For an insurer, readiness also raises questions that a generic checklist does not ask. Can this decision be reconstructed for a supervisor six months later? Can the data be pulled from the policy administration system without manual exports? Who is accountable if the output is wrong?<\/p>\n
AI readiness gaps in practice<\/h3>\n
Market data shows how few organizations are fully prepared. Cisco\u2019s study<\/a> of over 8,000 AI leaders in 30 markets identifies a group of \u201cPacesetters\u201d: about 13% of organizations for three years running. Nearly all Pacesetters (99%) have a defined AI roadmap, compared with 58% overall. Of the Pacesetters, 91% have a change-management plan, compared with 35% overall. Across all respondents, 64% struggle to centralize data.<\/p>\n There is no single standard breakdown of readiness. The sources this article draws on describe it from different angles.<\/p>\n The lists overlap more than they differ. All of them treat data, people, and governance as part of readiness, not as later additions. This article maps the factors to the ten areas of the insurer scorecard below.<\/p>\n Insurers share four readiness constraints that general guides rarely cover.<\/p>\n Policy, claims, and billing data often sit in several policy administration systems, one per product line or per acquired portfolio. An AI use case needs that data in a usable form. If extraction depends on manual work, or on batch exports that are slower than the use case allows, the model will not run reliably in production. Check data access before you choose the use case, not after.<\/p>\n Insurance data is long-lived. A life policy can stay in force for decades, so historical records carry old product codes, old formats, and old errors. Pricing and reserving data is also governed by the actuarial function. Any AI use of this data needs the same quality controls.<\/p>\n The regulatory classification of each use case changes the work. The EU AI Act lists AI systems for risk assessment and pricing of natural persons in life and health insurance as high-risk (Annex III, point 5(c)<\/a>). Their obligations apply from December 2, 2027<\/a>.<\/p>\n Other AI uses, such as claims triage or fraud detection, are not listed as high-risk. Like all insurance AI, they are supervised under Solvency II and the Insurance Distribution Directive, and the AI Act\u2019s rules on AI literacy and prohibited practices apply to them as well. EIOPA\u2019s Opinion of August 6, 2025<\/a> clarifies supervisory expectations under existing insurance-sector legislation for AI systems that are neither prohibited nor high-risk under the AI Act. The control matrix in Artificial intelligence governance for insurers<\/a> maps who owns which control.<\/p>\n Readiness depends on actuaries, underwriters, claims handlers, and IT working on the same use case. Under the AI Act, providers and deployers must take measures to support the AI literacy of their staff and of other persons operating AI systems on their behalf (Article 4). Since the AI Omnibus took effect in July 2026, no specific level of AI literacy is required<\/a>, and the Commission and the Member States take a stronger role in promoting it.<\/p>\n Readiness is always readiness for something. EIOPA notes that insurers already use AI across the value chain, including pricing, underwriting, claims management, and fraud detection. Each of these uses places different demands on data, systems, and governance.<\/p>\n Two patterns follow from the table. First, several use cases closely tied to underwriting and pricing depend heavily on core-system integration, so data access decides the timeline. Second, the regulatory position changes the amount of governance work, not whether governance is needed. A non-high-risk use case still falls under sectoral rules, and EIOPA\u2019s Opinion sets supervisory expectations for it that include data governance, record-keeping, and human oversight.<\/p>\n Choose the first use case with both in mind. A use case with a clear owner, accessible data, and a sectoral (not high-risk) classification usually reaches production first. It also builds the data pipelines and governance routines the harder use cases need later.<\/p>\n The scorecard turns the four constraints into ten questions. Score each area 0, 1, or 2. Run it for one planned use case at a time, because readiness differs by use case.