0
AI readiness assessment for insurers: A scorecard across data, core systems, and governance
Before an insurer commits budget to an AI project, it needs to know whether that project can run in production, not just in a pilot. This article gives you a scorecard for answering that question for one planned use case. It rates ten areas on a 0–2 scale: use case, data access, data quality, core-system integration, classification, governance, human oversight, skills, change management, and monitoring. A zero in data access, governance, or human oversight blocks the pilot regardless of the total, and so does a classification that is not yet documented. The article also explains when to use a readiness framework and when to use a readiness index. It walks through a four-step assessment: evaluation, planning, implementation, and monitoring. Finally, it lists the misconceptions that lead regulated companies to overestimate how prepared they are.
Introduction: Why AI readiness matters for insurers
AI readiness often decides whether a pilot scales or disappears after a proof of concept. Genesys defines it as an organization’s preparedness to implement and scale AI technologies effectively. The definition covers data quality, infrastructure, skills, ethical governance, and change management. That breadth is the point. Readiness is a technology question, a data question, and a people question. In insurance, it is also a compliance question. Genesys notes that companies with high readiness move from experimentation to production faster. An assessment surfaces gaps, such as missing training data or unclear use cases.
For an insurer, readiness also raises questions that a generic checklist does not ask. Can this decision be reconstructed for a supervisor six months later? Can the data be pulled from the policy administration system without manual exports? Who is accountable if the output is wrong?
AI readiness gaps in practice
Market data shows how few organizations are fully prepared. Cisco’s study of over 8,000 AI leaders in 30 markets identifies a group of “Pacesetters”: about 13% of organizations for three years running. Nearly all Pacesetters (99%) have a defined AI roadmap, compared with 58% overall. Of the Pacesetters, 91% have a change-management plan, compared with 35% overall. Across all respondents, 64% struggle to centralize data.
What AI readiness covers
There is no single standard breakdown of readiness. The sources this article draws on describe it from different angles.
- Genesys lists factors such as data quality, infrastructure, skills, ethical governance, and change management. It sums them up as having the right people, processes, and data in place.
- Future Processing describes three models: Foundational (infrastructure and resources), Operational (implementation and management), and Transformational (strategic vision and business acceptance).
- Future Processing also uses a 5P framework: Purpose, People, Process, Platform, and Performance.
- Paris21 names governance safeguards, skilled people, robust data infrastructure, and clear mandates and strategies as the institutional foundations for responsible adoption.
The lists overlap more than they differ. All of them treat data, people, and governance as part of readiness, not as later additions. This article maps the factors to the ten areas of the insurer scorecard below.
| Source | Structure | Best used for |
|---|---|---|
| Genesys | Readiness factors | A quick definition and gap list |
| Future Processing | Three models; 5P framework | Structuring a self-assessment |
| Paris21 | Institutional foundations | Organizations that need governance safeguards and a clear mandate in place first |
| Cisco | Benchmark against peers | Comparing your position with the market |
AI readiness in insurance: Core systems, data, and supervision
Insurers share four readiness constraints that general guides rarely cover.
Core systems
Policy, claims, and billing data often sit in several policy administration systems, one per product line or per acquired portfolio. An AI use case needs that data in a usable form. If extraction depends on manual work, or on batch exports that are slower than the use case allows, the model will not run reliably in production. Check data access before you choose the use case, not after.
Data
Insurance data is long-lived. A life policy can stay in force for decades, so historical records carry old product codes, old formats, and old errors. Pricing and reserving data is also governed by the actuarial function. Any AI use of this data needs the same quality controls.
Supervision
The regulatory classification of each use case changes the work. The EU AI Act lists AI systems for risk assessment and pricing of natural persons in life and health insurance as high-risk (Annex III, point 5(c)). Their obligations apply from December 2, 2027.
Other AI uses, such as claims triage or fraud detection, are not listed as high-risk. Like all insurance AI, they are supervised under Solvency II and the Insurance Distribution Directive, and the AI Act’s rules on AI literacy and prohibited practices apply to them as well. EIOPA’s Opinion of August 6, 2025 clarifies supervisory expectations under existing insurance-sector legislation for AI systems that are neither prohibited nor high-risk under the AI Act. The control matrix in Artificial intelligence governance for insurers maps who owns which control.
People
Readiness depends on actuaries, underwriters, claims handlers, and IT working on the same use case. Under the AI Act, providers and deployers must take measures to support the AI literacy of their staff and of other persons operating AI systems on their behalf (Article 4). Since the AI Omnibus took effect in July 2026, no specific level of AI literacy is required, and the Commission and the Member States take a stronger role in promoting it.
