AI in insurance: underwriting and pricing

Short answer: AI used for risk assessment (underwriting) and pricing in life and health insurance is high-risk under Annex III of the AI Act. For those products the full high-risk regime applies. AI in other insurance lines is not automatically covered by Annex III, but remains subject to the GDPR, solidarity and gender-equality law and the prohibition of discrimination.

Which insurance falls under Annex III

Annex III, point 5 of the AI Act specifically lists AI systems intended for risk assessment and pricing in relation to natural persons in life and health insurance. The legislator chose these two lines because a wrong assessment there directly affects health, livelihood and access to care.

That does not mean AI in, say, motor or contents insurance is unrestricted. The Annex III high-risk label does not apply automatically there, but the other requirements — GDPR, transparency, non-discrimination — remain fully in force.

The high-risk obligations in practice

For life and health AI the requirements from the high-risk obligations overview apply: a risk management system, validated and representative data, technical documentation, logging, human oversight and a conformity assessment. The deployer (the insurer) must also use the system in accordance with the instructions and ensure human oversight.

GDPR, special data and solidarity

Underwriting and pricing often rely on health data, which as a special category under the GDPR require an extra-strict legal basis. Fully automated underwriting decisions also engage GDPR Article 22. In addition, fine-grained, data-driven premium differentiation conflicts with the solidarity principle underlying insurance: the more personal the price, the less risk is shared. EU rules on gender equality in insurance premiums continue to apply, even where a model does not use sex explicitly but approximates it through proxies.

What to do

• Determine the line: establish whether the system concerns life or health (then Annex III) or another line (then the GDPR route).
• Secure the GDPR basis: arrange a valid basis for health data and respect Article 22 for automated underwriting.
• Examine proxies: check whether variables indirectly approximate age, sex, origin or health.
• Guard solidarity: make policy choices explicit about how far premium differentiation may go.
• Document and connect to your AI governance framework.

AI makes underwriting faster and more precise, but in life and health that is exactly why the heaviest regime applies. Do not mistake line-specific carve-outs for a free pass.