Short answer: sometimes, and the high-risk deadline is now 2 December 2027
Sometimes. The EU AI Act applies to a UK insurer that deploys AI in the EU, or whose AI output is used in the EU. A UK-only book sits outside it. Where it applies, only some insurance AI is high-risk, chiefly life and health risk assessment and pricing for individuals, and that duty now starts on 2 December 2027.[1][2]
Last reviewed: 27 October 2026. Not legal advice (see the note at the end).
The delay is law, not a proposal. The Digital Omnibus on AI was published in the Official Journal on 24 July 2026 and has been in force since 27 July.[2][3] It moves only the high-risk requirements. The prohibited practices (since 2 February 2025) and the duty to tell people they are talking to AI (since 2 August 2026) already apply.[1][2] The Commission's draft guidance says motor and home insurance are not high-risk, but that draft is not final.[5]
Last reviewed: 27 October 2026. Not legal advice (see the note at the end).
Does the Act reach a UK insurer?
It can. Article 2 applies the Act to providers placing AI on the EU market, to deployers established or located in the EU, and to providers and deployers in third countries where the system's output is used in the EU. The UK is a third country, so reach turns on where you operate and where outputs land.[1]
- UK entity, UK customers only: not in scope.
- EU branch or subsidiary: that entity is in scope for its own use of AI.
- UK entity writing EU risks: the "output used in the Union" limb may apply. The text does not define it for insurance, so take legal advice on your structure.
- Vendor tools: the vendor is usually the provider and the insurer the deployer, and both have duties.
What the Digital Omnibus changed
The Digital Omnibus on AI, Regulation (EU) 2026/1744, was published on 24 July 2026 and entered into force on 27 July 2026. It moved the high-risk deadlines: Annex III systems now apply from 2 December 2027, and Annex I product-embedded systems from 2 August 2028.[2][3]
The recitals blame delayed standards, guidance and national authorities. The Annex III list is unchanged, so life and health insurance stays on it. The AI literacy duty was softened to taking "measures to support" literacy.[2] Commission guidelines on classification were due by 2 February 2026 and arrived only as a draft on 19 May 2026. They are not binding.[4][5][6]
The key dates, in order
The dates that matter to a UK insurer are 2 February 2025 for prohibitions, 2 August 2026 for chatbot transparency, and 2 December 2027 for Annex III high-risk obligations, including life and health insurance. Annex I product-embedded systems follow on 2 August 2028.[1][2]
| Date | What applies | For a UK insurer |
|---|---|---|
| 2 Feb 2025 | Prohibited practices (Article 5) and AI literacy (Article 4). | Already live. |
| 27 Jul 2026 | Digital Omnibus in force (published 24 July). | The delay is law. |
| 2 Aug 2026 | General application, including Article 50 transparency. | Chatbots must disclose that they are AI. |
| 2 Dec 2027 | Annex III high-risk requirements. | Life and health pricing and risk assessment of individuals. |
| 2 Aug 2028 | Annex I (product safety) high-risk requirements. | Rarely relevant. |
Sources: Regulation (EU) 2024/1689, Article 113, as amended by Regulation (EU) 2026/1744.[1][2]
Which insurance AI is high-risk?
Only AI used for risk assessment and pricing in relation to natural persons in life and health insurance is named as high-risk in Annex III, point 5(c). Motor and property pricing, claims handling, fraud detection and chatbots are not listed there, although transparency, data protection and conduct rules can still apply.[1][5]
| Use case | Likely tier | Why, and the caveat |
|---|---|---|
| Life or health pricing and risk assessment (individuals) | High-risk | Annex III 5(c). Caveat: the Article 6(3) exemption is unavailable where a system profiles people. |
| Motor and property pricing | Not high-risk under 5(c) | The draft guidelines exclude other insurance classes. UK GDPR and FCA rules still apply. |
| Claims triage and management | Outside 5(c) | The draft guidelines treat claims validation as distinct from risk assessment. A tool that also re-rates policyholders could be caught. |
| Fraud detection | Outside 5(c) if a distinct system | Recital 58 and the draft guidelines. A life or health risk model with fraud detection built in stays high-risk. |
| Customer chatbots | Limited risk | Article 50(1): disclose that it is AI. Live since 2 August 2026. |
| SME and commercial underwriting | Outside 5(c) | Covers only life and health, and only natural persons. Sole traders count as natural persons. |
| Social scoring, exploiting vulnerability | Prohibited | Article 5(1)(b) and (c), since 2 February 2025. A plain risk model is unlikely to qualify. |
A reasoned reading of the Act and the Commission's draft, non-binding guidelines, whose paragraph numbering may change.[1][5]
This matches our analysis of underwriting automation: professional indemnity for doctors, the book in our underwriting case study, is liability cover, not life or health insurance.
