What Is AI in Insurance?
AI in insurance refers to the use of machine learning, natural language processing and generative models across the insurance value chain: distribution, underwriting, pricing, policy administration, claims, fraud detection and customer service. It spans two broad families of technology with very different risk profiles, and insurers who treat them as one category tend to get into trouble.
Predictive models have been part of insurance for years. Actuarial scoring, propensity models and fraud triage engines are statistical systems with measurable error rates and stable inputs. Generative AI is different. It produces text, summaries and recommendations from unstructured material such as adjuster notes, medical reports, broker emails and call transcripts. Its outputs are harder to test, harder to reproduce and much easier to trust without checking.
That distinction matters because insurance is a documentation business. A single motor claim can involve a first notice of loss, a police report, photographs, repair estimates, medical notes and a chain of correspondence. Generative AI is genuinely good at reading that pile. It is also capable of stating something confidently that appears nowhere in the file.
Why Insurers Are Investing in AI Now
The pressure is operational. Claims volumes are cyclical and staffing is not. Underwriters spend a substantial share of their time locating and re-keying information rather than assessing risk. Contact centres carry long handling times on questions that are answered somewhere in the policy wording. Document-heavy work is expensive, slow and difficult to hire for, and it sits directly on top of loss ratios and service metrics.
There is also a supervisory backdrop. International standard-setters have accepted that AI is already embedded in insurance operations and have moved to clarify expectations instead of prohibiting use. The IAIS Application Paper on the supervision of artificial intelligence reaffirms that insurers remain responsible for understanding and managing these systems and their outcomes, including where AI comes from third-party model vendors. The commercial case for AI is real. So is the expectation that the carrier, not the vendor, owns the result.
The Biggest Challenges of AI in Insurance
Insurance companies face AI adoption challenges because their data is fragmented across decades of systems and acquisitions, many core workflows still run on platforms that were never designed for real-time integration, and outputs must be reliable enough to support decisions that affect a policyholder's money. The obstacles below are the ones that consistently stall programmes between demonstration and production.
Poor Data Quality and Fragmented Data
Insurance data is rarely in one place and rarely consistent. A single customer may exist three times across a personal lines book, a legacy acquisition and a broker-sourced portfolio, with different identifiers in each. Claims notes are free text written under time pressure. Product definitions differ by state, country and policy generation.
Models inherit all of it. An underwriting assistant trained or grounded on inconsistent exposure data will produce answers that look precise and are quietly wrong for a subset of the book. The practical implication is that data remediation is usually the longest part of the project and the least visible to the executives funding it.
Legacy Policy and Claims Systems
Core administration platforms are the backbone of the business and the hardest constraint on AI. Many were built long before API-first architecture, so getting data out in real time means batch extracts, middleware or screen-level workarounds. Writing data back is harder still, because the system of record carries regulatory, actuarial and financial reporting weight.
This is why so many insurance AI tools end up as read-only assistants beside the workflow rather than inside it. A handler who has to leave the claims screen, paste text into another tool and copy a summary back is not saving much time.
Integration Into Real Workflows
An AI capability only creates value at the point where a decision is made. In claims, that means triage, reserving, coverage review and settlement authority. In underwriting, it means referral handling and risk appetite checks. Integration involves permissions, audit trails, exception routing and what happens when the model is unavailable at 2am during a storm surge.
Teams often underestimate the last point. Insurance operations run to service standards, and an assistant that fails silently during a catastrophe event creates a backlog rather than absorbing one.
Model Reliability and Hallucinations
Generative models produce plausible language regardless of whether the underlying fact exists. In a claims context, that can mean a summary that states a treatment date, a policy limit or an exclusion that is not in the documents. The error is not obvious, because the writing is competent.
Consider a claims team using an LLM to summarise a 200-page bodily injury file. The summary is useful and saves an hour. It also omits a single line about a prior injury that materially affects the reserve. Nothing in the output signals the gap. Controls therefore have to be designed around verification, such as forcing citations back to source pages, restricting the model to retrieval over a defined document set, and measuring accuracy on a labelled sample rather than on user satisfaction.
Human Oversight and Accountability
Oversight in insurance has to be specific. Someone must be named, competent and able to override. Supervisors have been explicit about this. The IAIS published its final Application Paper on AI supervision in July 2025, reinforcing that existing expectations around governance and conduct remain essential considerations for supervisors and insurers using AI systems. EIOPA's Opinion on Artificial Intelligence governance and risk management, addressed to national supervisors, takes a risk-based and proportionate approach to balancing the benefits and risks of AI systems in insurance.
In practice, oversight fails in a predictable way. A handler reviews the first fifty AI outputs carefully, finds them good, and stops reading closely by the second week. Governance that depends on sustained human vigilance without sampling, measurement or escalation triggers is governance on paper.
Handling Sensitive Policyholder Information
Insurance files contain some of the most sensitive categories of personal data in commercial use: health records, financial details, criminal allegations in liability matters, household composition. Sending that material to a third-party model raises questions that procurement checklists were not written for, including retention, subprocessors, training use and jurisdiction of processing.
This is where deployment architecture becomes an implementation decision rather than a compliance formality. Insurers evaluating AI for claims or underwriting increasingly look at whether identifying information needs to reach an external model at all, or whether it can be removed or masked before the prompt leaves the perimeter. Handling in Secure platform Questa AI works in that layer, anonymising sensitive business data before it reaches a language model and offering self-hosted deployment for organisations that cannot let data leave their own network. The relevant point for insurers is the design question, which is how much exposure a given workflow actually requires. Our guide to protecting AI systems with a privacy-first architecture goes further into that decision.
Third-Party Models and Vendor Dependency
Most carriers will buy rather than build. That introduces concentration risk, version risk and an information gap. Model behaviour can change with a vendor update, and the insurer may discover it through a shift in output quality rather than a release note. Contracts that cover uptime and support often say little about model changes, evaluation access or exit.
The IAIS position is that oversight of an externally supplied AI system should match what the insurer would apply to one it built itself. That is a high bar, and it starts at procurement. A structured approach to evaluating AI vendors is worth more than a security questionnaire completed after selection.
Scaling Beyond the Pilot
Pilots run on curated documents, a cooperative team and a narrow product line. Production runs on the whole book, including the 1998 policy wording, the scanned fax, the claim submitted in a second language and the broker who attaches everything as a single PDF. Accuracy that held at 94 percent in the pilot can drop sharply on the long tail, and the long tail is where the expensive claims live.
Scaling also surfaces cost. Token spend, human review time and monitoring are ongoing operating expenses, and they rarely appear in the business case that got the pilot approved
Measuring Performance and Business Value
Insurers measure cycle time, leakage, loss ratio, expense ratio, complaints and persistency. AI programmes frequently measure adoption, usage and sentiment, none of which appear in a board pack. Without a baseline captured before deployment, there is no defensible way to say whether the system improved anything.
Measurement also has a regulatory dimension, because demonstrating that a model is not producing unfair outcomes requires outcome data, not usage data.
