A complete sample report from discovery

Voorbeeld Leven en Zorg is a fictitious insurer: the client, its systems, its people and every finding in this report are invented for illustration, while the rules, articles and dates are real.

The discovery found eight artificial intelligence systems in use; the model register lists three. One of them, the pricing model for term life cover, is on the high risk list of the European Union Artificial Intelligence Act once the gradient boosted component approved in September 2026 is part of it: Annex III, point 5(c), lists risk assessment and pricing of natural persons for life and health insurance. The insurer builds the model itself, so it is provider as well as deployer. The register calls the model regression, out of scope, and nobody owns the question.

The high risk duties do not apply yet; they apply from 2 December 2027. Three gaps lie under rules in force. The customer service chat assistant does not say that it is an artificial intelligence system. Two of five suppliers with a model are missing from the register of information. An applicant whose premium is raised or whose application is refused receives no reasons.

The board is asked for three decisions. First, name the board member who holds risk as owner of classification and role, and classify the pricing model as high risk with the insurer as provider and deployer. Second, adopt the data route per type of work: health data only on the insurer's own premises or in a private deployment in a European region, and no personal data in a tool without a contract. Third, decide how to read Article 111(2) of the Act: a system put into service before 2 December 2027 comes under the Act only if its design changes significantly from that date. The insurer reviews its tariff every year, we found no text of the European Commission on whether such a review counts, and we advise planning on the answer being yes.

The dates that matter: the Digital Operational Resilience Act has applied since 17 January 2025, the staff competence duty of the Act since 2 February 2025, its transparency duty since 2 August 2026; the high risk duties follow on 2 December 2027. De Nederlandsche Bank names compliance with the Act as a focus of its supervision of insurers in 2026.

The discovery covered pricing, underwriting, claims, customer service, the call centre and the technology department. Per system we established owner, supplier, data, role under the Act and risk class; per type of work, the data route. We set the findings against the Act, the Digital Operational Resilience Act, the General Data Protection Regulation and what the insurance supervisors expect.

We held fourteen interviews: the board member who holds risk, the holder of the actuarial function, the heads of compliance, information technology, underwriting, claims and procurement, the data protection officer, the manager of the customer service centre, two pricing actuaries and three daily users. We read the model register, the draft policy, the register of information, five supplier contracts, the documentation of the pricing model and the minutes of the pricing committee. A questionnaire on tools used on own initiative was answered by 212 of 460 members of staff.

We inspected no source code, model files, data, logs or production systems and visited no supplier. The firm inspects nothing with automated tools, so use that nobody reported is missing, and the figures on staff use are a lower bound.

Role and risk class are our reading; two classifications are open and need a written memo. Not high risk means: not within Annex III, point 5, on our reading; the memo checks the other points. Below the high risk line the Opinion of the European Insurance and Occupational Pensions Authority of 6 August 2025 applies, with measures scaled to impact.

The register line on the pricing model leans on the guidelines of the European Commission, which place long established linear and logistic regression outside the definition of an artificial intelligence system. On our reading that passage does not cover the gradient boosted component. Article 6(3) exempts narrow preparatory tasks and adds that a system which profiles natural persons is always high risk.

Per type of work the insurer decides where data may go: the online interface of a model provider under contract, a private deployment, or only its own premises. No route by itself makes the insurer compliant. The duties under the Act attach to the role, wherever the system runs. Own premises removes the transfer outside the Union and the outside processor for that step; legal basis, data minimisation, retention, the rights of persons and security remain.

A private deployment in a European region keeps processing inside the Union and leaves the provider subject to the law of its home country. The governance is the same on every route: inventory, role, supplier file, evaluation on the insurer's own work, logging, human oversight, staff competence and an incident route. The fourth column lists what the route adds.

Severity is our judgement of the consequence if the gap stays. A ceiling is the most the law allows and not a typical fine; every amount is preceded by the words up to.

