EU AI Act in Life and Health Insurance (Annex III, 5)

1. Annex III, 5(b)

Covers "AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance." Pure underwriting decision-support tools using AI fall squarely in scope.

2. Special-category data under Art. 9 GDPR

Insurance health data is Art. 9 GDPR special-category data. Requires explicit consent (Art. 9(2)(a)) or another exception, plus the Art. 10 EU AI Act bias-test obligation. Document the legal basis and the bias-test methodology together.

3. FRIA mandatory

Annex III, 5 deployers must conduct a Fundamental Rights Impact Assessment under Art. 27 by Aug 2, 2026. Risk areas: discrimination based on pre-existing conditions, genetic disposition, age, or disability. Document mitigations including human review of adverse decisions.

4. Prohibitions under Art. 5

Subliminal influence is prohibited. Exploiting vulnerability based on illness is prohibited. Marketing or upselling AI that targets diagnosed patients with manipulative messaging is out of scope.

5. Conformity assessment (Art. 43)

A notified body is recommended given the high-risk classification and special-category data. Engage the insurance regulator (BaFin in Germany, FMA in Austria, FINMA in Switzerland) early — sector supervision adds requirements beyond the AI Act baseline.

Summary

Life and health insurance AI is the rare Annex III, 5 sub-area still on the original Aug 2, 2026 timeline. Insurers must run FRIA, document Art. 10 bias tests, exclude prohibited practices, and coordinate with both notified body and BaFin. Health-data sensitivity makes this one of the highest-stakes AI use cases in the SME world.

View EU AI Act Kit →