Banking and insurance
A closely supervised sector: what is permissible, where Annex III bites, and what evidence supervisors expect.
Where things sit
| Task | Classification |
|---|---|
| Checking documents for completeness | unproblematic |
| Drafting correspondence | unproblematic, with review |
| Comparing policy wordings | unproblematic |
| Detecting fraud patterns | limited, expressly excluded from Annex III |
| Assessing creditworthiness | high risk |
| Risk assessment in life and health insurance | high risk |
| Classifying complaints | limited, with deadline management |
What applies beyond the AI Act
| Regime | Subject |
|---|---|
| Prudential supervision | Outsourcing, governance, reporting |
| DORA | Operational resilience, third-party risk, incident reporting |
| GDPR | Legal basis, Art. 22, data subject rights |
| Anti-money-laundering law | Due diligence, retention |
| Consumer protection | Intelligibility, duties to give reasons |
The second point has immediate consequences for tool choice: an AI provider supporting a critical function is an ICT third-party provider with the corresponding contractual and exit requirements.
Introduction
- 01
Start in administration
Document checking and correspondence. Immediate value, manageable duties.
- 02
Determine role and class
Before a system with decision effect is planned, not after.
- 03
Explainability from the start
A decision that cannot be justified in one sentence is not tenable towards customers.
- 04
Notify outsourcing
Before the first processing, not at the next inspection.
What must be evidenced under high risk
- Purpose, boundary and limits of the system, in writing.
- Datasets with provenance, representativeness and an examination for bias.
- Quality and error rates broken out by customer group.
- Human oversight: who, with what authority, on what basis.
- Logs per decision, with model version and input data.
- A procedure for handling complaints against a decision.
Explainability towards the person
Art. 22 GDPR gives rights to human intervention, to express a view and to contest an automated individual decision. In practice that means: there must be a justification a person understands, and a person who can stand behind it.
An attribution such as "feature X contributed 0.3" does not suffice. What works is a statement in domain language: which facts were decisive and what would have to change. Which is exactly why linear models remain widespread in this sector, see Regression.
Entry sheet: banking and insurance
FREE ACCOUNT
Entry sheet for banking and insurance
This sector's tasks by risk class, the points to settle beforehand, and the metrics the benefit shows up in.
Checklist3 items