Luca BertonInsurance AI Under DORA: Beyond Traditional Model Risk
Insurance companies have used models for decades — actuarial tables, risk scoring, claims triage. But AI-powered underwriting, parametric insurance, and automated claims processing create new categories of operational risk that DORA now regulates explicitly.
This guide maps DORA requirements to insurance-specific AI use cases, with practical infrastructure patterns for Solvency II-regulated entities.
Insurance AI Use Cases and DORA Implications
Underwriting AI
Use case: Automated risk assessment using alternative data sources (IoT, satellite imagery, social data)
DORA implications:
- Third-party data provider risk management (Art. 28-44)
- Model change management when retraining on new data sources (Art. 9)
- Continuity planning — manual underwriting fallback when AI is unavailable (Art. 11)
- Incident reporting when model produces materially wrong risk assessments (Art. 17-23)
Claims Processing AI
Use case: Automated first notice of loss (FNOL), damage assessment from images, fraud detection
DORA implications:
- Resilience testing of the claims pipeline under catastrophe scenarios (100x normal volume) (Art. 24-27)
- Data quality monitoring for image classification models (Art. 13)
- Audit trail for every automated claims decision (Art. 5)
- Vendor risk for computer vision API providers (Art. 28-44)
Fraud Detection AI
Use case: Real-time fraud scoring on claims submissions using ML models
DORA implications:
- Model performance monitoring with drift detection (Art. 13)
- Adversarial testing — can fraudsters evade the model? (Art. 24-27)
- Explainability for regulatory review and policyholder appeals
- Data lineage for training data provenance and bias monitoring
EIOPA Expectations for AI in Insurance
The European Insurance and Occupational Pensions Authority (EIOPA) has published specific guidance on AI use in insurance:
- Ethical AI principles — Fairness, transparency, and accountability in automated insurance decisions
- Governance framework — Board oversight of AI strategy with clear accountability structures
- Consumer protection — Explainable decisions for policyholders, especially in claims denial
- Bias monitoring — Regular testing for discriminatory outcomes in pricing and underwriting models
- Outsourcing guidelines — AI services from third parties fall under EIOPA outsourcing requirements
Kubernetes Recipes
Practical guide for container orchestration and deployment — hands-on patterns you can use today.
View on Amazon →Infrastructure Architecture for Insurance AI
Key Architecture Decisions
- Multi-model orchestration — Insurance AI typically runs 10-50 models simultaneously (pricing, underwriting, claims, fraud). Infrastructure must manage model versioning and routing at scale.
- Catastrophe-ready scaling — Natural disasters trigger 10-100x claims volume. AI infrastructure must auto-scale inference capacity while maintaining decision quality.
- Actuarial integration — AI models must feed into traditional actuarial workflows. Infrastructure needs data pipelines connecting ML outputs to reserving and capital calculations.
- Regulatory reporting — Automated extraction of model performance metrics for Solvency II ORSA (Own Risk and Solvency Assessment) and DORA incident reports.
Solvency II and DORA Intersection
Insurance companies face a dual regulatory burden: Solvency II (prudential) and DORA (operational resilience). For AI systems, these intersect in important ways:
- Model risk capital — Poor AI governance increases operational risk capital requirements under Solvency II
- ORSA integration — AI risks must be reflected in the Own Risk and Solvency Assessment
- Outsourcing overlap — EIOPA outsourcing guidelines and DORA third-party provisions apply simultaneously to AI vendors
- Reporting alignment — DORA incident reports should feed into Solvency II supervisory reporting
ServiceNow Basics: IT Automation & AI-Powered Workflows
Design AI-powered workflows in ServiceNow for IT operations. In collaboration with Starweaver.
Start on Coursera →90-Day Implementation Roadmap for Insurers
Month 1: AI model inventory, criticality classification, third-party dependency mapping
Month 2: Design resilient infrastructure with catastrophe-scenario scaling, implement model monitoring
Month 3: Resilience testing (adversarial + chaos), incident response procedures, documentation for supervisory review
Related Solution
Navigating AI adoption in a regulated environment? Our readiness assessment maps infrastructure, governance, and compliance gaps in 3-4 weeks.
Explore AI Readiness for Regulated Enterprises →