Navigating the AI Governance Landscape in Insurance: A Strategic Approach

As artificial intelligence (AI) technology evolves, its integration into the insurance sector presents both opportunities and challenges. Nearly three out of four financial institutions are grappling with a pressing concern: they lack clarity on which of their vendors are utilizing AI in their operations. A recent survey by Ncontracts revealed that 72% of institutions only partially understand vendor AI use, while 9% have not assessed it at all. This significant blind spot poses a sharper third-party risk for insurance carriers than the technology itself. Understanding and managing this risk is becoming increasingly essential for insurers navigating the complexities of AI governance.

John Romano, a principal at Baker Tilly and leader in the firm’s insurance regulatory practice, emphasizes that the stakes are high. For instance, a managing general agent (MGA) leveraging generative AI to summarize claims may operate at a lower risk level, but a partner utilizing proprietary models for risk selection, pricing, and claims triage presents significantly greater vulnerabilities. Romano articulates that when AI impacts pricing, coverage, claims outcomes, or regulatory-bound consumer communications, it necessitates heightened scrutiny and oversight. Given the rapid proliferation of AI tools, the potential for liabilities tied to AI errors—such as an AI chatbot approving a claim at ten times its intended amount—has become a pressing concern for the industry.

The Growing Importance of AI Oversight

As the use of autonomous systems continues to rise within the insurance landscape, the urgency for robust AI governance practices becomes evident. The challenge for many carriers is not the absence of policies but rather the effectiveness of their vendor oversight mechanisms. According to Grant Thornton's 2026 AI Impact Survey, over half of insurance leaders reported that their boards had established AI governance policies. However, 44% still attributed project failures or underperformance to governance gaps.

Assessing Vendor Risk

Romano advocates for a comprehensive inventory of vendor AI usage. Carriers should be able to pinpoint where AI is applied across various processes, identify the nature of decisions made autonomously, and understand human involvement in these processes. This level of scrutiny goes beyond simply adhering to a governance document; it requires delving into how decisions are made, the data used, and the measures in place to ensure accuracy and mitigate bias.

Addressing bias is particularly critical, as it often stems from the data used to train AI models and can compound over time through model drift. This necessitates carriers to engage with vendors about their own third and fourth-party relationships. Effective oversight involves extending beyond the first contract to ensure that all subcontractors comply with governance standards.

Reframing Governance Strategies

Romano's insights suggest a paradigm shift in how insurance carriers approach vendor governance. Many institutions currently employ a “toll booth” method, where every vendor, regardless of their AI utilization, must navigate the same cumbersome scrutiny process. This approach can stall innovation and operational efficiency. Instead, Romano proposes an 'express lane' framework, allowing low-risk vendors to move swiftly through the review process while reserving deeper scrutiny for high-impact applications.

Defining Risk Appetite

To effectively implement this express lane model, carriers must first define their AI risk appetite. This involves evaluating the potential consumer impact and the sensitivity of the data each vendor handles. For example, managing general agents with delegated authority present a higher risk, as they represent a significant portion of the market, writing $108.7 billion in direct premiums in 2025 alone, according to AM Best data. Carriers must recognize that the authority they delegate comes with substantial responsibility and potential liability.

• High-Risk Vendors: Those with delegated underwriting authority.
• Medium-Risk Vendors: Third-party administrators and claims technology providers.
• Low-Risk Vendors: Firms providing services that do not directly impact consumer decisions.

Regulatory Trends in AI Governance

As the insurance industry adapts to increasing AI integration, regulatory bodies are intensifying their focus on third-party governance. The National Association of Insurance Commissioners (NAIC) is piloting an AI Systems Evaluation Tool across twelve states, aimed at assessing how insurers deploy AI, govern these systems, and identify high-risk models and data sources. This tool, expected to be evaluated for broader adoption in late 2026, is part of a wider effort to ensure that existing insurance laws apply equally to human and algorithmic decision-making.

Romano notes that regulators are keen to promote innovation while ensuring accountability. The NAIC's 2023 model bulletin on AI usage has already been adopted by approximately 25 states, reinforcing the notion that insurers must not only have governance policies but also demonstrate the efficacy of those controls, particularly in critical areas like underwriting, pricing, and claims management.

Evidence Over Documentation

Moving forward, regulatory scrutiny is expected to shift from mere documentation of policies to concrete evidence of their implementation. Carriers that can effectively map their vendors' AI usage and prioritize oversight on decisions impacting policyholders will be better positioned to adapt to these changes. Those that rely solely on a governance policy without substantive evidence of implementation may find themselves exposed to greater risks.

Key Takeaways

• Understanding vendor AI usage is crucial for risk management in insurance.
• Implementing a tiered governance approach enhances efficiency and oversight.
• Regulatory bodies are increasing scrutiny of AI governance in the industry.
• Evidence of effective AI governance will become a key focus for regulators.
• Carriers must proactively manage third-party risk to mitigate potential liabilities.

Frequently Asked Questions

Why is understanding vendor AI usage important for insurance carriers?

Understanding how vendors utilize AI is essential for insurance carriers because it directly impacts pricing, risk assessment, claims processing, and regulatory compliance. Carriers that are unaware of the AI practices employed by their vendors may expose themselves to significant third-party risks, including financial liabilities and regulatory scrutiny, which can undermine customer trust and operational integrity.

What are the risks associated with inadequate AI governance?

Inadequate AI governance can lead to a variety of risks, including biased decision-making, incorrect claims approvals, and regulatory violations. For instance, an AI error that results in a claim being approved at an incorrect amount can lead to costly repercussions for an insurer, including fines, reputational damage, and loss of customer trust. Furthermore, if regulators find that a carrier has insufficient governance practices, they may impose stricter controls or penalties that affect the entire organization.

How can carriers improve their vendor oversight processes?

Carriers can enhance their vendor oversight by establishing a comprehensive framework for evaluating AI usage across their supply chain. This includes developing a robust inventory of vendor AI practices, implementing a tiered governance approach based on risk assessment, and ensuring that all stakeholders, including legal and compliance teams, are involved in the evaluation process. Regular audits and assessments can also help carriers stay informed about their vendors’ changing practices and potential risks.

What role do regulators play in shaping AI governance in the insurance sector?

Regulators play a critical role in defining the standards and expectations for AI governance within the insurance sector. By creating model laws and evaluation tools, such as the NAIC's AI Systems Evaluation Tool, regulators are guiding insurers on how to effectively manage AI governance while encouraging innovation. Their increasing focus on third-party risk management ensures that insurers remain accountable for the actions of their vendors, promoting a safer and more transparent industry.