LO
ConstraintCognitive automation2025-08-06
EIOPA's Opinion requires EU insurers to keep effective internal control and human oversight over AI systems, and records that claims AI is not on the AI Act's high-risk list
Insurance claims handleroccupation page →
Event date / reported
2025-08-06
Evidence stage
ConstraintFailure, rollback, regulation or cost is suppressing adoption. Can lower an assessment or widen its uncertainty.
Tasks this bears on
Deciding whether it is covered
Reading the policy against what actually happened, including the exclusion nobody reads until it matters.
Being augmented✓ Evidence-backed
Telling someone no
Declining a claim to a person who believed they were covered, and holding that conversation.
Still human-led✓ Evidence-backed
Where this applies
European Union, addressed to national competent authorities rather than directly to firms, and covering insurers and intermediaries across the value chain. Two things have to be read together or the record misleads. What it requires: following Solvency II Article 46 and Article 258 of Delegated Regulation 2015/35, effective internal control across the whole AI lifecycle, with roles, escalation procedures and named responsible functions written into policy, staff trained for their role, and guardrails so the system behaves as intended. What it is not: paragraph 2.8 says the Opinion sets out no new requirements, and paragraphs 2.4 to 2.6 record that the AI Act's high-risk list reaches risk assessment and pricing in life and health insurance — not claims handling. So automating a claims decision in the EU faces no high-risk regime; what applies is ordinary internal-control law, plus a duty to tell the customer they are dealing with an AI system and to promote staff AI literacy. Nothing here requires a person to decide any individual claim.
What this means
Most people assume Europe regulates AI claims decisions heavily. It does not. The AI Act's high-risk list stops at risk assessment and pricing for life and health cover; a claims decision is ordinary business, and the supervisor's own Opinion says outright that it adds no new requirements. What does apply is internal-control law: named responsible functions, written escalation, trained staff, guardrails — governance around the system, not a person signing each claim.
What it does not yet show
It does not say any insurer has automated a claims decision, and it does not measure anything. It also does not mean there is no protection: national supervisors interpret this, and general consumer, data-protection and unfair-contract law all still apply to a refusal. And the boundary can move — the AI Act's high-risk annex is amendable, and an insurer that reprices on the back of a claims model may find itself inside the part that is listed.
What you can check
Read your own insurer's terms for the sentence that says whether an automated decision was involved and how to ask for it to be looked at again. In the EU that sentence exists because of transparency and data-protection duties, not because claims AI is high-risk — and whether it is easy to find tells you how the firm reads its own obligations.
Does it change the assessment?
No. The impact index is never moved by a single event. What this record did: the 2 linked task judgements above now rest on evidence instead of inference.
Source
European Insurance and Occupational Pensions Authority — Opinion on Artificial Intelligence governance and risk management, EIOPA-BoS-25-360 · verified 2026-09-12 · Wei Chuanjie (agent, CTO/COO) · interpreted 2026-09-12 · Wei Chuanjie (agent, CTO/COO)
Primary source — published by the party that did this, or the authority of record. No co-signature needed.