources instead of freely generated answers. This explainability is demanded by BaFin and the AI Act for pricing and benefits decisions. In law firms it corresponds to the duty to present results in an auditable way.
• Integration into the system landscape: more than 70 standard connectors and open interfaces integrate the platform into existing systems. Claims files, contract documents and health data thus remain in controlled processes instead of in freely chosen consumer tools. This is the most effective protection against shadow AI.
• Flexible operating models: cloud in Germany, private cloud or on-premise, depending on the company’s requirements profile.
• Established conformity: for law firm operations, aiuno is designed to be BRAK-compliant. This shows the pattern that applies to insurers too: whoever selects systems according to professional and industry law documents compliance not retrospectively, but through the procurement itself.
• Contractually closed chain: the obligations under §203 StGB and §43 BRAO must be agreed with all parties in the processing chain. At aiuno, the entire process chain is contractually and physically limited to the European Economic Area; operations run via defined contractual partners. An insurer checks the same question at this point, just with different sections: are data processing, subcontractors and the data centre contractually captured and controllable?

Such a tool does not replace AI governance or a legal review. But it addresses the most common implementation hurdle: projects fail on data protection and traceability requirements before they deliver value.

Recommendations for Insurers

1. Take stock: which AI systems are already running, including in business departments without IT knowing about them?
2. Perform risk classification: which systems fall under the AI Act’s high-risk category? Where do GDPR, Solvency II and future product liability law apply?
3. Anchor governance: establish responsibilities, approval processes and documentation, from model development to monitoring.
4. Review the contract chain: are data processing agreements, subcontractors and data-centre locations fully captured and controllable? Without a closed chain, obligations are merely shifted, not fulfilled.
5. Understand compliance as a product feature: use traceability and data sovereignty not only internally, but in customer contact.
6. Involve employees: training and transparent communication lower acceptance hurdles and prevent shadow AI.
7. Select tools by compliance criteria: check EU hosting, traceability, integration and operating model, not just feature scope. Orientation is provided by systems that already fulfil stricter professional rules.

FAQ

Conclusion

AI is changing what insurance can deliver: faster settlement, more precise risk models, better service. The regulation seen as an obstacle is in reality something else: the framework in which a trust-based industry can responsibly deploy AI at all. The industry can learn from a neighbouring sector that already uses tools built with data protection and traceability in mind under similar confidentiality obligations. Insurers that treat regulation as a space for design, build governance and select tools by compliance criteria can do both: settle claims faster and earn trust systematically.

Sources

• German Insurance Association (GDV): “Dossier: Künstliche Intelligenz” – gdv.de
• GDV: “Artificial Intelligence in the Insurance Industry”, position paper 2026 – gdv.de
• Taylor Wessing: “Künstliche Intelligenz in der Versicherungsbranche” – taylorwessing.com
• KPMG AG Wirtschaftsprüfungsgesellschaft: “Künstliche Intelligenz im Versicherungswesen: Innovation gestalten” – kpmg.com
• appoco GmbH: “aiuno – AI solution for documents & information” – aiuno.io