August 21, 2026 · 7 min read

AI Governance for Insurance: Claims Agents, Underwriting, and EU AI Act Compliance

AI-first startups accounted for 30% of all European insurtech deals in H1 2026, and every single B2B insurtech deal involved an AI-first company. Insurance AI is going agentic — autonomous claims processing, real-time fraud detection, dynamic underwriting. Under the EU AI Act, every one of these applications is classified as high-risk.

Why Insurance AI Is High-Risk

The EU AI Act's Annex III explicitly classifies AI systems used in insurance as high-risk when they are used for:

Risk assessment and pricing — AI that determines insurance premiums based on individual characteristics
Claims handling — automated or semi-automated claims decisions that affect payouts
Fraud detection — AI systems that flag or block claims as potentially fraudulent
Underwriting — automated decisions about whether to offer coverage and at what terms

This high-risk classification triggers the full set of EU AI Act obligations: risk management systems (Article 9), data governance (Article 10), technical documentation (Article 11), record-keeping (Article 12), transparency (Article 13), human oversight (Article 14), accuracy and robustness (Article 15).

Non-compliance penalties: up to €35M or 7% of global annual turnover, whichever is higher.

What Agentic Insurance Looks Like Today

The new generation of insurance AI isn't a simple classifier that flags claims for human review. It's an autonomous agent that:

Receives a claim submission (text, images, documents)
Extracts and validates claim details against the policy
Cross-references historical claims data for fraud patterns
Assesses damage from photos and documentation
Calculates the payout amount
Approves, denies, or escalates the claim
Generates the response to the policyholder

One European insurtech processes claims through this kind of pipeline with minimal human involvement. Another offers "ClaimOS" — autonomous claims handling including compliance checks, fraud detection, and customer communication. The speed is remarkable. The governance is often an afterthought.

The Explainability Gap

Some AI agent platforms build in explainability — step-by-step breakdowns of what the agent did and why. This is valuable, but it's not sufficient for regulatory compliance. Explainability answers the question "what did the agent do?" Governance answers the harder questions:

Was the agent authorized to make this decision? (Pre-execution policy check)
Can you prove the explanation hasn't been modified? (Cryptographic signature)
When exactly was the decision made? (RFC 3161 timestamp)
Can a third party independently verify this? (Public verification URL)

An explanation is a narrative. A receipt is evidence. Regulators accept evidence.

Governing a Claims Agent with Aira

from aira import Aira

aira = Aira(api_key="aira_live_xxx")

# Claims agent has assessed a claim and wants to deny it
decision = aira.authorize(
    action_type="claim_decision",
    details=f"Deny claim {claim_id}: water damage to basement. "
            f"Policy excludes flood damage per Section 4.2. "
            f"Estimated damage: €12,400. Recommended payout: €0.",
    agent_id="claims-agent-v3",
    model_id="claude-sonnet-4-6",
    policy="rules + AI + human_approval",
    metadata={
        "claim_id": claim_id,
        "policy_number": "POL-2026-88421",
        "claim_type": "property_damage",
        "decision": "deny",
        "reason": "flood_exclusion",
        "estimated_damage_eur": 12400,
        "recommended_payout_eur": 0,
    },
)

if decision.status == "approved":
    # Denial is authorized — send to policyholder
    send_denial_with_receipt(claim_id, decision.verify_url)
elif decision.status == "escalated":
    # Held for human claims adjuster
    route_to_adjuster(claim_id, decision.approval_url)

Notice the last line: send_denial_with_receipt. Under Article 22 of the GDPR and Article 86 of the EU AI Act, policyholders have a right to meaningful information about automated decisions that significantly affect them. By including the verification URL in the denial letter, you give the policyholder — and their lawyer — an independently verifiable record of exactly what happened.

Content Scanning for Insurance Documents

Insurance claims involve sensitive personal data: medical records, property addresses, financial information, photographs. Before this data reaches an LLM for processing, it needs scanning:

# Scan claim documents before sending to LLM
scan = aira.scan(
    content=claim_documents,
    content_type="pdf",
    checks=["pii", "phi", "secrets"],
    action="redact",  # Redact PII before LLM processing
)

# Now process with the claims agent using sanitized content
agent_input = scan.sanitized_content

Aira's scanner detects PII across text, images, PDFs, and DICOM medical images. For insurance, this means SSNs, IBANs, medical record numbers, and personal addresses are caught and redacted before they reach the AI model — satisfying both GDPR data minimization requirements and EU AI Act data governance obligations.

Selling to Regulated Insurers

If you're an insurtech selling AI agent products to regulated insurance companies, governance is your sales unlock. When Allianz, AXA, or Zurich evaluates your claims agent, the first question from their compliance team will be: "How do you govern your AI?"

Without an answer, the deal dies in procurement. With Aira, your answer is a live demo: show them a claims decision, show them the cryptographic receipt, show them the public verification URL. Let them verify it themselves — no account needed.

This is the difference between "we have explainability" and "here's cryptographic proof any regulator can independently verify." One is a feature. The other closes the deal.

Start with Aira's free tier to integrate governance into your insurance AI. Or explore the documentation for the full API reference.