Introduction
AI use is becoming widespread among Irish insurers. A recent Central Bank of Ireland survey found that 85% of 53 responding firms were using AI to some extent, with 94% expecting to use it within three years. While the EU AI Act introduces additional requirements for these insurers, the sector is not starting from a blank page.
In its August 2025 Opinion, the European Insurance and Occupational Pensions Authority (EIOPA) noted that the use of AI in insurance is already subject to insurance-sector regulation and supervision. Existing insurance-sector legislation continues to apply to insurers' use of AI. EIOPA's Opinion focuses on AI systems that are neither prohibited nor classified as high-risk under the AI Act, avoiding overlap with the specific requirements that apply to those systems.
EIOPA has also highlighted the importance of transparency, AI literacy and responsible-use frameworks when deploying AI systems. This includes ensuring that relevant staff understand the capabilities and limitations of AI tools, promoting appropriate transparency around their use, and encouraging the adoption of internal policies or codes of conduct to support responsible AI practices. These expectations sit comfortably alongside existing Solvency II governance principles and reinforce the need for insurers to embed AI oversight within established governance structures rather than treating AI compliance as a standalone exercise.
The Central Bank of Ireland is also monitoring insurers' approaches to AI. Its survey highlighted both the rapid adoption of AI across the sector and the need for firms to ensure that technological adoption strengthens rather than undermines their ability to price fairly, reserve adequately and treat customers appropriately.
For insurers, the challenge is to incorporate AI-specific obligations into existing governance, risk management and assurance arrangements, with clear accountability for how systems are developed, deployed and monitored.
From standalone compliance to integrated governance
Solvency II asks whether the insurer is run in a sound and prudent manner; the AI Act asks whether AI systems are appropriately classified, controlled, transparent, monitored and subject to meaningful human oversight. When an insurer uses AI in underwriting, pricing, claims, fraud monitoring, customer interaction or actuarial work, these questions intersect.
The Society of Actuaries in Ireland has made this integration point explicitly in its consultation response on national implementation of the AI Act. It noted that there are horizontal regulations to consider alongside the AI Act, including GDPR and DORA, as well as industry-specific legislation such as Solvency II and the Insurance Distribution Directive for insurers. It also argued that AI Act governance should form part of integrated assurance programmes rather than becoming a standalone effort.
Establishing AI governance entirely separately from existing insurance governance may create duplication, gaps and unclear ownership. A better approach is to allocate responsibilities through the existing three-lines-of-defence structure, supported by AI-specific policies and controls where required.
What changes under the AI Act?
The most visible change is risk classification. Ireland's official AI Act guidance describes a risk-based framework, including prohibited uses, high-risk systems, specific transparency risks and minimal-risk systems.
Following amendments introduced through the Digital Omnibus on AI, the principal compliance milestone for insurers is now the phased introduction of high-risk AI requirements, with Annex III high-risk systems becoming subject to the relevant requirements from 2 December 2027 and certain product-linked high-risk systems following from 2 August 2028. These changes do not postpone the AI Act as a whole, with other requirements already applying. For insurers, this creates a need to inventory AI systems, classify them and apply proportionate controls. Insurers must first establish which systems fall within the AI Act's definition of AI and classify them according to risk. Not every statistical model or automated process qualifies, so classification should reflect how the system operates and its intended use.
The AI Act expressly identifies AI systems intended to be used for risk assessment and pricing in relation to natural persons in life and health insurance as high-risk. Equivalent non-life insurance applications are not specifically listed under that category in Annex III, although individual systems may fall within other high-risk categories. Non-life insurers should therefore assess individual AI applications against the Act's broader classification framework rather than assuming they are automatically high-risk.
High-risk classification changes the level of evidence expected. Providers of high-risk AI systems must meet requirements including establishing a risk management system, applying appropriate data governance, drawing up technical documentation, enabling automatic logging, providing instructions for use to deployers, establishing a quality management system and designing the system to achieve appropriate levels of accuracy, robustness and cybersecurity while enabling effective human oversight. The distinction between providers and deployers is particularly important. An insurer that develops or substantially modifies an AI system may be regarded as a provider and therefore become responsible for a broader set of obligations relating to governance, documentation, risk management and conformity.