Where insurers use AI and what each use case needs
Readiness is always readiness for something. EIOPA notes that insurers already use AI across the value chain, including pricing, underwriting, claims management, and fraud detection. Each of these uses places different demands on data, systems, and governance.
| Use case | Typical data | Core-system dependency | Regulatory position | Usual readiness bottleneck |
|---|---|---|---|---|
| Risk assessment and pricing in life and health insurance | Applicant, medical, and policy history | High: the result feeds the underwriting and pricing decision | High-risk under the AI Act (Annex III, point 5(c)) | Documentation, human oversight, and classification work |
| Pricing in non-life lines | Policy, claims, and exposure data | High: tariff engines and policy systems | Sectoral rules (Solvency II, IDD) as clarified by EIOPA | Data quality across product lines |
| Claims triage | Claims notifications, documents, history | Medium: the result routes work in the claims system | Sectoral rules | Integration of the output into the claims workflow |
| Fraud detection | Claims, payments, external data | Medium | Sectoral rules | Explainability of alerts to investigators |
| Document extraction for policy and claims servicing | Scanned forms, letters, emails | Medium: extracted fields must reach the policy system | Sectoral rules | Data access and field mapping to the core system |
| Customer-facing assistant | Policy and product information | Low to medium | Transparency duty: people must be informed they are interacting with an AI system, unless this is obvious, and the provider must design the system to make that possible (AI Act Article 50) | Content governance and escalation to a person |
Two patterns follow from the table. First, several use cases closely tied to underwriting and pricing depend heavily on core-system integration, so data access decides the timeline. Second, the regulatory position changes the amount of governance work, not whether governance is needed. A non-high-risk use case still falls under sectoral rules, and EIOPA’s Opinion sets supervisory expectations for it that include data governance, record-keeping, and human oversight.
Choose the first use case with both in mind. A use case with a clear owner, accessible data, and a sectoral (not high-risk) classification usually reaches production first. It also builds the data pipelines and governance routines the harder use cases need later.
The insurer AI readiness scorecard
The scorecard turns the four constraints into ten questions. Score each area 0, 1, or 2. Run it for one planned use case at a time, because readiness differs by use case.
| Area | Question | 0 points | 1 point | 2 points |
|---|---|---|---|---|
| Use case | Is there one defined use case with a business owner and a success metric? | Idea only | Defined, no owner or metric | Owner and metric agreed |
| Data access | Can the data be pulled from core systems without manual work? | Manual exports | Scheduled batch | API or stream |
| Data quality | Has the data been profiled for completeness and errors? | Never | Once, informally | Profiled, with known issues logged |
| Core-system integration | Can the model’s output be written back into the process that uses it? | No path | Manual hand-off | Integrated step |
| Classification | Has compliance classified the use case under the AI Act and sectoral rules? | Not discussed | In progress | Documented |
| Governance | Is there a named owner for the system and for each control? | No owner | Team-level owner | Named person per control |
| Human oversight | Is it defined when a person reviews or overrides the output? | Not defined | Defined informally | Documented and trained |
| Skills | Do the people who will run and supervise the system understand it? | No | Some training | Training done and recorded |
| Change management | Is there a plan for the staff whose work changes? | No | Communication only | Plan with training and feedback |
| Monitoring | Are performance, data drift, and complaints tracked after go-live? | No plan | Metrics defined | Metrics, owner, and review cadence |
How to read the score
16-20 points: ready for a production pilot. 10-15 points: ready for a limited pilot with the gaps addressed in the plan. Below 10 points: fix the foundations first. A zero in data access, governance, or human oversight blocks the pilot regardless of the total, and so does a classification that is not yet documented.
Use the result as input to the plan, not as a grade. A low score in one area shows where to invest first. Repeat the scorecard before each move from pilot to production.
Illustrative example (hypothetical)
Consider an insurer planning AI-supported triage of motor claims. A claims director owns the use case, and a target for faster routing is set (2 points). Claims data comes from a nightly batch export (1 point). The data was profiled once during a migration project (1 point). The triage result would have to be keyed into the claims system by hand (1 point).
Compliance has classified the use case as outside Annex III and subject to sectoral rules (2 points). Ownership sits with the claims IT team, not a named person (1 point). Override rules for handlers are discussed but not written down (1 point). Handlers have had no training (0 points). Communication with the claims team is planned (1 point). Monitoring metrics are defined but have no owner (1 point).
