Governance
EU AI Act
Definition
The EU AI Act is the European Union's risk-tiered regulation of AI systems, imposing the heaviest obligations on high-risk uses — which include several core insurance functions.
The Act sorts systems by risk rather than by technology, so obligations follow what a system decides and about whom, not which model or vendor produced it. Risk assessment and pricing in life and health insurance sit in the high-risk tier, pulling documentation, data governance, human oversight, and logging requirements into ordinary underwriting operations. Firms operating in or serving EU markets are covered even if the AI system itself was built or hosted elsewhere.
Timeline movement is not relief
Adjustments to application dates change the deadline, not the work. The controls that take longest — inventory, decision logging, oversight staffing, eval evidence — are the ones that cannot be compressed at the end, because they depend on data being captured consistently over time rather than assembled retroactively. A firm that treats a delayed deadline as permission to wait will find itself trying to reconstruct a year of decision logs it never captured, which is materially harder than logging them as they happened would have been.
It lands on operations, not on legal
Most of the required evidence is produced by the systems and the people running them day to day — underwriters, claims handlers, the teams that built the pricing model — not by the legal department reviewing a contract. Treating the Act as a legal review item rather than an operational instrumentation project is the common and costly mistake, because it leaves the actual logging and oversight work unowned until an audit forces the question. The firms handling this well have assigned operational owners, not just legal reviewers, from the start.
High-risk classification changes the build, not just the paperwork
Once a system is classified high-risk, the obligations are not satisfied by a compliance memo attached after launch; they change what the system has to be able to do from the outset, including producing a human-reviewable explanation for individual decisions and maintaining a dataset governance record. Retrofitting these capabilities into a system that was not designed for them is significantly more expensive than building them in from the start, which is why classification should happen at design time, before the architecture is locked in, rather than after the system is already in production.
In practice
- Classify each deployed system against the risk tiers before designing controls
- Instrument decision logging now; it has the longest lead time
- Keep human oversight staffed and evidenced, not just documented
- Assign an operational owner for compliance evidence, not only a legal reviewer
