14. InsurTech, AI and Digital Regulation

Introduction and Context

Insurance has always depended on information: the probability of loss, the value exposed to risk, the conduct of the policyholder, and the cost of settling a claim. Digital technologies are changing how this information is collected, interpreted and acted upon. InsurTech refers broadly to the use of technology to improve insurance products, distribution, underwriting, administration, claims and risk management. Artificial intelligence, connected devices, cloud computing, application programming interfaces (APIs), distributed ledgers and advanced analytics are now embedded in many insurance processes.

The legal significance of these developments is substantial. A digital insurance transaction is not merely a traditional contract delivered through a mobile application. It may involve automated decisions, continuous data collection, third-party platforms, machine-generated prices, algorithmic fraud detection and cross-border data transfers. These features raise questions about consent, fairness, explainability, evidence, responsibility and regulatory jurisdiction.

The central regulatory challenge is to obtain the benefits of innovation without weakening the basic functions of insurance law. Policyholders must receive understandable information, valid consent must be obtained, risks must be assessed fairly, claims must be handled lawfully, and firms must remain accountable even when decisions are delegated to software or external technology providers.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the principal technologies used in contemporary insurance.

2. Distinguish smart contracts, parametric insurance, telematics, IoT-based insurance and embedded insurance.

3. Analyse automated underwriting and claims systems from legal, operational and ethical perspectives.

4. Evaluate regulatory sandboxes, open insurance and data-sharing arrangements.

5. Apply principles of explainability, fairness, human oversight, cybersecurity and algorithmic accountability.

6. Recommend governance controls for insurers implementing AI and digital platforms.

The Digital Transformation of the Insurance Value Chain

Insurance technology can be understood by examining where it changes the insurance value chain. In distribution, comparison engines, digital brokers, mobile applications and embedded offers allow insurance to be purchased at the point of another transaction. In underwriting, predictive models combine application data with external, behavioural or sensor-generated information. In policy administration, cloud platforms automate billing, endorsements, renewals and communication. In claims, image recognition, natural-language processing and rules engines can support notification, damage assessment, fraud screening and payment.

Automation does not eliminate the legal character of these activities. An algorithmic premium is still a premium; an electronically issued policy is still a contract; an automated rejection remains a decision affecting a customer. The insurer ordinarily cannot avoid regulatory duties by stating that a vendor, model or artificial intelligence system made the decision. Responsibility must be allocated through contracts, governance arrangements and applicable law, but accountability should remain traceable to the regulated entity.

Important Technologies and Concepts

Telematics and Usage-Based Insurance

Telematics combines telecommunications and informatics to collect information about the use or operation of an insured object. In motor insurance, a device or mobile application may record distance, speed, braking, acceleration, location or time of travel. A usage-based policy may charge according to kilometres driven, while a behaviour-based policy may adjust pricing according to driving patterns.

Telematics can improve risk differentiation and encourage safer behaviour. It can also create privacy and fairness concerns. Location data may reveal sensitive personal information, and a driver with limited ability to avoid night travel may be disadvantaged by a model that treats all night driving as equally risky. Regulation therefore requires attention to purpose limitation, data minimisation, transparency, retention and the validity of consent.

Internet of Things in Insurance

The Internet of Things (IoT) is a network of physical objects containing sensors, software and connectivity. Examples include industrial machines, smart homes, wearable devices, agricultural sensors and connected vehicles. IoT insurance may be preventive rather than merely compensatory. A water sensor can alert a homeowner to a leak; a factory sensor can identify overheating before equipment fails; a wearable device may support wellness-based products.

The legal position becomes complex when a sensor fails, data is inaccurate or a warning is ignored. Contracts should identify whether the device is advisory or safety-critical, who maintains it, how outages are treated and whether failure to act on an alert affects coverage. Security weaknesses in connected devices may also create direct and systemic risks.

Parametric Insurance

Traditional indemnity insurance compensates an assessed financial loss. Parametric insurance pays when a specified objective trigger occurs, such as rainfall below a defined level, wind speed above a threshold, an earthquake of a stated magnitude or a flight delay exceeding a specified period. The payment is calculated according to the parameter rather than the policyholder’s actual loss.

Parametric products can provide rapid and relatively inexpensive payments, particularly where loss assessment is difficult. Their principal legal issue is basis risk: the policyholder may suffer a loss without the trigger occurring, or the trigger may occur without equivalent loss. Clear disclosure of the trigger, data source, measurement method, payment formula and exclusions is therefore essential. The product must also be classified and supervised consistently with its substance rather than its label.

Smart Contracts and Distributed Ledgers

A smart contract is software that automatically performs specified actions when coded conditions are met. In insurance, it may be used to release a payment after an authorised data source confirms a parametric event, or to automate premium collection and policy administration. A distributed ledger can provide a shared, tamper-evident record of transactions among authorised participants.

A smart contract is not necessarily a complete legal contract. Code may implement only some contractual terms, while legal issues such as misrepresentation, unfair terms, mistake, force majeure, dispute resolution and regulatory compliance remain outside the code. Coding errors also create a gap between intended legal meaning and automated execution. Effective design therefore combines legal drafting, technical testing, access controls, audit trails and an override mechanism for exceptional cases.