The total is 11 points: ready for a limited pilot. The plan would first name an owner for the system and its controls, write down the override rules, and train the handlers. It would then build the write-back into the claims system before production. The zero in skills does not block the pilot, but it has to be fixed before go-live.
Frameworks and indexes for assessing AI readiness
A readiness framework gives you a process to follow. A readiness index gives you a score to compare against peers. Organizations often adopt a framework expecting a score, or an index expecting a roadmap, and get neither.
| Framework / Index | Scope | Strengths | Limitations | Best for |
|---|---|---|---|---|
| Cisco AI Readiness Index | Global survey of over 8,000 AI leaders, repeated yearly | Large comparative dataset; compares a leading group, the Pacesetters, with all respondents | Benchmarks against a global group that does not reflect insurance regulation | Large organizations wanting peer comparison |
| Future Processing 5P | Organizational capability across Purpose, People, Process, Platform, and Performance | Practical checklist format with self-assessment questions | Does not produce a comparable score across organizations | Mid-size organizations wanting a guided self-assessment |
| Paris21 AI Readiness Self-Assessment | Institutional readiness of national statistical offices | Strong focus on governance and mandate | Built for public statistics, not commercial companies | Data-heavy institutions with a public mandate |
| Insurer scorecard (this article) | One use case in one insurer | Covers core systems and regulatory classification | Not benchmarked; depends on honest scoring | Insurers preparing a specific AI project |
Organizations early in their AI work usually gain more from a framework’s step-by-step guidance. Organizations further along gain more from an index’s comparison. Insurers usually need both, plus the regulatory layer that neither provides.
What the index says about AI agents
Cisco’s 2025 study adds a warning that matters for the next wave of use cases. Cisco found that 83% of organizations plan to deploy AI agents, and nearly 40% expect them to work alongside employees within a year. Readiness to run them safely lags behind. Among Pacesetters, 87% are highly aware of AI-specific threats, compared with 42% overall. Likewise, 75% of Pacesetters are fully equipped to control and secure AI agents, compared with 31% overall.
For an insurer, agents that act inside claims or underwriting processes raise the stakes for the governance questions in this scorecard. The companion article Multi-agent systems in insurance covers where human oversight belongs in such designs.
What a public-sector guide teaches insurers
The Paris21 guide was written for national statistical offices, not insurers. Its starting point is still familiar. These offices must meet growing demand for timely, granular, and trustworthy data while contending with strained budgets, skills gaps, and outdated systems. Replace “statistical office” with “insurer running decades-old policy systems,” and the constraint is the same.
The guide’s answer is to treat governance safeguards, skilled people, robust data infrastructure, and clear mandates as foundations, not as later additions. That is the logic of the scorecard: a zero in data access, governance, or human oversight, or a classification that is not yet documented, blocks the pilot, however strong the model looks.
Four steps to assess AI readiness
The assessment follows four repeatable steps: evaluation, planning, implementation, and monitoring. Each step produces the input for the next. Skipping planning is the most common reason initiatives stall.
Step 1: Evaluation
Run the scorecard for the planned use case. Audit data access and quality, catalog skills and training gaps, and check whether infrastructure can carry the workload. Genesys describes this step as finding gaps, such as missing training data or unclear use cases.
What you need before this step: one named use case and access to the people who own its data and process. What you have after it: a fully scored scorecard, a list of gaps, and the regulatory classification request sent to compliance. Common failure point: scoring the whole company instead of one use case, which produces an average that helps nobody.
Step 2: Planning
Turn the findings into a prioritized roadmap. Decide which use case to pilot first and what data remediation it needs. Agree which skills gaps need hiring or training. Define which governance controls must exist before the system touches production data or a customer decision.
What you need before this step: the fully scored scorecard and the classification from compliance. What you have after it: a roadmap with owners, dates, and the controls required before go-live. Common failure point: planning the model work in detail and leaving data access and write-back to “later.”
Step 3: Implementation
Run the pilot against the plan. Set checkpoints where you reassess readiness instead of assuming the first assessment still holds. What you need before this step: the roadmap, a pilot scope, and the agreed human-oversight rules. What you have after it: pilot results, a rescored scorecard, and a go/no-go decision for production. Common failure point: extending the pilot indefinitely instead of deciding.
Step 4: Monitoring
Track performance, data drift, and the readiness indicators after go-live. Cisco repeats its own benchmark every year. Its 2025 study found that 95% of Pacesetters track the impact of their AI investments. For more on monitoring, see Data monitoring for AI and regulatory reporting.
What you need before this step: metrics, an owner for them, and a review cadence. What you have after it: a regular report that covers model performance, data quality, and compliance. Common failure point: tracking accuracy only, while data quality and complaints go unwatched.
