If your firm uses AI in pricing, underwriting, or claims, you're operating under Annex III §5(c) of the EU AI Act and the 2025 EIOPA Opinion on AI Governance. cosantio gives MGAs, brokers, and carriers the workflow, artefacts, and named officer to be audit-defensible in time. Examples here are drawn from the Irish market we know best, but the obligations apply to insurers across the EU, with some country-specific variation.
Insurance AI in Ireland and the EU is regulated by more than the AI Act. The four frameworks below overlap. cosantio's Insurance Scorecard maps your firm against all four at once.
Source: Regulation (EU) 2024/1689
Classifies AI used for risk assessment and pricing of life and health insurance as high-risk. Triggers obligations on technical documentation, human oversight, accuracy, FRIA, EU registration, and post-market monitoring.
Source: EIOPA-BoS-25/360 · August 2025
Sector-specific supervisory expectations on AI governance and risk management, including data governance, record-keeping, fairness, explainability, human oversight, and cyber security, applied on a risk-based, proportionate basis. National competent authorities, including the Central Bank of Ireland, supervise on these terms.
Source: IDD POG · 2017/2358
If AI is part of product design, pricing, or target market identification, the product must be tested against customer outcomes and value-for-money. Periodic review, distribution monitoring, and intervention triggers are mandatory.
Source: Central Bank of Ireland
Sector-specific Irish supervision. Operational resilience under DORA, fitness and probity for AI decision owners, and conduct expectations under the Consumer Protection Code. AI Act compliance does not replace it; it sits alongside.
The AI Act treats your firm differently based on whether you develop the AI or use it. That distinction (provider vs deployer) shapes which Article 16 or Article 26 obligations apply.
Managing General Agents who build or significantly modify pricing models, underwriting algorithms, or claims-triage AI. Acting as provider under Article 25 means full Article 16 obligations.
Insurance intermediaries using third-party pricing engines, quote tools, or claims AI. Acting as deployer under Article 26 means a lighter but still substantive set of obligations.
Insurers operating in EU markets, often both providers (in-house pricing and underwriting AI) and deployers (third-party fraud and claims systems). Both obligation sets apply, per AI system.
Article 25 caveat. Modifying a third-party AI system substantially (including changes to its intended purpose) reclassifies the deployer as a provider. A broker that fine-tunes a third-party pricing engine on its own book of business is almost certainly a provider, not a deployer. The Scorecard surfaces this where it applies to your firm.
Real systems we see across Irish and EU insurance firms. Classifications and obligations below are illustrative; your firm's classification depends on the specific use, not the product name.
Excerpt from a sample Annex IV technical dossier for a life-insurance pricing engine. Every finding cites firm-specific evidence; every gap names an owner and a date.
The Scorecard is the same eight questions for every sector, but the result is sector-specific. Insurance firms get EIOPA Opinion alignment, POG mapping, and a §5(c) FRIA readiness check layered on top of the core readiness assessment.
Free · 3 minutes · no login
Eight plain-English questions. A regulator-grade PDF that scores your firm against every AI Act obligation already in force, with insurance-specific framing throughout.
Demo · 20 minutes · with our team
The full Annex IV workflow inside the platform: 25 questions across 11 pillars per AI system, producing a regulator-grade technical dossier for the Central Bank, EIOPA-aligned auditors, or your carrier. Book a demo to walk through a sample and the insurance-specific features.
Eight questions. Three minutes. A regulator-grade PDF with §5(c) classification, EIOPA Opinion alignment, and a prioritised action plan for your firm.