The pricing committee of a medium sized life and health insurer meets in October for the yearly review of the tariff for term life cover. The actuarial team proposes to replace part of the generalised linear model with a gradient boosted model that picks up interactions between age, occupation and the answers on the health declaration. Whether the new model is a high risk system under the European Union Artificial Intelligence Act is not on the agenda, because that question has no owner in the room.
It needs one. Annex III of the Act lists, under point 5(c), systems intended for risk assessment and pricing in relation to natural persons in the case of life and health insurance. The obligations for those systems apply from 2 December 2027. The date was 2 August 2026 until the amending regulation of 8 July 2026 moved it. De Nederlandsche Bank reports in its supervisory outlook for 2025 and 2026 that most insurers use artificial intelligence in regular business processes, so far with few high risk applications, and that clear governance with a worked out policy and recorded roles is not in every case in place before an application goes into use. For 2026 it names compliance with the Act as a focus of its supervision of insurers.
The usual response is a policy written by the compliance function and a line in the model register that reads "regression, out of scope". That line leans on the European Commission's guidelines on the definition of an artificial intelligence system, which place long established linear and logistic regression methods outside the definition. Nothing in that passage covers the gradient boosted component the committee has just approved. The exemption in Article 6 for narrow or preparatory tasks is of little use either, since the same article states that a system which profiles natural persons is always high risk.
The second gap is the role. An insurer that develops its pricing model itself and puts it into service under its own name is the provider of that system as well as its deployer. The provider carries the heavier file: a quality management system, technical documentation, a conformity assessment, a declaration of conformity and registration. For Annex III systems the conformity assessment is done by internal control, without a notified body, so nobody outside will hand the insurer a certificate. As deployer the insurer must also carry out a fundamental rights impact assessment before first use; Article 27 names life and health pricing expressly.
The transitional rule rewards a careful reading. A high risk system put into service before 2 December 2027 comes under the Act only if its design changes significantly from that date. An insurer that reviews its tariff every year should expect that moment to come early. The Commission has not said whether a yearly review that changes the model family counts, and a board that plans on the answer being no is taking a position it will have to defend to its supervisor.
Underneath lies the question of where the data may go. A health declaration is special category data under the General Data Protection Regulation, and Article 22 of that regulation restricts decisions based solely on automated processing, with a stricter condition for special categories. So the insurer decides per type of work. Training and scoring the pricing model on health declarations belongs on the insurer's own premises or in a private deployment in a European region. A letter to an intermediary without medical detail can go through the online interface of a model provider under contract. A model in the insurer's own data centre needs the same file as one that runs elsewhere, because the obligations attach to the role of provider or deployer wherever the system runs.
The governance is therefore identical on all routes: an inventory of what is used, the role under the Act, the supplier file that the Digital Operational Resilience Act requires for any outside provider, evaluation on the insurer's own portfolio, logging, human oversight, staff competence and an incident route. For systems below the high risk line the Opinion of the European Insurance and Occupational Pensions Authority of 6 August 2025 already sets expectations, scaled to the impact of each system, and makes the members of the board responsible for the overall use of artificial intelligence. Fines under the Act for breaches of operator obligations run up to 15 million euro or 3 percent of worldwide annual turnover, whichever is higher.
The AI Guys, a Dutch firm that works on compliance for artificial intelligence in regulated industries, supports this work from the route decision through to implementation.
By the pricing committee of November the board member who holds risk should have four papers on the table. A classification memo for every pricing and underwriting model, stating whether it is an artificial intelligence system and whether it is high risk. A role statement that says for each model whether the insurer is provider, deployer or both. A route decision for health data. And a dated plan that works back from 2 December 2027 to the first fundamental rights impact assessment, with the name of the person who signs it.