EU AI Act August 2026 deadline: what it means for insurance underwriting decisions

``` html

Why underwriting AI is treated as high-risk

Systems used to assess and price risk for insurance are named directly in the Act's high-risk categories, because they materially affect a person's access to coverage. That classification isn't something a vendor's marketing can talk its way out of; it follows from what the system does.

What Article 26 asks of the insurer, not just the vendor

A deployer can't simply rely on a vendor's conformity paperwork. The insurer has to assign a named person with real oversight authority, monitor the system against live decisions rather than a one-time test, and be able to show that oversight is actually happening in production, not just documented on paper.

What this looks like built in, rather than bolted on

An audit logging layer that captures every risk-relevant event tied to an individual decision, a human oversight checkpoint with real visibility and override authority before a decision is finalised, and consistent rule enforcement across every case, not just the ones flagged for review.

FAQs

• Does the Act apply to a vendor's platform or to how we use it? Both, but the deployer obligations under Article 26 fall on the insurer using the system, independent of what the vendor has already done.
• Is claims processing covered the same way as underwriting? Underwriting and pricing are explicitly named; claims triage sits closer to a grey zone and should be assessed on its own facts, not assumed to follow the same classification.
• What's the practical first step? Confirm who holds named oversight authority today, and whether your current logging can produce event-level traceability for an individual decision. Most gaps show up in that second question.