AI readiness assessment for insurers: A scorecard across data, core systems, and governance

Before an insurer commits budget to an AI project, it needs to know whether that project can run in production, not just in a pilot. This article gives you a scorecard for answering that question for one planned use case. It rates ten areas on a 0–2 scale: use case, data access, data quality, core-system integration, classification, governance, human oversight, skills, change management, and monitoring. A zero in data access, governance, or human oversight blocks the pilot regardless of the total, and so does a classification that is not yet documented. The article also explains when to use a readiness framework and when to use a readiness index. It walks through a four-step assessment: evaluation, planning, implementation, and monitoring. Finally, it lists the misconceptions that lead regulated companies to overestimate how prepared they are.

Introduction: Why AI readiness matters for insurers

AI readiness often decides whether a pilot scales or disappears after a proof of concept. Genesys defines it as an organization’s preparedness to implement and scale AI technologies effectively. The definition covers data quality, infrastructure, skills, ethical governance, and change management. That breadth is the point. Readiness is a technology question, a data question, and a people question. In insurance, it is also a compliance question. Genesys notes that companies with high readiness move from experimentation to production faster. An assessment surfaces gaps, such as missing training data or unclear use cases.

For an insurer, readiness also raises questions that a generic checklist does not ask. Can this decision be reconstructed for a supervisor six months later? Can the data be pulled from the policy administration system without manual exports? Who is accountable if the output is wrong?

AI readiness gaps in practice

Market data shows how few organizations are fully prepared. Cisco’s study of over 8,000 AI leaders in 30 markets identifies a group of “Pacesetters”: about 13% of organizations for three years running. Nearly all Pacesetters (99%) have a defined AI roadmap, compared with 58% overall. Of the Pacesetters, 91% have a change-management plan, compared with 35% overall. Across all respondents, 64% struggle to centralize data.

What AI readiness covers

There is no single standard breakdown of readiness. The sources this article draws on describe it from different angles.

• Genesys lists factors such as data quality, infrastructure, skills, ethical governance, and change management. It sums them up as having the right people, processes, and data in place.
• Future Processing describes three models: Foundational (infrastructure and resources), Operational (implementation and management), and Transformational (strategic vision and business acceptance).
• Future Processing also uses a 5P framework: Purpose, People, Process, Platform, and Performance.
• Paris21 names governance safeguards, skilled people, robust data infrastructure, and clear mandates and strategies as the institutional foundations for responsible adoption.

The lists overlap more than they differ. All of them treat data, people, and governance as part of readiness, not as later additions. This article maps the factors to the ten areas of the insurer scorecard below.

AI readiness in insurance: Core systems, data, and supervision

Insurers share four readiness constraints that general guides rarely cover.

Core systems

Policy, claims, and billing data often sit in several policy administration systems, one per product line or per acquired portfolio. An AI use case needs that data in a usable form. If extraction depends on manual work, or on batch exports that are slower than the use case allows, the model will not run reliably in production. Check data access before you choose the use case, not after.

Data

Insurance data is long-lived. A life policy can stay in force for decades, so historical records carry old product codes, old formats, and old errors. Pricing and reserving data is also governed by the actuarial function. Any AI use of this data needs the same quality controls.

Supervision

The regulatory classification of each use case changes the work. The EU AI Act lists AI systems for risk assessment and pricing of natural persons in life and health insurance as high-risk (Annex III, point 5(c)). Their obligations apply from December 2, 2027.

Other AI uses, such as claims triage or fraud detection, are not listed as high-risk. Like all insurance AI, they are supervised under Solvency II and the Insurance Distribution Directive, and the AI Act’s rules on AI literacy and prohibited practices apply to them as well. EIOPA’s Opinion of August 6, 2025 clarifies supervisory expectations under existing insurance-sector legislation for AI systems that are neither prohibited nor high-risk under the AI Act. The control matrix in Artificial intelligence governance for insurers maps who owns which control.

People

Readiness depends on actuaries, underwriters, claims handlers, and IT working on the same use case. Under the AI Act, providers and deployers must take measures to support the AI literacy of their staff and of other persons operating AI systems on their behalf (Article 4). Since the AI Omnibus took effect in July 2026, no specific level of AI literacy is required, and the Commission and the Member States take a stronger role in promoting it.

Where insurers use AI and what each use case needs

Readiness is always readiness for something. EIOPA notes that insurers already use AI across the value chain, including pricing, underwriting, claims management, and fraud detection. Each of these uses places different demands on data, systems, and governance.

Two patterns follow from the table. First, several use cases closely tied to underwriting and pricing depend heavily on core-system integration, so data access decides the timeline. Second, the regulatory position changes the amount of governance work, not whether governance is needed. A non-high-risk use case still falls under sectoral rules, and EIOPA’s Opinion sets supervisory expectations for it that include data governance, record-keeping, and human oversight.

Choose the first use case with both in mind. A use case with a clear owner, accessible data, and a sectoral (not high-risk) classification usually reaches production first. It also builds the data pipelines and governance routines the harder use cases need later.

The insurer AI readiness scorecard

The scorecard turns the four constraints into ten questions. Score each area 0, 1, or 2. Run it for one planned use case at a time, because readiness differs by use case.

How to read the score

16-20 points: ready for a production pilot. 10-15 points: ready for a limited pilot with the gaps addressed in the plan. Below 10 points: fix the foundations first. A zero in data access, governance, or human oversight blocks the pilot regardless of the total, and so does a classification that is not yet documented.

