AI in insurance: what FINMA, the AI Act and your policyholders require before you automate

Insurers have an advantage over many other sectors: their AI use cases are obvious. Triaging claims, detecting fraud, pre-filling an application, answering policyholders. They also have a handicap: their customers and their regulators watch very closely what AI decides. In Switzerland as in the European Union, the framework has become much clearer in eighteen months. Here is what it requires, and how to turn it into an advantage rather than a brake.

Policyholders accept AI that explains, not AI that decides

The study Deloitte Switzerland published on 1 April 2026, based on a survey of 1,291 Swiss policyholders aged 18 to 79, sets the frame better than any regulatory text. 85% of respondents assume their insurer already uses AI, but only 18% see it positively. Above all, acceptance depends entirely on the use: 62% accept AI simplifying policy wording and 57% accept it spotting suspicious patterns in claims, but 61% reject AI deciding alone whether to accept or refuse a claim, and 41% oppose automated risk classification and pricing.

The conditions are clear: 86% require human involvement in important decisions, 85% want to know when AI is used, 59% ask for simple appeal procedures. And trust is low: 17% trust insurers on the subject, 14% trust supervisory authorities, 13% trust technology providers. Deloitte sums it up: customers accept AI "provided it serves to explain rather than to decide".

For an insurer, this is not a marketing constraint, it is a product specification. A claims AI that speeds up assessment, documents its recommendation and leaves the final decision to a handler ticks every box. An AI that automatically rejects a file ticks them all in the negative.

What FINMA has expected since December 2024

FINMA Guidance 08/2024, published on 18 December 2024, creates no new rule: it recalls that there is no AI-specific legislation in Switzerland and that existing, technology-neutral prudential requirements apply. But it describes precisely what FINMA checked at supervised institutions, and therefore what it will check again.

Seven points structure the document: AI governance with clear responsibilities; a centralised inventory of use cases with risk classification; data quality; testing and continuous monitoring of models; usable documentation; explainability of results; and independent review. FINMA also notes that supervised institutions "focus primarily on data protection risks", less on model risks such as robustness, bias or explainability. And it observes that results "are often not understood, explained or reproduced", particularly when a decision must be justified to a customer or to the audit firm.

Footnote 7 of the document deserves quoting: "AI is not in itself a high-risk application." The risk level depends on complexity, autonomy, scope and integration into processes. In other words, an assistant that summarises a claims file does not call for the same controls as a model that sets a premium.

The European AI Act and the case of life and health insurance

For insurers active in the Union or dealing with European policyholders, Regulation 2024/1689 adds a layer. Its Annex III, point 5(c), classifies as high-risk AI systems "intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance". Point 5(b) covers creditworthiness assessment and credit scoring. The attached obligations are heavy: risk management, governance of training data, technical documentation, traceability, human oversight, robustness.

The application timeline for high-risk obligations, initially set for 2 August 2026, is being pushed back as part of the European digital omnibus. That delay does not change the nature of the requirements, only the moment they become enforceable. Insurers who treat them today as good model-governance practice will have nothing to reinvent.

The convergence is striking: FINMA, the AI Act and policyholders ask for the same thing in different words. Inventory, classification, explainability, human oversight, recourse.

Where AI really pays off in claims

Claims handling concentrates a large share of an insurer's operating costs, and that is where gains are most measurable. The uses that work in production share one characteristic: they assist, they do not rule.

• Triage and qualification at intake. Read the declaration, the photos and the attachments, extract structured information, estimate complexity, route to the right handler or to a simplified path. This is the fastest win, often days saved on first-response time.

• Anomaly detection. Flag inconsistencies between the narrative, the documents and the policy history for human investigation. Deloitte estimates, in its 2025 financial services predictions, that multimodal AI applied to fraud detection could cut fraudulent claims by 80 to 160 billion dollars worldwide by 2032.

• Assisted drafting. Prepare the case summary, the letter to the policyholder, the reasoning behind a decision. The handler reviews and signs. This is also what makes explainability concrete: the reasoning exists, it is readable, it is archived.

A typical situation: a mid-sized insurer handling 50,000 simple claims a year, with an average first-response time of five days. By automating qualification and file preparation while keeping the human decision, that lead time typically falls to one or two days, and the handler time freed up shifts to complex cases.

What we take away

Insurance is the sector where AI governance is not a compliance cost but a condition of adoption: without explainability and human oversight, policyholders refuse and regulators step in. The insurers moving forward build their use-case inventory, classify risks as FINMA describes, design their assistants to explain rather than decide, and measure gains on concrete lead times. At 39 Advisory, we support Swiss insurers along this path, with a method that starts from claims and underwriting processes, never from the tool.

To see where your organisation stands, our AI Barometer gives a first reading in ten minutes, and we remain available to go further.