By contrast, an insurer using a third-party solution will typically act as a deployer. Deployers generally need to use the system in accordance with its instructions, assign human oversight to suitably competent persons, monitor its operation and retain logs where those logs are under their control. Understanding where an insurer sits within this framework is therefore a key compliance consideration. For a Solvency II insurer, these are not alien concepts; they resemble existing disciplines around governance, risk management, model control, documentation, operational resilience and assurance. The difference is that the AI Act applies them with AI-specific precision and enforcement consequences.
The Solvency II functions through an AI lens
Board and senior management
Boards should have oversight of material AI applications, with clear responsibility for approving their use and managing associated risks. Reporting should establish what systems are being used, who owns them and how their performance and potential effects on policyholders are monitored.
Risk management
AI risks should be assessed alongside existing model, conduct, operational, cyber and outsourcing risks. For material applications, assessments should cover model performance, data quality, fairness, explainability, human oversight and monitoring for changes in performance.
Compliance
The compliance function should assess applicable obligations under the AI Act alongside GDPR, DORA and insurance regulation. This includes maintaining regulatory classifications, identifying provider and deployer responsibilities and monitoring compliance with relevant requirements.
Actuarial function
Where AI affects technical provisions, underwriting policy or reinsurance, the actuarial function should consider the implications within its existing Solvency II remit. Actuarial expertise may also support pricing and model validation, including assessments of reliability, explainability and customer outcomes.
Outsourcing and third-party risk
Where AI systems or services are provided by third parties, insurers should consider appropriate due diligence, contractual controls, ongoing monitoring and the implications of their role as deployer.
Data governance
Existing data governance frameworks should address the quality, provenance, representativeness and lineage of data used by AI systems, together with appropriate controls over data limitations and bias.
Internal audit
Internal audit should assess whether AI governance controls operate effectively. This includes checking that systems are identified, classified, approved, documented and monitored, with evidence of appropriate human oversight and follow-up when issues arise.
Why this matters for Irish insurers
Ireland has adopted a distributed supervisory model, with the AI Office of Ireland acting as the central coordinating authority and Single Point of Contact for the AI Act. The Central Bank of Ireland is one of the designated authorities and acts as market surveillance authority for specified prohibited practices and certain Annex III financial-services high-risk systems, including life and health insurance risk assessment and pricing where these systems are used by regulated financial service providers in direct connection with regulated financial services.
This AI Act role sits alongside the Central Bank's existing prudential and conduct supervision of insurers. The controls required will vary according to the nature and risk of each application. An AI-powered underwriting model, for example, raises different considerations from a tool used to summarise internal documents.
The practical challenge is evidence. Insurers may already have committees, policies and model governance forums. The AI Act will test whether those structures can produce AI-specific evidence: the system has been identified, the role of the insurer as provider or deployer has been assessed, the risk category has been documented, the data controls are adequate, human oversight is real, and the system remains monitored after deployment. That is where existing Solvency II and insurance governance can provide the operating model through which AI Act requirements are managed.
Conclusion
For Irish insurers, compliance with the AI Act will require more than technical assessments of individual systems. Firms will need to demonstrate that responsibilities are clearly assigned, risks are assessed and controls operate effectively throughout the AI system's lifecycle. Existing Solvency II governance provides a starting point, but insurers must identify where AI-specific measures are needed to meet the Act's requirements. Ultimately, the question for Boards is not simply whether the insurer uses AI, but whether it can demonstrate that its use is understood, appropriately controlled and consistent with its wider obligations.
Meet our team
Michael Marshall, Eilish Bouse and David Mac Curtain bring a blend of technical expertise, strategic insight and practical advisory experience, helping organisations navigate complexity, change, governance and evolving business challenges.
