Is AI pricing for health and life insurance high-risk under the EU AI Act?

Yes, in most cases. AI that assesses the risk of, or sets the price for, an individual in life or health insurance is listed in Annex III, point 5(c), and under Article 6(2) that makes it high-risk. The Article 6(3) derogation rarely helps, because a system that scores an individual's health, habits or finances to price their cover is in our reading profiling, and an Annex III system that profiles natural persons is always high-risk. The answer turns on three things: which insurance line (motor, home and travel are not listed), whose risk is assessed (the point covers "natural persons", which leaves group policies unclear), and what the tool does (claims handling and fraud detection are not named in point 5(c)).

This is an information service to help you orient, not legal advice. To see the obligations that attach to your own AI use, answer three questions about it.

Your situation at a glance

Your situation	High-risk?	Why (article / annex point)
AI scores an individual applicant's risk or sets their premium for life or health cover	Yes	Annex III, point 5(c), read with Article 6(2)
The same model, but an underwriter signs off every decision	Usually still yes	In our reading, point 5(c) describes the system's intended purpose, not who decides. Article 6(3) never applies where the system profiles natural persons
AI pricing for motor, home or other property insurance	Not under point 5(c)	Point 5(c) names only "life and health insurance". No other Annex III point covers insurance pricing
Travel insurance with medical-expenses cover, critical illness, income protection	Unsettled	The Act does not define "life insurance" or "health insurance"
Pricing a group life or health policy for an employer from aggregate workforce data	Unsettled	Point 5(c) covers risk assessment and pricing "in relation to natural persons". A tool that assesses individual members is the clearer case
AI triages claims or flags suspected claims fraud	Not by the words of point 5(c)	Point 5(c) covers risk assessment and pricing, not claims. Its fraud exception sits in point 5(b) only (see below)
AI decides eligibility for healthcare cover on behalf of a public authority	Possibly, by a different route	Annex III, point 5(a): use by or on behalf of public authorities for essential public assistance benefits and services, "including healthcare services"
A tool only extracts data from medical reports into the underwriting file, and a person assesses the risk	Possibly not	Article 6(3)(a) or (d), a narrow procedural or preparatory task, if it does not evaluate the person and so does not profile
Models that calculate the insurer's own capital requirements	Probably not	Recital 58: AI provided for by Union law for prudential purposes to calculate insurance undertakings' capital requirements should not be considered high-risk

The legal test

Article 6(2) says that AI systems referred to in Annex III "shall be considered to be high-risk". Annex III, point 5 covers access to and enjoyment of essential private and public services and benefits. Point 5(c) lists:

"AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance."

Four elements do the work:

• "Intended to be used" points to the provider's purpose. Article 3(12) ties the intended purpose to the instructions for use, promotional or sales materials and statements, and technical documentation. In our reading, a general analytics platform is not caught merely because an insurer could use it for pricing; a tool sold for underwriting is. An insurer that turns a general tool to point 5(c) use can itself become the provider (Article 25(1)(c), below).
• "Risk assessment and pricing" covers underwriting and premium-setting. The text does not say whether a system must do both. A model that only decides whether to accept or decline an applicant, without setting a price, is a risk assessment, and the cautious reading treats it as covered.
• "In relation to natural persons" limits the point to individuals. A group policy priced for an employer on the claims history of its workforce as a whole is not obviously an assessment "in relation to natural persons"; a tool that assesses individual members of the group plainly is. The Act does not settle the middle.
• "Life and health insurance" limits the point to two lines. Neither term is defined in the Act.

Point 5(c) names no user. Like point 5(b), and unlike point 5(a), it is not limited to a particular kind of organisation. An intermediary that uses a tool to assess an individual's risk for life cover is as much in scope as an insurer.

Recital 58 of the original 2024 text gives the reason for the listing: these systems "can also have a significant impact on persons' livelihood and if not duly designed, developed and used, can infringe their fundamental rights and can lead to serious consequences for people's life and health, including financial exclusion and discrimination."

Other insurance lines

Motor, home, travel, liability and other non-life lines appear nowhere in Annex III. A pricing model for car insurance is not high-risk through point 5(c), whatever data it uses. Two cautions. First, the boundary of "health insurance" is not drawn in the Act, so products that pay out on illness or cover medical costs need a careful look. Second, Article 7 lets the Commission amend Annex III by delegated act; the consolidated text of 27 July 2026 contains no further insurance use case, and the Digital Omnibus did not amend point 5.

Claims handling and fraud detection

Point 5(c) covers "risk assessment and pricing". Claims triage, claims settlement and claims-fraud detection are not named. So a model that only flags suspicious claims is not described by point 5(c)'s words.

The fraud carve-out people often cite does not sit in point 5(c). It is the tail of point 5(b), on creditworthiness, which ends "with the exception of AI systems used for the purpose of detecting financial fraud". Point 5(c) has no exception of its own. Recital 58 adds that "AI systems provided for by Union law for the purpose of detecting fraud in the offering of financial services and for prudential purposes to calculate credit institutions' and insurance undertakings' capital requirements should not be considered to be high-risk under this Regulation", but a recital explains the operative text; it does not add exceptions to it.

