Governance, risk & compliance
Your superpower at a regulated insurer (EU AI Act · DORA · GDPR).
This is where you leapfrog a “normal” AI lead. At an insurer the constraint isn't can we build it — it's can we run it safely under regulation. Few people speak both AI and risk. Master this and you're indispensable across every BU.
Key ideas
- 1
Know the EU AI Act risk tiers (prohibited / high-risk / limited / minimal). Insurance pricing & risk assessment for life/health can be high-risk.
- 2
Know DORA (ICT & third-party/vendor risk, resilience testing — your AI vendors are third parties) and GDPR (lawful basis, data minimization, Art. 22 automated decisions, never leak PII into prompts/logs).
- 3
Leverage existing model risk management: insurers already validate actuarial models — frame AI/LLM governance as an extension of frameworks the company already trusts.
- 4
Use NIST AI RMF and ISO/IEC 42001 as the skeleton for internal AI governance.
- 5
Build an AI use-case intake & risk-triage template — it puts you at the center of every BU's workflow.
The regulatory landscape (working knowledge)
- EU AI Act — risk tiers, transparency obligations, timelines; insurance is explicitly in scope for parts of it.
- DORA — applies to financial entities incl. insurers; ICT risk, third-party (vendor) risk, operational resilience testing.
- GDPR — lawful basis, purpose limitation, DPIAs, automated-decision rights (Art. 22), and strict PII handling.
- Standards — NIST AI RMF, ISO/IEC 42001 (AI management systems), ISO 23894 (AI risk).
Your unfair advantage: existing model risk governance
Insurers already have actuarial model governance and model inventories. Position AI/LLM governance as an extension of frameworks the company already trusts — this makes you credible to risk officers fast.
Make it practical
Build an intake template (~10 questions) that auto-classifies risk tier and routes to the right approvals, and co-author governance lightly WITH Legal, Privacy/DPO, Security and Model Risk so it's theirs too.
Watch
Do the work
0/4 · 0%Test yourself
Why is governance described as a “superpower” specifically at an insurer?
27 chapters · progress saves automatically