Embedded Insurance

Embedded insurance is offered within a non-insurance purchase or digital journey. Travel cover may be presented while a customer books a flight; device protection may be offered at the point of sale; shipping cover may be included in an online marketplace transaction. The arrangement can reduce search costs and improve distribution, but it may obscure the identity of the insurer, the scope of cover, exclusions and the customer’s ability to opt out.

Regulatory duties concerning disclosure, remuneration, licensing, suitability where applicable, complaints and cancellation remain important. Convenience cannot replace informed choice. Platforms must also clarify whether they act as agents, distributors, technology providers or merely introducers.

Automated Underwriting and Claims

Automated underwriting uses rules, statistical models or machine-learning systems to assess applications and determine eligibility, terms or price. A rules engine may apply predetermined questions and thresholds. A machine-learning model may identify relationships in large datasets that are not obvious to a human analyst. These approaches can improve speed and consistency, but predictive accuracy does not by itself establish legal or ethical acceptability.

A sound underwriting model should have a defined purpose, a documented population and data basis, testing for errors and discrimination, controlled deployment, monitoring for drift and a process for reviewing exceptional cases. Proxy discrimination is a particular risk. A model may exclude or surcharge a group without using a protected characteristic directly, because variables such as postcode, language, occupation or purchasing behaviour may correlate with that characteristic.

Automated claims systems may classify claims, estimate damage from photographs, identify unusual patterns or recommend settlement. Straight-through processing can be valuable for simple, low-value claims, but a fully automated denial may be inappropriate where facts are disputed or the consequences are serious. Human review should be available, meaningful and capable of changing the initial result.

Explainability and the Right to Understand

Explainability concerns the ability to communicate how a system reached, or materially contributed to, a decision. It does not always require disclosure of source code. A useful explanation should ordinarily identify the principal factors considered, the role of automated processing, the information used, the relevant policy rule and the available review or appeal route.

There is a difference between technical interpretability and customer explanation. A data scientist may need feature-importance analysis, while a policyholder needs a comprehensible reason for a price, refusal or claim decision. Explanations must be accurate rather than merely persuasive. If an insurer cannot explain a decision sufficiently to investigate complaints and demonstrate compliance, the system may be unsuitable for that use.

Human Oversight

Human oversight is not satisfied by placing a nominal employee at the end of an automated workflow. The reviewer must have adequate competence, access to relevant information, authority to question the system and sufficient time to conduct an independent assessment. Oversight is particularly important for vulnerable customers, adverse decisions, suspected fraud, medical or disability-related information and cases involving significant financial impact.

The appropriate model may be human-in-the-loop, where a person approves a decision; human-on-the-loop, where a person supervises automated operation and intervenes when alerts arise; or human-in-command, where the organisation retains the power to suspend or redesign the system. The choice should reflect the risk and reversibility of the decision.

Regulatory and Governance Frameworks

Algorithmic Accountability

Algorithmic accountability is the organisational duty to ensure that automated systems are lawful, reliable, fair, explainable and subject to effective challenge. It extends beyond model accuracy. A governance framework should cover the entire lifecycle:

• purpose definition and legal assessment;
• data provenance, quality and lawful use;
• model development and independent validation;
• impact assessment before deployment;
• approval by an accountable committee or officer;
• monitoring, incident reporting and periodic review;
• customer communication, complaints and redress; and
• controlled retirement or replacement.

A model inventory is a practical tool. It records each material algorithm, its owner, purpose, data inputs, decision impact, validation status, vendors, performance indicators and review date. Documentation should be sufficient for internal audit, regulators and competent investigators to reconstruct what happened.

Bias, Fairness and Proportionality

Fairness in insurance is not a single mathematical formula. Different models of fairness may conflict. Treating similarly situated individuals alike, reducing unequal outcomes, preserving actuarial relevance and preventing prohibited discrimination are related but distinct objectives. A variable can be statistically predictive while still producing unacceptable social or legal effects.

Insurers should test training and outcome data for missingness, sampling bias and historical discrimination. They should compare error rates and adverse outcomes across relevant groups where lawful and appropriate, investigate proxies, and document the reasons for using sensitive or potentially sensitive variables. Controls may include feature removal, reweighting, alternative models, human review, limits on automated decisions and post-deployment monitoring. Fairness assessment must continue after launch because data distributions and customer behaviour change.

Data Protection and Consent

Digital insurance requires a disciplined approach to personal data. Key questions include: What data is collected? For what specified purpose? Is it necessary? What is the legal basis for processing? How long is it retained? With whom is it shared? Can the customer access, correct or challenge it? Special care is required for health, biometric, precise location and other sensitive information.

Consent should not be treated as a universal solution. It must be informed and appropriately voluntary, and it does not justify excessive collection or unfair use. Privacy notices should distinguish essential processing from optional analytics and should explain automated decision-making in accessible language. Data governance must also address cross-border transfers, deletion, vendor access and secondary use.