Two ceilings recur. Article 99(4) of the Artificial Intelligence Act: up to 15,000,000 euros or, for an undertaking, up to 3 percent of total worldwide annual turnover of the preceding financial year, whichever is higher. Article 83(5) of the General Data Protection Regulation: up to 20,000,000 euros or, for an undertaking, up to 4 percent of that turnover, whichever is higher. The Digital Operational Resilience Act sets no amount: under Article 50(3) each member state lays down the penalties, which under Article 50(5) can reach members of the management body. National amounts are left out.

Articles 16, 26 and 27 apply from 2 December 2027. A gap against them is a gap in preparation, not a breach.

On our reading a model inside a bought service makes its provider a subcontractor of the supplier. Under Article 28 of the Digital Operational Resilience Act the insurer remains fully responsible. Paragraph 3.11 of the Opinion of 6 August 2025 adds that an insurer should obtain adequate information and assurances about the characteristics, the capabilities and the data used to train and test the systems it uses.

Per model provider the file holds: the assessment before contracting, with the concentration assessment of Article 29; the contract with the contents of Article 30(2); the register entry; the deployment type and what the provider documents on processing location, retention and training on customer data; the assessment of origin that Opinion 28/2024 of the European Data Protection Board asks; the evaluation on the insurer's own work; and the exit plan.

No supplier has a complete file. Two contracts do not name the model provider, none states the deployment type, and no file holds an evaluation or an exit plan. In each case the model was added to a service the insurer already bought, so nobody assessed it before contracting. A model on own premises needs a file too: origin, licence, evaluation and updates replace the contract.

On every route a running system does three things. It records each outcome with the input, the model version and the moment: from 2 December 2027 Article 26 of the Act asks the deployer of a high risk system to keep logs for at least six months, and paragraph 3.23 of the Opinion of 6 August 2025 asks for records that make results reproducible and traceable. It places a person in the decision: Article 26 asks for oversight by persons with competence, training and authority, and Article 22 of the General Data Protection Regulation restricts decisions by software alone. It is evaluated on the insurer's own portfolio, before and during use. Personal data may not be kept longer than needed, so log retention and deletion are designed together.

The pricing model has a sound start: the actuarial team validated the gradient boosted component against the generalised linear model on applications held back from training. The validation does not compare outcomes per group of applicants, and nothing is planned after the model goes into use. Production stores premium and score without the model version, so last year's outcomes cannot be reproduced. An underwriter sees an application only above a set sum insured; no person is named for oversight, and nobody has recorded authority to set an outcome aside. The incident route covers personal data breaches, with the notification within 72 hours of Article 33 of the General Data Protection Regulation, but not a model that prices wrongly.

The table gives no dates and no phases: the board sets the schedule. The order follows only from what each action depends on. Size is the effort of the insurer's own people.

Much of this needs no outside help.

The board can name the owner and have the register line corrected in one meeting.

The supplier can add the notice to the chat assistant; it is a change of text.

Procurement can ask each supplier in writing which model it uses, who provides it, where data is processed and which deployment type applies. The answers fill most of the register of information.

The data protection officer can review automated outcomes against Article 22 and draft the letter with reasons.

The actuarial team can store the model version and extend its validation to groups of applicants.

Outside help earns its cost in three places: a disputed classification, which a lawyer should confirm; the provider file, which is new to an insurer; and evaluation on the insurer's own work when a route changes.

This report rests on documents and interviews. Nothing was tested in production, and no code, data, logs or supplier was inspected.

It is not legal advice. The readings marked as ours are not sourced facts, among them: that the regression passage does not cover a gradient boosted model; that pricing on personal characteristics is profiling; that a yearly tariff review which changes the model family is a significant change in design; and that the model provider behind a supplier is a subcontractor. A lawyer should confirm each.

Not verified on 5 October 2026: whether the European Commission has published its guidelines on high risk classification, and the status of the Dutch implementing act, which settles the division of supervision between De Nederlandsche Bank and the Autoriteit Financiële Markten.

The report certifies nothing. For Annex III systems the provider assesses conformity itself by internal control, without a notified body, so nobody hands the insurer a certificate. Following the roadmap closes the gaps we found; it is not a statement that the insurer complies.