Annex III point 5 lists AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance as high-risk use cases, subject to the Article 6 conditions and the profiling limit. That listing is specific to life and health insurance: other insurance lines, such as motor or property insurance, are assessed on their own function and provisions, and should not be assumed to be within or outside the listing without testing. A life or health pricing system must be classified under Article 6, with Chapter III duties following from 2 December 2027, while data protection, insurance regulation, equality and consumer duties apply on their own terms. This guide does not decide any specific pricing system and does not give actuarial or legal advice.
Which insurance functions are listed?
Annex III point 5(b) lists AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance. That covers systems that assess the risk a person presents for life or health cover and that set or influence the price, terms or availability of that cover on the basis of that assessment. A system that only administers policies, only handles claims paperwork without assessing risk, or only provides general information, is assessed differently, and the distinction must be recorded from the actual function. The record should describe what risk is assessed, what data are used, what price or underwriting output is produced, who uses the output and what decision follows. A system that prices motor or property cover is not within point 5(b) as written, but it can still engage other AI Act provisions, data protection law, insurance regulation and equality law, and its function must be tested on its own terms rather than assumed to be unregulated.
How is an insurance pricing system classified?
The decisive question for a life or health pricing system is usually profiling. Where the system evaluates a person from personal data, including health-related data, and the assessment feeds a price, terms or availability decision, the Article 6(3) route is unavailable and the system is high-risk where it falls within point 5(b). The file should say so directly, citing the data used, the risk assessment performed and the pricing output produced, rather than leaning on a claim that the system only assists a human or only performs a narrow task. Provider and deployer should describe the same system: the deployer needs the provider's classification and conformity information, and should record its own assessment for its portfolio, its population and its decision process. Health data brings a second, parallel assessment: the data protection position and the lawful basis for processing special-category data must be settled alongside classification, with qualified advice, before the system is used.
For the broader regulatory framework, see finance, insurance and critical infrastructure.
What data governance questions arise in insurance?
Pricing data deserves a sceptical reading. Historical claims and underwriting records can carry patterns that a model then reproduces, and features such as lifestyle, location or purchasing behaviour can stand in for a protected characteristic even when that characteristic is never entered as an input. The data governance work should therefore test relevance, accuracy and representativeness, examine bias in the features and the outcomes, and record the methods, findings and mitigations, with data protection, actuarial and equality advice involved from the start. Monitoring after deployment should look at pricing outcomes for the population actually served, watching for differences across groups that were neither intended nor justified. Special-category data, including health data, may be processed for bias detection only in the defined circumstances the consolidated text provides, and that position should be checked before any such processing begins, not assumed from the Act's general permission to examine bias.
What oversight and customer information are needed?
Oversight in pricing means a person who can genuinely second-guess the system: someone with the competence, the time and the authority to weigh the risk assessment and the price, to bring in information beyond the output, and to decide differently where the facts require it. Customers need a clear account of the AI use: that a system assessed their risk, which data and main factors fed the price, and how a decision can be challenged, within the information duties of insurance, consumer and data protection law. Complaints and appeals need a named owner and a timescale, and the Article 86 explanation right should be planned for where it applies. A price, or a refusal of cover, that follows a system output automatically, with no oversight and no explanation, does not match the deployment the Act describes, however accurate the model behind it may be.
What sector law sits alongside the AI Act for insurance?
Insurance regulation, including prudential and conduct rules, the distribution and disclosure duties, equality and non-discrimination law, and data protection law, all sit alongside the AI Act for insurance pricing and underwriting. Pricing must satisfy actuarial, fairness and transparency requirements under sector law, and the use of health and other sensitive data is constrained by data protection and equality law in ways the AI Act does not itself set out. The combined file should record the sector authorisation and conduct position, the data protection assessment, the equality and bias examination, and the AI Act classification and conformity position, with a shared system identifier. This guide gives no dates for sector law, and any sector date must be verified in the sector instrument itself. A pricing decision that is compliant with the AI Act but breaches insurance or equality law is not a lawful decision, and the file should be designed to prevent that gap by bringing the regimes together before the system is used.
Continue with credit scoring and creditworthiness.
What does this guide not decide?
No insurance pricing system is assessed here, and no price or underwriting decision is judged lawful or fair. Those questions turn on the system's function, data and outputs, the insurance line and decision process, and the insurance, data protection and equality law that applies, worked through on the specific facts with qualified advice. The actuarial validity of a pricing model is also outside this guide. Before a life or health pricing system influences a price or an underwriting decision, the classification, data governance, oversight, explanation and sector positions should be confirmed with a competent authority or legal adviser.
Frequently asked questions
Are all insurance pricing systems high-risk?
No. Annex III point 5(b) lists risk assessment and pricing for life and health insurance in relation to natural persons. Other insurance lines are assessed on their own function and provisions, and must not be assumed to be within or outside the listing without testing.
Can health data be used to test for bias?
Special-category data can be processed for bias detection only in the defined circumstances the consolidated text provides, with appropriate safeguards. The position should be checked with data protection advice before any such processing.
Must a customer be told AI was used in pricing?
Transparency, insurance, consumer and data protection duties can all require information to the customer. The information should be clear, given before the decision, and accompanied by a route to challenge it.
Continue through this AI Act cluster
This article is an informational overview, not a legal determination. Check the current legal text and official implementation guidance for your system and role.
Consolidated Regulation (EU) 2024/1689, as amended ↗AI Act Service Desk implementation timeline ↗