<\/p>\n 16-20 points: ready for a production pilot. 10-15 points: ready for a limited pilot with the gaps addressed in the plan. Below 10 points: fix the foundations first. A zero in data access, governance, or human oversight blocks the pilot regardless of the total, and so does a classification that is not yet documented.<\/p>\n Use the result as input to the plan, not as a grade. A low score in one area shows where to invest first. Repeat the scorecard before each move from pilot to production.<\/p>\n Consider an insurer planning AI-supported triage of motor claims. A claims director owns the use case, and a target for faster routing is set (2 points). Claims data comes from a nightly batch export (1 point). The data was profiled once during a migration project (1 point). The triage result would have to be keyed into the claims system by hand (1 point).<\/p>\n Compliance has classified the use case as outside Annex III and subject to sectoral rules (2 points). Ownership sits with the claims IT team, not a named person (1 point). Override rules for handlers are discussed but not written down (1 point). Handlers have had no training (0 points). Communication with the claims team is planned (1 point). Monitoring metrics are defined but have no owner (1 point).<\/p>\n The total is 11 points: ready for a limited pilot. The plan would first name an owner for the system and its controls, write down the override rules, and train the handlers. It would then build the write-back into the claims system before production. The zero in skills does not block the pilot, but it has to be fixed before go-live.<\/p>\n A readiness framework gives you a process to follow. A readiness index gives you a score to compare against peers. Organizations often adopt a framework expecting a score, or an index expecting a roadmap, and get neither.<\/p>\n Organizations early in their AI work usually gain more from a framework\u2019s step-by-step guidance. Organizations further along gain more from an index\u2019s comparison. Insurers usually need both, plus the regulatory layer that neither provides.<\/p>\n Cisco\u2019s 2025 study adds a warning that matters for the next wave of use cases. Cisco found that 83% of organizations plan to deploy AI agents, and nearly 40% expect them to work alongside employees within a year. Readiness to run them safely lags behind. Among Pacesetters, 87% are highly aware of AI-specific threats, compared with 42% overall. Likewise, 75% of Pacesetters are fully equipped to control and secure AI agents, compared with 31% overall.<\/p>\nWhat AI readiness covers<\/h2>\n
\n
\n
\n \nSource<\/th>\n Structure<\/th>\n Best used for<\/th>\n<\/tr>\n<\/thead>\n \n Genesys<\/td>\n Readiness factors<\/td>\n A quick definition and gap list<\/td>\n<\/tr>\n \n Future Processing<\/td>\n Three models; 5P framework<\/td>\n Structuring a self-assessment<\/td>\n<\/tr>\n \n Paris21<\/td>\n Institutional foundations<\/td>\n Organizations that need governance safeguards and a clear mandate in place first<\/td>\n<\/tr>\n \n Cisco<\/td>\n Benchmark against peers<\/td>\n Comparing your position with the market<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n AI readiness in insurance: Core systems, data, and supervision<\/h2>\n
Core systems<\/h3>\n
Data<\/h3>\n
Supervision<\/h3>\n
People<\/h3>\n
Where insurers use AI and what each use case needs<\/h2>\n
\n
\n \nUse case<\/th>\n Typical data<\/th>\n Core-system dependency<\/th>\n Regulatory position<\/th>\n Usual readiness bottleneck<\/th>\n<\/tr>\n<\/thead>\n \n Risk assessment and pricing in life and health insurance<\/td>\n Applicant, medical, and policy history<\/td>\n High: the result feeds the underwriting and pricing decision<\/td>\n High-risk under the AI Act (Annex III, point 5(c))<\/td>\n Documentation, human oversight, and classification work<\/td>\n<\/tr>\n \n Pricing in non-life lines<\/td>\n Policy, claims, and exposure data<\/td>\n High: tariff engines and policy systems<\/td>\n Sectoral rules (Solvency II, IDD) as clarified by EIOPA<\/td>\n Data quality across product lines<\/td>\n<\/tr>\n \n Claims triage<\/td>\n Claims notifications, documents, history<\/td>\n Medium: the result routes work in the claims system<\/td>\n Sectoral rules<\/td>\n Integration of the output into the claims workflow<\/td>\n<\/tr>\n \n Fraud detection<\/td>\n Claims, payments, external data<\/td>\n Medium<\/td>\n Sectoral rules<\/td>\n Explainability of alerts