Worked example: sector guidance and the two-track problem

Sector guidance is the part of the landscape practitioners most often misdescribe in their own policies, usually by overstating its force. Two documents dominate for insurance and banking in this region, and both need careful reading for what they are as well as what they say.

FINMA Guidance 08/2024

Published 18 December 2024, titled governance and risk management when using artificial intelligence. Two characteristics decide how you cite it. It is guidance, not a circular, and it creates no new rules. It states how the supervisor reads obligations that already exist.

Its four themes are governance and accountability, robustness and reliability, explainability and transparency, and non-discrimination. Its expectations include an inventory of AI applications, risk classification, clearly allocated roles, testing before deployment and continuous monitoring, documentation proportionate to risk, and independent review separate from the developing unit. And it states that responsibility remains with the institution even where AI is bought in or outsourced.

Independent review separate from the developing unit is the expectation that most often forces an organisational change. A data science team that builds, tests, signs off and monitors its own models does not meet it, however good the work is.

EIOPA Opinion EIOPA-BoS-25-360

Issued 6 August 2025 on AI governance and risk management. Two characteristics again decide how you use it. It is addressed to national competent authorities, not directly to undertakings, and it creates no new rules. It interprets Solvency II, the Insurance Distribution Directive, DORA and GDPR for AI.

And it carries a deliberate scope decision that is easy to miss and expensive to miss: it excludes prohibited and high-risk AI Act systems to avoid overlap.

The two-track consequence

Put those two facts together and an insurer's portfolio splits.

Systems that are high-risk under the AI Act are governed by the Act's own requirements. The EIOPA Opinion does not cover them by design. For a life insurer that means the underwriting risk assessment and pricing models sit on the AI Act track.

Systems that are not high-risk are outside the Act's heavy requirements but inside the EIOPA interpretation of Solvency II, IDD, DORA and GDPR that supervisors are being told to apply. Claims triage that is not pricing, fraud detection, marketing propensity, customer service assistants and operational document processing mostly sit here.

So an insurer runs two governance tracks over one portfolio, with different sources, different vocabularies and different addressees. A single internal AI policy that cites only the AI Act leaves the larger half of the estate ungoverned in the eyes of its own supervisor. A policy that cites only EIOPA fails on the systems that matter most.

The other regimes that arrive by geography

An international insurer will also meet the NAIC Model Bulletin on the Use of AI Systems by Insurers, adopted 4 December 2023. It expects a written AIS Program covering governance, risk management, internal controls and third-party AI. It is a model bulletin rather than a model law and takes effect only as each state adopts it, so the correct internal statement names the adopting states rather than asserting nationwide application.

Where employment screening is used in New York City, Local Law 144 applies with rules at 6 RCNY sections 5-300 to 5-304: an independent bias audit no more than one year old, calculating selection rate, scoring rate and impact ratio by sex, race or ethnicity and intersectional categories, with categories under 2% of the data excludable if the justification is stated, a published summary with prescribed contents, and candidate notice at least ten business days before use. Note what the law requires: calculation and publication. The 0.80 four-fifths figure comes from the EEOC Uniform Guidelines and is not an LL144 threshold. Building an internal pass/fail gate on 0.80 and calling it LL144 compliance misstates the law in both directions.

Worked example: mapping one insurer's estate to tracks

A group insurer with Swiss, EU and US operations holds the eleven systems from earlier in this module. The mapping exercise takes an afternoon and settles a year of argument.

AI Act high-risk track, to 2 December 2027: life underwriting, health pricing, HR screening. Full Article 26 deployer set, Article 27 impact assessment for the two insurance pricing systems, and a role determination under Article 25 for each.

EIOPA-interpreted track, now: fraud triage, claims summarisation, motor pricing, marketing propensity, document classification, reserving. Governed through Solvency II, IDD, DORA and GDPR as the Opinion reads them, with FINMA Guidance 08/2024 expectations applying to the Swiss entity across the whole estate regardless of track.

Article 50 track, live now: the website chatbot and the correspondence assistant, with a visible label the firm controls rather than a vendor watermark.

US track, by state: the AIS Program where the NAIC bulletin has been adopted, and a bias audit for HR screening if it is used for New York City roles.

Four tracks, one estate. The value of writing it down is that every subsequent argument about whether a control is required becomes an argument about which track a system sits on, which is answerable, rather than an argument about whether AI governance is worth doing, which is not.

As of 24 September 2026.