Every obligation, answered from your records.
Each rule your supervisor applies to AI in insurance is linked to the sealed records that answer it. An auditor can follow the line from the article to the decision, the evidence it rested on and the person who signed it.
Some rules apply now. The next ones have a date.
DORA already applies to insurers. The reviewed Solvency II rules and the AI Act's high-risk rules follow. The evidence each one asks for is the same: who decided, on what, under which rule.
until the EU AI Act's rules for high-risk AI apply to risk assessment and pricing in life and health insurance, on 2 December 2027.
DORA already applies to insurers today, and Solvency II and the IDD ask for the same thing: proof. HONESTAS keeps that proof from the first claim.
Choose any date on the line. The clock counts down to a rule, then counts the days it has applied.
AI Act dates as amended by Regulation (EU) 2026/1744, the Digital Omnibus, published in the Official Journal on 24 July 2026. Solvency II review: Directive (EU) 2025/2, applying from 30 January 2027. Not legal advice.
What each rule asks, and the record that answers it.
One sealed record can answer several rules at once. Below, each obligation is put in plain words, followed by what HONESTAS keeps for it.
EU AI Act · Regulation (EU) 2024/1689
- Risk managementArticle 9A risk management system for each high-risk AI system, run and reviewed for as long as the system is in use.Answered byValidation runs, challenger findings and drift alerts, each kept with the model version it tested.
- Record-keepingArticle 12High-risk AI systems must record events automatically over their lifetime, so their working can be traced.Answered byThe sealed decision record: inputs, rules and model versions, every argument, the signature and an outside time stamp.
- Transparency to deployersArticle 13The people using the system must be able to understand its output and use it properly.Answered byEvery AI answer lists what it was read with and what was held back. Every AI button shows the model and version it runs.
- Human oversightArticle 14People must be able to oversee the system, understand its limits, decide not to use its output, and stop it.Answered byA named chair in every decision room, a challenger seat, a second model that can stop the decision, and a person who signs.
- Duties of deployersArticle 26Give oversight to people with the competence, training and authority for it, monitor the system, keep its logs for at least six months and tell the people affected.Answered bySigners whose authority is checked before they sign, logs kept in the record store for the period you set, and letters that say AI assisted.
- Life and health pricingAnnex III, point 5(c)AI used for risk assessment and pricing of natural persons in life and health insurance is high-risk. The rules for it apply from 2 December 2027.Answered byEvery life and health underwriting and pricing decision triaged to a room and sealed, from the first quote.
Insurance supervision
- Solvency II · system of governanceDirective 2009/138/EC · Articles 41 to 49Clear responsibilities, risk management, internal control and written policies, with outsourced functions kept under the insurer's control.Answered byAuthority limits held as versioned instruments, four eyes on every change to them, and a record of who held which power on the day.
- Solvency II · model validationDirective 2009/138/EC · Article 124A regular cycle of validation for internal models, testing results and key assumptions.Answered byValidation runs that can be re-run exactly, sealed with the data, code and model versions they used.
- Insurance Distribution DirectiveDirective (EU) 2016/97 · Articles 17, 20, 25Act honestly, fairly and in the customer's best interests, meet their demands and needs, and govern each product for its target market.Answered byEach quote keeps the documents the customer saw before paying. Each product keeps every approved version of its wording.
- EIOPA opinion on AIAI governance and risk management · 6 August 2025How Solvency II and the IDD apply to AI that is not high-risk: governance, data, record keeping, fairness, explainability, human oversight and cyber security.Answered byThe same sealed record for every AI-touched decision, high-risk or not.
- DORARegulation (EU) 2022/2554 · since 17 January 2025Manage ICT risk, report major incidents, keep a register of ICT suppliers and have exit plans for those that support critical or important functions.Answered byOur details for your register, incident timelines from the first alert, and a full export in an open format.
- Lloyd'sPrinciple 4, claims management · MS14 validationPrompt and fair claims handling with delegated claims kept under oversight, and internal models validated independently, at least once a year.Answered bySealed claims decisions the managing agent can review, coverholder and TPA decisions open to the capacity provider, and replayable validation runs.
Customers and their data
- GDPR · automated decisionsRegulation (EU) 2016/679 · Articles 22 and 15(1)(h)People have the right not to be subject to a decision made solely by a machine that significantly affects them, and may ask for meaningful information about the logic involved. In case C-203/22, on 27 February 2025, the Court of Justice held that this means explaining the procedure and principles actually applied.Answered byNo decline is made by a model alone. A named person signs, and the record says in plain words which data was used and how.
- Central Bank of IrelandConsumer Protection Code · S.I. 80 and 81 of 2025Since 24 March 2026: act in customers' best interests, give clear information in plain language, make digital channels easy to use and support customers in vulnerable circumstances.Answered byEvery customer letter checked for plain words and reading age before it is sent, and a record of what each customer was told.
- FCA Consumer DutyPrinciple 12 · PRIN 2A · since 31 July 2023Deliver good outcomes for retail customers: products and services, price and value, consumer understanding and consumer support.Answered byA sealed reason behind every price and claim decision, the words the customer saw, and the support they got on each call.
Certification stays between you and your auditor. HONESTAS keeps the evidence; it does not certify you. Not legal advice.
A supervisor asks about one decision. You answer in four steps.
The rule, the decision and the evidence are linked when the decision is made, not pieced together when someone asks.
The rule
Each rule you answer to is held as a versioned item, with the date it applied and the policies that put it into practice.
The decision
Each sealed decision names the rules, wordings, rate tables and authority it ran under, at the version in force.
The evidence
The record carries every input, its source and its age, and says plainly what was missing when the decision was made.
The read seat
Your auditor or supervisor gets a seat that reads exactly those records, or a Decision Passport they check with no account.
About the rules.
Does HONESTAS make us compliant?
No product can. HONESTAS keeps the evidence each rule asks for, as decisions are made, so your compliance team, your auditor and your supervisor can reach their own view on it. Certification stays between you and your auditor.
Which of our uses are high-risk under the AI Act?
Annex III point 5(c) covers AI used for risk assessment and pricing of natural persons in life and health insurance. Other uses, such as motor claims or commercial underwriting, fall under the EIOPA opinion and your existing Solvency II and IDD duties. HONESTAS keeps the same record for both, so a change in classification does not change your evidence.
What did the Digital Omnibus change?
Regulation (EU) 2026/1744 moved the date for the AI Act's high-risk rules on Annex III uses from 2 August 2026 to 2 December 2027. It did not remove the duties for those uses. Records kept from today will already cover the period a supervisor asks about.
Do the UK and Lloyd's rules apply too?
If you write business in the UK, the FCA Consumer Duty applies to retail customers, and Lloyd's sets its own principles for managing agents. HONESTAS keeps one record and maps it to each regime you answer to.
How long are records kept?
For as long as you set, per kind of record. The AI Act asks deployers to keep logs for at least six months; claims and underwriting records are usually kept far longer. A legal hold stops deletion until it is released, with a record of both.
Is this page legal advice?
No. It is our plain reading of the rules, with the references so your own advisers can check them.
Go deeper
Bring the rule that worries you most.
Tell us which article your supervisor asked about last. We will show you the records that answer it.