to investigators<\/td>\n<\/tr>\n \n Document extraction for policy and claims servicing<\/td>\n Scanned forms, letters, emails<\/td>\n Medium: extracted fields must reach the policy system<\/td>\n Sectoral rules<\/td>\n Data access and field mapping to the core system<\/td>\n<\/tr>\n \n Customer-facing assistant<\/td>\n Policy and product information<\/td>\n Low to medium<\/td>\n Transparency duty: people must be informed they are interacting with an AI system, unless this is obvious, and the provider must design the system to make that possible (AI Act Article 50)<\/td>\n Content governance and escalation to a person<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n ![\"AI](\"https:\/\/msg-life.sk\/wp-content\/uploads\/2026\/11\/insurance-ai-use-cases-readiness.webp\")
The insurer AI readiness scorecard<\/h2>\n
\n
\n \nArea<\/th>\n Question<\/th>\n 0 points<\/th>\n 1 point<\/th>\n 2 points<\/th>\n<\/tr>\n<\/thead>\n \n Use case<\/td>\n Is there one defined use case with a business owner and a success metric?<\/td>\n Idea only<\/td>\n Defined, no owner or metric<\/td>\n Owner and metric agreed<\/td>\n<\/tr>\n \n Data access<\/td>\n Can the data be pulled from core systems without manual work?<\/td>\n Manual exports<\/td>\n Scheduled batch<\/td>\n API or stream<\/td>\n<\/tr>\n \n Data quality<\/td>\n Has the data been profiled for completeness and errors?<\/td>\n Never<\/td>\n Once, informally<\/td>\n Profiled, with known issues logged<\/td>\n<\/tr>\n \n Core-system integration<\/td>\n Can the model\u2019s output be written back into the process that uses it?<\/td>\n No path<\/td>\n Manual hand-off<\/td>\n Integrated step<\/td>\n<\/tr>\n \n Classification<\/td>\n Has compliance classified the use case under the AI Act and sectoral rules?<\/td>\n Not discussed<\/td>\n In progress<\/td>\n Documented<\/td>\n<\/tr>\n \n Governance<\/td>\n Is there a named owner for the system and for each control?<\/td>\n No owner<\/td>\n Team-level owner<\/td>\n Named person per control<\/td>\n<\/tr>\n \n Human oversight<\/td>\n Is it defined when a person reviews or overrides the output?<\/td>\n Not defined<\/td>\n Defined informally<\/td>\n Documented and trained<\/td>\n<\/tr>\n \n Skills<\/td>\n Do the people who will run and supervise the system understand it?<\/td>\n No<\/td>\n Some training<\/td>\n Training done and recorded<\/td>\n<\/tr>\n \n Change management<\/td>\n Is there a plan for the staff whose work changes?<\/td>\n No<\/td>\n Communication only<\/td>\n Plan with training and feedback<\/td>\n<\/tr>\n \n Monitoring<\/td>\n Are performance, data drift, and complaints tracked after go-live?<\/td>\n No plan<\/td>\n Metrics defined<\/td>\n Metrics, owner, and review cadence<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n How to read the score<\/h3>\n
Illustrative example (hypothetical)<\/h3>\n
![\"Hypothetical](\"https:\/\/msg-life.sk\/wp-content\/uploads\/2026\/11\/readiness-scorecard-example-motor-claims.webp\")
Frameworks and indexes for assessing AI readiness<\/h2>\n
\n
\n \nFramework \/ Index<\/th>\n Scope<\/th>\n Strengths<\/th>\n Limitations<\/th>\n Best for<\/th>\n<\/tr>\n<\/thead>\n \n Cisco AI Readiness Index<\/td>\n Global survey of over 8,000 AI leaders, repeated yearly<\/td>\n Large comparative dataset; compares a leading group, the Pacesetters, with all respondents<\/td>\n Benchmarks against a global group that does not reflect insurance regulation<\/td>\n Large organizations wanting peer comparison<\/td>\n<\/tr>\n \n Future Processing 5P<\/td>\n Organizational capability across Purpose, People, Process, Platform, and Performance<\/td>\n Practical checklist format with self-assessment questions<\/td>\n Does not produce a comparable score across organizations<\/td>\n Mid-size organizations wanting a guided self-assessment<\/td>\n<\/tr>\n \n Paris21 AI Readiness Self-Assessment<\/td>\n Institutional readiness of national statistical offices<\/td>\n Strong focus on governance and mandate<\/td>\n Built for public statistics, not commercial companies<\/td>\n Data-heavy institutions with a public mandate<\/td>\n<\/tr>\n \n Insurer scorecard (this article)<\/td>\n One use case in one insurer<\/td>\n Covers core systems and regulatory classification<\/td>\n Not benchmarked; depends on honest scoring<\/td>\n Insurers preparing a specific AI project<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n What the index says about AI agents<\/h3>\n