What high-risk status requires, and the fines
A high-risk system needs risk management, data governance, documentation, logging, human oversight and accuracy controls from its provider. A deployer, which is what most insurers will be, must follow instructions, assign competent human oversight, check input data, monitor, keep logs for six months, and for life and health run a fundamental rights impact assessment.[1]
Affected people also get a right to an explanation (Article 86). Fines reach €35 million or 7% of worldwide turnover for prohibited practices and €15 million or 3% for most other obligations, with the lower figure for SMEs.[1] Whether a UK-authorised firm can use the Article 26 shortcut for financial institutions is untested, so do not assume it.
How this fits with UK regulation
The UK has no AI-specific statute. The FCA says it does not plan to introduce extra AI regulations and will rely on existing frameworks, chiefly the Consumer Duty and the Senior Managers regime. A UK insurer therefore faces the EU Act only where it reaches the firm, and UK conduct rules everywhere else.[7][9]
The FCA expects firms to remain responsible for AI outcomes, with human oversight, monitoring and an AI inventory.[8] That is also the core of EU deployer compliance, so build it once. Automated claims decisions carry separate UK GDPR constraints, covered in AI claims processing explained, and our Claim It Quick product keeps a person on every decline.
A practical checklist for UK insurers
Start with an inventory of every AI system, then map each to a jurisdiction and a risk tier, then close the gaps in the highest-risk systems first. Most of the work is the same work the FCA already expects. Six steps cover it.
Inventory every AI system
Include vendor tools. Record purpose, owner, data used and whether a person reviews the output.
Map EU reach and risk tier
Ask whether an EU entity or EU resident is involved. Flag life and health pricing and risk assessment, and check the rest against Article 5.
Fix chatbot disclosure
Customer-facing assistants must say they are AI. This has applied since 2 August 2026.
Ask vendors for evidence
Intended purpose, instructions for use and logging, written into contracts before 2 December 2027.
Prepare the high-risk package
For life and health systems: named reviewers with authority, input-data checks, six-month logs and a draft impact assessment that cross-refers to your DPIA.
Set a review trigger
Re-check when the Commission adopts final guidelines.
Frequently asked questions
Does the EU AI Act apply to UK insurers after Brexit?
Only where it reaches them. It applies to providers and deployers in the EU, and to third-country firms whose AI output is used in the EU. A UK insurer with an EU branch, subsidiary or affected EU customers may be in scope. A UK-only business is not. Take legal advice on your structure.
When do the EU AI Act high-risk rules apply to insurers?
From 2 December 2027 for Annex III systems, which include AI for risk assessment and pricing in life and health insurance. The Digital Omnibus on AI, Regulation (EU) 2026/1744, set that date. It is in force and no longer a proposal.
Is motor insurance pricing high-risk under the EU AI Act?
Not under Annex III point 5(c), which names only life and health insurance. The Commission's draft guidelines say motor and home insurance are not covered. The draft is not final, and data protection, discrimination and FCA rules still apply.
Is insurance fraud detection high-risk?
Generally not. Recital 58 and the Commission's draft guidelines treat a distinct fraud-detection system as outside point 5(c). A life or health risk assessment system with a fraud feature built in remains high-risk.
Do insurers have to tell customers they are talking to a chatbot?
Yes, in the EU. Article 50(1) requires AI systems that interact directly with people to be designed so they are informed they are dealing with AI, unless it is obvious. It has applied since 2 August 2026 and was not delayed.
What should a UK insurer do first?
Build an inventory of every AI system, then map each to EU reach and a risk tier. That work meets much of what the FCA already expects and produces the evidence EU deployer duties need.
References
The sources below were opened and read in full for this review on 27 October 2026. Bracketed numbers in the text point here.
- Regulation (EU) 2024/1689 (the Artificial Intelligence Act), Official Journal of the European Union, 12 July 2024. eur-lex.europa.eu
- Regulation (EU) 2026/1744 of 8 July 2026 (the Digital Omnibus on AI), Official Journal of the European Union, 24 July 2026. data.europa.eu
- European Commission, “AI Omnibus enters into force”, 27 July 2026. digital-strategy.ec.europa.eu
- European Commission, “Guidelines for providers and deployers of AI high-risk systems” (policy page, draft guidelines and consultation). digital-strategy.ec.europa.eu
- European Commission, draft guidelines on the classification of high-risk AI systems (Annex III section, paragraphs 72 to 74 and 306 to 323), published 19 May 2026. Not binding. digital-strategy.ec.europa.eu
- IAPP, “European Commission delivers draft high-risk AI guidelines after delays”. iapp.org
- Financial Conduct Authority, “AI and the FCA: our approach” (last updated 2 October 2026). fca.org.uk
- Financial Conduct Authority, “AI in financial services: good practice and areas for improvement” (published 19 October 2026). fca.org.uk
- House of Commons Library, “AI regulation in the UK”, briefing CBP-10003. commonslibrary.parliament.uk
Last reviewed: 27 October 2026.
Not legal advice. This article is a plain-English summary for general information, written by a technology founder rather than a lawyer. The Act's application to a specific insurer depends on its facts, and parts of this analysis rely on Commission draft guidelines that are not final or binding. Take advice from a qualified lawyer before making compliance decisions.