EU AI Act for Insurance Brokers: What Counts as High-Risk AI?
The difference between customer-service automation and AI used for risk assessment or pricing in life and health insurance.
Start with the intended purpose
For insurance brokers, the useful question is not whether a supplier uses AI. The useful question is what the system is intended to do, which information it uses and whether its output influences a decision about a person. The AI Act follows a risk-based structure, while GDPR continues to govern personal-data processing.
This distinction matters commercially. A narrow communication workflow can remove repetitive work without silently becoming a decision engine. A broad promise to “automate the process” can conceal very different legal, operational and human consequences.
Where the high-risk boundary may appear
The AI Act specifically identifies AI used for risk assessment and pricing in relation to natural persons in life and health insurance as high-risk.
The current implementation timetable and supporting guidance continue to evolve. Organisations should classify the actual use case, document assumptions and obtain current legal advice rather than relying on a product label or an old compliance checklist.
Design a narrow operational scope
Keep customer intake and appointment booking separate from underwriting, eligibility, individual risk scoring and premium recommendations.
An assistant can identify the requested insurance category and arrange a licensed adviser call. It should not calculate a personalised life-insurance risk class unless that use is deliberately governed.
GDPR still applies to the data flow
AI classification does not replace GDPR analysis. Buyers still need to define purpose, lawful basis, data minimisation, transparency, recording, retention, access, processors, transfers, security and rights handling. Voice and free-text systems can capture much more personal information than a structured web form.
Design prompts around the minimum information needed for the next action. Where sensitive or special-category data may appear, use tighter access, shorter retention where appropriate and a tested human handoff. Recording should be a deliberate setting, not an automatic default.
Questions buyers should ask
Buyers in insurance brokers should ask the supplier to state the intended purpose, prohibited uses, data fields, model and infrastructure providers, storage locations, logging, monitoring, incident process and human-oversight design. Ask what happens when the system is uncertain, the user objects or the conversation moves outside scope.
Contracts should match the actual service. Determine which organisation acts as provider, deployer, controller or processor for each part of the workflow. Marketing terms such as “compliant platform” do not settle those roles.
A practical implementation path
Begin with a small number of repeatable scenarios and a written decision table. For every scenario, define the allowed action, required data, responsible person, escalation trigger and maximum response time. Test ordinary cases, ambiguous answers, refusals, language changes and emergencies.
The safest and most commercially useful automation usually makes routine communication faster while preserving human authority over consequential decisions. That boundary should be visible in product design, contracts, training and day-to-day operation.