A compliance officer at a general insurer is filling in the supervisor's sector-wide questionnaire, which has a section on AI. The list she can fill in is about models: fraud detection, claims estimation, a pricing model built by the actuarial team. Down the corridor, a claims handler pastes a solicitor's letter into ChatGPT to get a summary, with the claimant's name, policy number and a description of the injury still in it.
Both are AI applications at a supervised insurer. Only one of them is on the questionnaire.
#What insurance supervisors expect from AI
The short version: insurance law did not wait for the AI Act. When the Dutch supervisors AFM and DNB published their joint report on AI in April 2024 (checked 9 November 2026), they put it plainly: existing regulation applies in full when a financial institution uses AI. Sound governance, risk management and careful handling of client data apply to a model or a chatbot like to anything else.
Three recent publications say what that means in practice:
- EIOPA, August 2025: Solvency II and the IDD apply to all AI that is not high-risk, with attention to data governance, record-keeping, fairness, cyber security, explainability and human oversight.
- DNB, January 2026: document why and how an AI application goes live so the choices can be traced, then keep checking that it still does what it was meant to do.
- AFM, Agenda 2026: map your AI applications, strengthen model risk management and data quality, record decision logic and actively report incidents.
None of the three makes an exception for general tools that staff open themselves. That is where the gap in the opening paragraph comes from.
#What the Dutch central bank found at insurers
The Netherlands shows what a national supervisor does in practice. DNB surveys AI use across the insurance sector and follows up with reviews at a few firms. Its findings for 2025 (in Dutch, checked 9 November 2026): almost 80 percent of large and mid-sized insurers had one or more AI applications in use at the start of 2025, against 21 percent of smaller ones. A large share of the applications were built by the insurers themselves; about 21 percent come from third parties. Just over 70 percent of insurers take EIOPA's AI principles into account in their governance.
The follow-up reviews showed where it falls short. Steps taken, decisions made and parties involved were not always fully documented, and there were not always enough safeguards to keep monitoring an application after it went live. Hence DNB's two expectations: document before go-live, monitor afterwards. DNB is surveying the whole sector again in 2026 and may run deeper reviews in the second half of the year.
A year earlier, in AI at insurers: opportunities and risks (in Dutch, checked 9 November 2026), DNB had already said two things that matter for everyday use. AI systems that are not high-risk under the AI Act still need control and attention from the insurer. And so do AI systems supplied by external partners.
#The AFM wants every AI application mapped
The Dutch conduct supervisor looks at the effect on customers. In its Agenda 2026 (checked 9 November 2026) the AFM names opaque algorithms, bias and misleading information as risks to consumers and markets, and aims to make AI use more explainable and controllable.
Its four requests to firms are practical: map your AI applications, strengthen model risk management and data quality, record decision logic, and actively report incidents. The first carries the other three. You can only report an incident with a tool you know is in use, and only record decision logic for an application you know exists.
#EIOPA: existing insurance law, read for AI
On 6 August 2025 the European insurance supervisor published its Opinion on AI governance and risk management (checked 9 November 2026). It is addressed to national supervisors such as DNB and explains how they should read the Insurance Distribution Directive and Solvency II when an insurer uses AI. It sets no new requirements and does not change the scope of the AI Act.
The scope is the interesting part. AI systems that are high-risk or prohibited under the AI Act are left out, because the AI Act covers them. The Opinion is about everything else, which is most of the AI an insurer actually uses. For that, EIOPA asks for an approach that is risk-based and proportionate, and that covers data governance, record-keeping, fairness, cyber security, explainability and human oversight.
A claims handler summarising a letter is not using a high-risk system. That does not put the use outside the rules. It means the rules come through Solvency II and the IDD, to the degree the risk calls for.
#Where the AI Act comes on top
The AI Act lists risk assessment and pricing for life and health insurance in Annex III as high-risk uses. DNB wrote in January that the extra requirements would apply from 2 August 2026. Since the Digital Omnibus, the date is 2 December 2027; the rest of what moved is in the AI Act timeline. DNB sees very few such applications or pilots in the Dutch sector so far.
What applies already is Article 4: an insurer that uses AI takes measures to support the AI literacy of the people who work with it. What that asks since the Omnibus is in is AI literacy mandatory?. How to assess per system whether a use is high-risk, and how that works for mortgage underwriting, is in AI governance for mortgage and insurance organisations.
#Everyday AI use belongs in the same inventory
An insurer's models have an owner, a development process and often a model validation. The tools staff open themselves usually have none of that. An underwriter putting a medical questionnaire into a chatbot to make it easier to read, a customer service agent having a complaint letter rewritten: it happens in the browser, on an account nobody decided on. Such a tool has no decision logic to record. It is still an AI application from an external party, with client data in it.
What the supervisors ask for does translate:
- Map it. Which AI tools are actually used, and on which account. A survey of departments gives a snapshot; the use changes every month.
- Decide per tool. Allowed, limited use with a condition, not allowed with an alternative, or no decision yet. In the example organisation we use throughout, ChatGPT is widely used and has its own register file, DeepSeek is not allowed, and Microsoft Copilot is the approved alternative.
- Record it so it can be traced. Who decided, when, why, for which use, and which documents belong with it, such as a data processing agreement or a DPIA. That is what DNB means by choices that can be traced.
- Keep watching. Whether use changes after the decision, whether a tool without a decision is growing, and whether client data turns up where it should not.
That belongs in one AI register that also holds the models, not in a separate list. Under the GDPR, everyday use is often the bigger exposure. The Dutch data protection authority treats it as a personal data breach (in Dutch, checked 9 November 2026) when an employee enters personal data into an AI chatbot against the employer's rules. How that plays out for financial firms is in AI in financial services, and the third-party ICT side under DORA in AI and DORA.
BeeSensible shows in the Inbox which AI tools are in use in the organisation without a decision, under See. The decision per tool goes into the AI register, with use cases, owners, the status of documents such as the data processing agreement and the DPIA, a review date and a history of who changed what and when. When someone opens a tool with limited use or one that is not allowed, a notice in the browser shows the condition or the alternative. What happened over a period is in a report under Substantiate, in counts and without showing what anyone typed. The models an insurer builds or buys are outside what BeeSensible sees; they go into the register through their owner. How this works for the sector as a whole is on the financial services page.
The compliance officer from the opening paragraph can then answer the supervisor with both layers: the models and the tools at the desk, each with a decision that can be traced.