The harder case is a fraud or misrepresentation score used at underwriting, or a claims-behaviour score fed back into a person's renewal premium. That output becomes part of the risk assessment or pricing of a natural person, and point 5(c) has no fraud exception to take it out. Treat it as in scope unless you can show otherwise.

Public health insurance

Where a public authority, or a body acting on its behalf, uses AI to decide whether a person is entitled to healthcare cover, point 5(a) can apply: "AI systems intended to be used by public authorities or on behalf of public authorities to evaluate the eligibility of natural persons for essential public assistance benefits and services, including healthcare services, as well as to grant, reduce, revoke, or reclaim such benefits and services". Whether a given statutory or social health insurer is a public authority, or acts on behalf of one, depends on the national set-up.

The Article 6(3) derogation, and why profiling closes it

Article 6(3) lets an Annex III system escape the high-risk label where it "does not pose a significant risk of harm to the health, safety or fundamental rights of natural persons, including by not materially influencing the outcome of decision making". It applies where at least one of four conditions is met. The system is intended to:

• (a) perform a narrow procedural task;
• (b) improve the result of a previously completed human activity;
• (c) detect decision-making patterns or deviations from prior decision-making patterns, where it is "not meant to replace or influence the previously completed human assessment, without proper human review"; or
• (d) perform a preparatory task to an assessment relevant for the Annex III use cases.

But the third subparagraph is absolute: an Annex III system "shall always be considered to be high-risk where the AI system performs profiling of natural persons". Article 3(52) borrows the GDPR definition (Article 4(4) GDPR): automated processing of personal data to evaluate personal aspects of a person, "in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements". A model that predicts an applicant's mortality or morbidity from their data is evaluating their health. For an individual risk or pricing model, the derogation is effectively closed.

It stays open for genuinely narrow tools: one that extracts fields from a medical report, checks an application for missing answers, or routes files to the right underwriter, without evaluating the person. A provider that relies on it must document the assessment before placing the system on the market or putting it into service (Article 6(4)) and register the system in the EU database (Article 49(2)).

What the Digital Omnibus changed here. Regulation (EU) 2026/1744 inserted new paragraphs 1a to 1c into Article 6, on safety components; it did not amend paragraphs 3 or 4, so the four conditions, the profiling rule and the documentation duty are unchanged. It did slim the registration: it deleted points 7 and 9 of Annex VIII, Section B, so a provider no longer submits a short summary of the grounds for its not-high-risk conclusion, or the Member States in which the system has been placed on the market, put into service or made available. The registration itself still applies (Article 6(4), second subparagraph, and Article 49(2), both unamended). Recital 22 of the Omnibus is explicit that the provider "remains obligated to document its assessment". See when an Annex III system is not high-risk.

If it is high-risk: who does what, and when

When. The Digital Omnibus amended Article 113. Chapter III, Sections 1, 2 and 3 apply to Annex III systems from 2 December 2027. Under Article 111(2), as amended, and without prejudice to Article 5, the Act applies to operators of high-risk systems placed on the market or put into service before that date only if, from that date, those systems are subject to significant changes in their designs. Providers and deployers of high-risk systems intended to be used by public authorities must in any case comply by 2 August 2030. See what the Digital Omnibus changed.

Providers (whoever develops the model and places it on the market or puts it into service under its own name, Article 3(3)) carry the main load: the Section 2 requirements (risk management, data governance, technical documentation, logging, transparency to deployers, human oversight, accuracy, robustness and cybersecurity), a quality management system (Article 17), a conformity assessment based on internal control under Annex VI (Article 43(2), which covers points 2 to 8 of Annex III) and registration in the EU database (Article 49(1)). An insurer that builds its own pricing model is both provider and deployer. Under Article 25(1)(c), a deployer that repurposes a general-purpose AI system so that it becomes a point 5(c) system is treated as its provider.

Deployers (the insurer or intermediary using the system, Article 3(4)) must use it according to the instructions for use, assign human oversight to people with the necessary competence, training and authority, monitor it, keep the logs under their control and, under Article 26(11), inform the natural persons that they are subject to the use of a high-risk AI system where it is used to make or assist decisions about them. Under Article 86(1), an affected person subject to a decision taken by the deployer on the basis of the system's output, which produces legal effects or similarly significantly affects them in a way they consider to have an adverse impact on their health, safety or fundamental rights, has the right to obtain from the deployer "clear and meaningful explanations of the role of the AI system in the decision-making procedure and the main elements of the decision taken". The right does not apply where Union or national law provides exceptions or restrictions (Article 86(2)), and applies only to the extent it is not otherwise provided for under Union law (Article 86(3)). See deployer obligations under Article 26.