Use the result as input to the plan, not as a grade. A low score in one area shows where to invest first. Repeat the scorecard before each move from pilot to production.

Illustrative example (hypothetical)

Consider an insurer planning AI-supported triage of motor claims. A claims director owns the use case, and a target for faster routing is set (2 points). Claims data comes from a nightly batch export (1 point). The data was profiled once during a migration project (1 point). The triage result would have to be keyed into the claims system by hand (1 point).

Compliance has classified the use case as outside Annex III and subject to sectoral rules (2 points). Ownership sits with the claims IT team, not a named person (1 point). Override rules for handlers are discussed but not written down (1 point). Handlers have had no training (0 points). Communication with the claims team is planned (1 point). Monitoring metrics are defined but have no owner (1 point).

The total is 11 points: ready for a limited pilot. The plan would first name an owner for the system and its controls, write down the override rules, and train the handlers. It would then build the write-back into the claims system before production. The zero in skills does not block the pilot, but it has to be fixed before go-live.

Frameworks and indexes for assessing AI readiness

A readiness framework gives you a process to follow. A readiness index gives you a score to compare against peers. Organizations often adopt a framework expecting a score, or an index expecting a roadmap, and get neither.

Organizations early in their AI work usually gain more from a framework’s step-by-step guidance. Organizations further along gain more from an index’s comparison. Insurers usually need both, plus the regulatory layer that neither provides.

What the index says about AI agents

Cisco’s 2025 study adds a warning that matters for the next wave of use cases. Cisco found that 83% of organizations plan to deploy AI agents, and nearly 40% expect them to work alongside employees within a year. Readiness to run them safely lags behind. Among Pacesetters, 87% are highly aware of AI-specific threats, compared with 42% overall. Likewise, 75% of Pacesetters are fully equipped to control and secure AI agents, compared with 31% overall.

For an insurer, agents that act inside claims or underwriting processes raise the stakes for the governance questions in this scorecard. The companion article Multi-agent systems in insurance covers where human oversight belongs in such designs.

What a public-sector guide teaches insurers

The Paris21 guide was written for national statistical offices, not insurers. Its starting point is still familiar. These offices must meet growing demand for timely, granular, and trustworthy data while contending with strained budgets, skills gaps, and outdated systems. Replace “statistical office” with “insurer running decades-old policy systems,” and the constraint is the same.

The guide’s answer is to treat governance safeguards, skilled people, robust data infrastructure, and clear mandates as foundations, not as later additions. That is the logic of the scorecard: a zero in data access, governance, or human oversight, or a classification that is not yet documented, blocks the pilot, however strong the model looks.

Four steps to assess AI readiness

The assessment follows four repeatable steps: evaluation, planning, implementation, and monitoring. Each step produces the input for the next. Skipping planning is the most common reason initiatives stall.

Step 1: Evaluation

Run the scorecard for the planned use case. Audit data access and quality, catalog skills and training gaps, and check whether infrastructure can carry the workload. Genesys describes this step as finding gaps, such as missing training data or unclear use cases.

What you need before this step: one named use case and access to the people who own its data and process. What you have after it: a fully scored scorecard, a list of gaps, and the regulatory classification request sent to compliance. Common failure point: scoring the whole company instead of one use case, which produces an average that helps nobody.

Step 2: Planning

Turn the findings into a prioritized roadmap. Decide which use case to pilot first and what data remediation it needs. Agree which skills gaps need hiring or training. Define which governance controls must exist before the system touches production data or a customer decision.

What you need before this step: the fully scored scorecard and the classification from compliance. What you have after it: a roadmap with owners, dates, and the controls required before go-live. Common failure point: planning the model work in detail and leaving data access and write-back to “later.”

Step 3: Implementation

Run the pilot against the plan. Set checkpoints where you reassess readiness instead of assuming the first assessment still holds. What you need before this step: the roadmap, a pilot scope, and the agreed human-oversight rules. What you have after it: pilot results, a rescored scorecard, and a go/no-go decision for production. Common failure point: extending the pilot indefinitely instead of deciding.

Step 4: Monitoring

Track performance, data drift, and the readiness indicators after go-live. Cisco repeats its own benchmark every year. Its 2025 study found that 95% of Pacesetters track the impact of their AI investments. For more on monitoring, see Data monitoring for AI and regulatory reporting.

What you need before this step: metrics, an owner for them, and a review cadence. What you have after it: a regular report that covers model performance, data quality, and compliance. Common failure point: tracking accuracy only, while data quality and complaints go unwatched.

Enterprise context: Readiness in a regulated insurer

In insurance, each step carries requirements a generic framework does not specify. The evaluation step must check whether a decision can be reconstructed and explained to a supervisor after the fact. The planning step must name who is accountable for the output before the system touches a claims or underwriting decision. The monitoring step must track whether outputs stay consistent with the documentation filed at deployment. Confirm the regulatory classification of each system with compliance and legal; no readiness framework makes that determination.

The assessment is more objective when someone outside the project team runs it. That can be internal audit, a cross-departmental review board, or an external specialist. An independent assessment also helps when internal sign-off requires documentation.

What this is not: Common misconceptions and boundaries

Readiness is often misunderstood in ways that lead organizations to overestimate their preparedness.

These boundaries apply to this article too. The scorecard is a structured starting point for self-assessment, not a certified audit or legal advice.