Enterprise context: Readiness in a regulated insurer
In insurance, each step carries requirements a generic framework does not specify. The evaluation step must check whether a decision can be reconstructed and explained to a supervisor after the fact. The planning step must name who is accountable for the output before the system touches a claims or underwriting decision. The monitoring step must track whether outputs stay consistent with the documentation filed at deployment. Confirm the regulatory classification of each system with compliance and legal; no readiness framework makes that determination.
The assessment is more objective when someone outside the project team runs it. That can be internal audit, a cross-departmental review board, or an external specialist. An independent assessment also helps when internal sign-off requires documentation.
What this is not: Common misconceptions and boundaries
Readiness is often misunderstood in ways that lead organizations to overestimate their preparedness.
| Belief | Reality | Why it matters |
|---|---|---|
| Readiness is a technology problem | The Genesys definition includes data quality, skills, ethical governance, and change management, not only infrastructure | Upgrading infrastructure alone leaves the people and governance gaps open |
| A checklist is enough | A checklist finds gaps; it does not plan, implement, or monitor the response | Teams that stop at the checklist skip the planning step |
| Readiness is a one-time milestone | Cisco has repeated its benchmark yearly for three years; scaling, new systems, and new regulation can lower readiness between assessments | A single assessment misses regressions caused by scaling or new regulation |
| Readiness belongs to IT | Change management and governance are business functions | Projects without business sponsorship lose support after the pilot |
| One framework fits every organization | Cisco, Future Processing, and Paris21 were built for different contexts | A benchmark built for one sector can misdiagnose another |
| A high readiness score means compliance | Readiness shows whether you can run the system; the AI Act and sectoral rules decide what you must do with it | A ready team can still deploy a high-risk system without the required documentation and oversight |
These boundaries apply to this article too. The scorecard is a structured starting point for self-assessment, not a certified audit or legal advice.
Frequently asked questions about AI readiness for insurers
What are the three pillars of AI readiness?
There is no single official set. A practical three-part summary is people, processes, and data: Genesys describes readiness as having the right people, processes, and data in place. Its fuller definition adds infrastructure, ethical governance, and change management.
What does an AI readiness assessment for an insurer include?
It covers the use case, data access, data quality, core-system integration, classification, governance, human oversight, skills, change management, and monitoring. The scorecard in this article scores each of the ten areas from 0 to 2 for one planned use case.
How do you prepare for AI in a regulated insurance environment?
Use the same four steps (evaluation, planning, implementation, monitoring) with auditability built into each one. Classify the use case under the AI Act and sectoral rules first. Then name an owner for the system and for each control before it touches a customer decision.
What is the difference between an AI readiness framework and an AI readiness index?
A framework gives you a process to follow; an index gives you a benchmarked score. The Future Processing 5P model is a framework for self-assessment. The Cisco AI Readiness Index compares organizations against a global dataset and identifies the “Pacesetter” group.
How can I objectively assess my organization’s AI readiness?
Let someone outside the project team run the assessment against a documented scorecard. Internal audit, a cross-departmental board, or an external specialist can do it. Keep the scored results as a record for the next assessment and for compliance review.
Who should own the AI readiness assessment in an insurer?
The business owner of the planned use case should own it, because the assessment ends in a decision about that use case. The work itself needs data owners, IT, compliance, and the people who will supervise the system. A person outside the project, such as internal audit, should review the scores before the go/no-go decision.
What are common pitfalls when assessing AI readiness?
The first is treating the checklist as the whole assessment and skipping planning and monitoring. The second is assessing once and never repeating it. The third is applying a framework built for another sector without adapting it to insurance regulation and core systems.
Next steps: From readiness to an AI project
Start with the scorecard for one planned use case. Then use the four-step method to turn the scores into a plan.
Three companion articles cover the next questions. Artificial intelligence governance for insurers maps who owns each control under the AI Act and Solvency II. Multi-agent systems in insurance covers agent architectures in claims and underwriting. Data monitoring for AI and regulatory reporting covers what to monitor once the system is live. For the migration side of core-system readiness, see how digital technologies and efficient migration enable the digital transformation of insurance.
At msg life Slovakia, I work as a Data Scientist with experience in developing insurance systems. I focus on the design and compliance of agentic AI systems in insurance and write about how the regulatory requirements of the EU AI Act translate into real-world architecture. I'm the author of the video series S Michalom o AI on the msg life Slovakia YouTube channel, where I explore various aspects of agentic programming.
Get to know us
See who translates insurance into code at msg life Slovakia.