In short. This module covers the use of AI and data in insurance: classifying use cases, automated decisions, health data and the timetable of the AI Act.
Learning outcomes
After completing this module you will be able to:
- classify an AI use case and the data processed;
- identify an automated decision within the meaning of GDPR Art 22;
- prepare a legal review and documentation plan.
Key points
Use cases differ
Text assistance, fraud signals, claims handling support and risk assessment and pricing in life and health insurance do not fall into the same risk class. Under point 5(c) of Annex III to the AI Act, AI systems intended to be used for risk assessment and pricing in relation to natural persons in life and health insurance are high-risk; classification is made under Article 6.
Automated decisions
GDPR Art 22 applies to a decision based solely on automated processing that produces legal or similarly significant effects; the exceptions in Art 22(2) and the safeguards in Art 22(3) (including the right to human intervention, to express one's point of view and to contest the decision) must be applied. Processing health data also requires a basis under Art 9. A formal human sign-off is not a substantive review.
Timetable
Under the AI Act as amended by Regulation (EU) 2026/1744, Chapter III Sections 1 to 3 apply to high-risk systems classified under Article 6(2) and Annex III from 2 December 2027 (point (c) of the third paragraph of Article 113). Later application does not suspend obligations under the GDPR or insurance law.
Supervisory expectations
EIOPA's Opinion of 6 August 2025 on AI governance and risk management sets out supervisory expectations also for systems that are not high-risk; it is interpretative guidance, not a new legal rule. Data quality, explainability, human oversight and complaints handling should be documented.
Read before the quiz
Articles on this site:
- AI risk insurance in Estonia: silent and affirmative cover
- Cyber claims in Estonia: NIS2, GDPR, ransomware and insurance
- EU regulations for insurers in Estonia: Rome I, DORA, PRIIPs
Legal sources:
- GDPR (EU) 2016/679, Arts 5, 6, 9, 13–15, 22, 35
- AI Act (EU) 2024/1689
- Amending Regulation (EU) 2026/1744
- EIOPA Opinion of 6 August 2025
Practical case
Write down your own answer before opening the suggested approach.
An insurer's model refuses to conclude a life insurance contract on the basis of health data; an employee confirms the result with one click without any substantive review. The customer challenges the decision. Prepare a legal review plan.
Suggested approach
Check: the legal basis for processing (GDPR Art 6) and the exception for health data (Art 9); whether the decision is based solely on automated processing (Art 22) and whether human involvement is substantive; the Art 22(2) exception and the Art 22(3) safeguards; information and explanations given to the customer (Arts 13–15); the data protection impact assessment (Art 35); data quality and the risk of discrimination; the AI Act classification (Annex III point 5(c)) and its date of application (from 2 December 2027); the complaints procedure and documentation.
Self-check quiz
Answer the three questions and press "Check answers". An explanation is shown for each question.