The EU AI Act and insurance pricing: what high-risk means in practice

The EU AI Act is the first broad law in Europe to regulate artificial intelligence by risk level. For insurers, one part of it matters most. AI systems used for risk assessment and pricing of individuals in life and health insurance are listed as high-risk. Those systems carry the heaviest set of obligations in the Act.

The obligations are phasing in over several years, and guidance on how they apply is still developing. Pricing teams do not need to wait for every detail to be settled before acting. Most of the controls the Act expects are good practice for any pricing model, whether or not AI is involved.

Which insurance systems are high-risk

The high-risk category covers AI systems intended to be used for risk assessment and pricing in relation to natural persons in life and health insurance. In practice that means models that use AI to decide whether to offer cover to an individual, or at what price.

Several points follow from this:

• It is about individuals. Pricing for businesses and commercial risks is not in this category.
• It is about life and health. Motor, home, pet, travel and other general insurance lines are not listed in the same way, although other parts of the Act and existing laws still apply.
• It is about AI systems. Whether a particular pricing tool counts as an AI system under the Act's definition depends on how it works. Traditional rating tables and formulas may fall outside it. Machine learning models used to set risk scores or prices are more likely to fall inside it.

Firms should take legal advice on how their own systems are classified. Many will decide to apply the same standards to all pricing, so they do not have to run two different control frameworks.

What the obligations cover

For high-risk systems, the Act sets out requirements that broadly group into these themes:

• Risk management. A documented process for identifying, assessing and reducing the risks a system creates, kept up to date throughout its life.
• Data governance. Controls over the data used to train, validate and test the system, including its relevance, quality and possible sources of bias.
• Technical documentation. A description of the system, how it was built, what it is meant to do and how it has been tested, detailed enough for an authority to assess it.
• Record-keeping. Automatic logging of the system's operation so that its outputs can be traced.
• Transparency. Clear information for the people deploying the system on how it works, what it is for and what its limits are.
• Human oversight. Design that allows people to understand, monitor and, where needed, override the system.
• Accuracy and resilience. Appropriate levels of accuracy, with protection against errors and misuse.

Providers and deployers of high-risk systems carry different responsibilities. An insurer that builds its own pricing model may be both.

What this looks like for a pricing team

The requirements translate into a fairly concrete set of practices:

1. Know which models are in scope. Keep an inventory of pricing models, what each one does, which products it prices and whether it uses AI techniques.
2. Make the logic readable. A model whose rates, rules and formulas can be read and reviewed is far easier to document than one that has to be explained after the fact.
3. Version every change. Each change should create a new version, and every quote should record which version priced it.
4. Test every version. Keep a set of known cases with expected results and run them on every change. This provides direct evidence of accuracy.
5. Keep a trace for each decision. Record the inputs, the values used at each step and the result, so any individual price can be explained.
6. Require human approval. Changes should be reviewed and approved by named people before they price live business.
7. Monitor outcomes. Review how the model performs once it is live, including how outcomes differ across groups of customers.

Lines outside the high-risk category

Motor, home and other general insurance pricing for individuals is not listed as high-risk, but it is still covered by consumer protection, equality and data protection law, as well as by insurance regulators' own expectations. Regulators across Europe and in the UK have been clear that firms using AI or complex models must still be able to explain their pricing and show it treats customers fairly.

Applying the same controls across all pricing is usually simpler than maintaining one standard for high-risk models and another for everything else. It also means a product that later moves into scope does not need to be rebuilt.

How Ptally supports this

Ptally models are readable JSON with their tests stored in the same file. Every version is recorded, and every version moves through draft, approval and publishing, with each status change logged against the person who made it and the time it happened. AI agents can edit drafts, but only people can approve and publish.

Every quote can return a debug trace showing each input, lookup, formula and rule that produced the price. Together with the test suite on each version, that gives a pricing team the records the Act's themes call for. Our article on explainability in regulated industries covers the wider approach.

Getting started

If you want your pricing models in a form you can document, test and trace, send us your rating guide or current model. There is no implementation fee and nothing to pay upfront. Talk to our team.

This article is general information and is not legal advice. Take advice on how the EU AI Act applies to your own systems.