Fundamental rights impact assessment. Article 27(1) names this case directly. Before deploying, "deployers of high-risk AI systems referred to in points 5 (b) and (c) of Annex III, shall perform an assessment of the impact on fundamental rights that the use of such system may produce", alongside bodies governed by public law and private entities providing public services. Recital 96 gives "banking or insurance entities" as the example. The assessment covers the deployer's processes, the period and frequency of use, the categories of people affected, the specific risks of harm, the human oversight measures and what happens if the risks materialise (Article 27(1)(a) to (f)). It applies to first use, must be updated when those elements change (Article 27(2)), and its results must be notified to the market surveillance authority, using the AI Office template (Article 27(3), which allows an exemption only in the Article 46(1) case). As replaced by the Omnibus, Article 27(4) provides that where any of these obligations is already met through a data protection impact assessment under Article 35 GDPR, the deployer may cross-refer to the relevant sections of that assessment or include relevant parts of it in the fundamental rights impact assessment.

Where insurance supervision fits in

The Act has specific provisions for "financial institutions subject to requirements regarding their internal governance, arrangements or processes under Union financial services law". It does not define the term, but Recital 158 lists the Solvency II Directive (2009/138/EC) and the Insurance Distribution Directive ((EU) 2016/97) among the financial services acts whose supervisors should supervise AI used by regulated financial institutions, and says the same regime "should apply to insurance and re-insurance undertakings and insurance holding companies under Directive 2009/138/EC". A recital is not operative text, so our reading is that an insurer subject to Solvency II governance requirements is such an institution, but the Act itself does not say so. Where an insurer is such an institution:

• Quality management. As a provider, its QMS obligation is deemed fulfilled by complying with its internal-governance rules under financial services law, except the risk management system, post-market monitoring and serious-incident reporting elements (Article 17(4), excepting Article 17(1)(g), (h) and (i)).
• Documentation and logs. It keeps the technical documentation and logs as part of the documentation kept under financial services law (Articles 18(3), 19(2) and 26(6)).
• Monitoring as deployer. Its deployer monitoring duty is deemed fulfilled by complying with its internal-governance rules (Article 26(5)).
• Post-market monitoring. As a provider of a point 5 system it places on the market or puts into service, it may integrate the AI Act's post-market monitoring elements into systems and plans it already has, provided that achieves an equivalent level of protection (Article 72(4), second subparagraph).
• Supervisor. The market surveillance authority is, in principle, the national authority responsible for its financial supervision, insofar as the AI use is in direct connection with the provision of those financial services (Article 74(6)), unless the Member State identifies another authority (Article 74(7)).

None of this removes the Article 27 assessment or the Section 2 requirements themselves.

What applies regardless

• AI literacy (Article 4). In force since 2 February 2025. As replaced by the Digital Omnibus, it requires providers and deployers to take measures to support the development of AI literacy of their staff and other persons dealing with the operation and use of AI systems on their behalf, such as underwriters reviewing model outputs, and it "does not require providers or deployers to guarantee any specific level of AI literacy of any individual". See the AI literacy duty.
• Prohibited practices (Article 5). In force since 2 February 2025, in every insurance line (the two prohibitions added by the Omnibus, Article 5(1)(ba) and (bb), apply from 2 December 2026). Article 5(1)(c) bans evaluating or classifying people over a period of time based on their social behaviour or personal characteristics where the social score leads to detrimental or unfavourable treatment in unrelated social contexts, or treatment that is unjustified or disproportionate. Article 5(1)(g) bans biometric categorisation to deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life or sexual orientation. Breaches can carry fines of up to EUR 35 million or, for an undertaking, up to 7% of its total worldwide annual turnover for the preceding financial year, whichever is higher (Article 99(3)); for SMEs, whichever is lower (Article 99(6)). See prohibited AI practices.
• Chatbots (Article 50(1)). In force since 2 August 2026. If customers talk to an AI assistant for quotes or claims, the provider must design it so they are told they are interacting with an AI system, unless that is obvious. See transparency obligations.
• Data protection, a separate regime. Underwriting AI processes personal data, often health data. The AI Act does not replace the GDPR.

What to do now

1. List every model by line and function: individual pricing, accept/decline, group pricing, claims triage, fraud scoring, document extraction, customer chatbot.
2. Treat individual life and health risk and pricing models as high-risk and plan for 2 December 2027. Do not lean on Article 6(3) for anything that evaluates the person.
3. Trace where fraud and claims scores end up. If they feed an individual's risk assessment or premium in life or health insurance, assume point 5(c).
4. Plan the fundamental rights impact assessment before first use, and line it up with any existing data protection impact assessment.
5. Check every model against Article 5 now, in every line. The prohibitions are already in force.

For the general test behind this page, see is your AI system high-risk?. For a parallel point 5 case, see is AI tenant screening high-risk?. To get a weekly email of verified changes to these rules, join the waitlist.

The official text is Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744. This article is an information service to help you orient — it is not legal advice.