Cybersecurity and Operational Resilience

The insurance sector is an attractive target because it holds financial, health and identity data and is connected to brokers, hospitals, repair networks, payment systems and cloud providers. Threats include ransomware, credential theft, malicious insiders, model poisoning, adversarial manipulation of images or sensor data, denial-of-service attacks and unauthorised changes to smart-contract code.

Cybersecurity should be risk-based and integrated into product design. Core controls include strong identity management, encryption, secure software development, network segmentation, vulnerability testing, logging, backup, incident response and recovery exercises. Third-party risk is especially important: outsourcing technology does not outsource regulatory responsibility. Contracts should establish security standards, audit rights, breach notification, data location, continuity arrangements and exit support.

Regulatory Sandboxes

A regulatory sandbox allows selected firms to test innovative products or processes under controlled conditions, usually with defined scope, duration, safeguards and reporting. Sandboxes can help regulators understand new technology and help firms identify compliance problems before full-scale deployment.

They are not immunity from law. A responsible test should specify the customer group, maximum exposure, disclosures, complaint route, compensation or remediation plan, data controls and conditions for suspension. Regulators should also avoid allowing sandbox participation to become an informal quality endorsement. Lessons from testing should be shared, where possible, without compromising confidential information.

Open Insurance and APIs

Open insurance refers to the controlled sharing and use of insurance-related data through standardised interfaces, subject to permission, security and governance. APIs can enable customers to authorise data access, compare products, connect prevention services or move information between providers. Open ecosystems may increase competition and personalisation, but they also create risks of data concentration, unauthorised reuse, cyberattack and customer confusion about responsibility.

Effective open-insurance arrangements require clear consent management, authentication, data standards, access controls, liability allocation and mechanisms for revoking permissions. Customers should be able to understand which entity receives data and for what purpose. Interoperability must not become a justification for unrestricted surveillance.

Applied Case: Automated Motor Insurance Platform

Background

DriveSure, an illustrative insurer, launches a mobile-based motor policy using telematics. Customers receive a premium based on distance driven and a behavioural score derived from acceleration, braking, time of travel and location. Claims are submitted through photographs, which an AI system uses to estimate repair costs. Low-value claims are paid automatically.

Situation and Problem

After six months, complaints increase. Customers who work night shifts receive higher prices. Some drivers report that the application recorded journeys inaccurately when their phones lost connectivity. A customer’s claim is rejected because the image-recognition model classifies damage as pre-existing. The insurer cannot provide a clear explanation beyond stating that “the algorithm assessed the risk.”

Analysis

The platform creates several connected risks. The pricing model may use time and location as proxies for occupation, socioeconomic status or neighbourhood. Connectivity failures may create inaccurate data and unfairly penalise customers. The claims model may have been trained primarily on clear daylight images and perform poorly on certain devices or conditions. Automated processing has also weakened the customer’s ability to challenge decisions.

Approach and Solution

DriveSure should first suspend automatic adverse decisions in disputed or high-impact cases. It should audit the data pipeline, distinguish missing data from risky behaviour, and provide a documented correction process. The pricing model should be tested for disparate outcomes and proxy effects. Alternative evidence, such as verified mileage records, should be accepted where telematics data is unreliable.

For claims, the insurer should publish a meaningful explanation, preserve the images and model output used in the decision, and provide trained human review. Model validation should include different lighting conditions, phone types and vehicle categories. The insurer should revise customer disclosures, limit retention of precise location data, and establish a governance committee responsible for monitoring performance and fairness.

Outcome

In this illustrative case, the revised process may reduce automation speed for complex cases but improve accuracy, trust and defensibility. The principal lesson is that digital efficiency must be assessed together with data quality, contestability and accountability. A technically sophisticated system can still produce an unlawful or commercially damaging outcome if its governance is weak.

Professional and Managerial Implications

Senior managers should treat InsurTech as an operating-model decision rather than merely an IT purchase. Before deployment, they should ask what customer problem is being solved, whether the data is necessary, how the decision can be explained, what happens when the system fails and who has authority to intervene. Boards should receive reports on material models, incidents, bias indicators, vendor concentration and remediation.

Legal, compliance, actuarial, underwriting, claims, information-security, data-science and customer-service functions should collaborate from the design stage. Actuaries and model developers should not work in isolation from policy wording and conduct requirements. Procurement teams should evaluate technology vendors not only on price and functionality but also on auditability, security, portability and support for regulatory enquiries.

Common mistakes include assuming that consent cures every privacy problem, treating a high accuracy score as proof of fairness, using a vendor’s model without independent validation, failing to test for data drift, and allowing human reviewers merely to rubber-stamp automated outcomes. Another mistake is designing a digital process for an ideal user while excluding customers with disabilities, limited connectivity, low digital literacy or language barriers.

Emerging Developments

Insurance is moving toward continuous risk assessment, real-time prevention, synthetic data, generative AI assistants, digital identity, automated document analysis and increasingly integrated ecosystems. Generative AI may assist with correspondence, coding, summarising records and claims triage, but it can produce fabricated explanations, expose confidential information or reproduce hidden bias. Its use should therefore be bounded by approved purposes, access controls, testing, human review and records of material outputs.

Future regulation is likely to emphasise risk classification, transparency, resilience, data governance, third-party accountability and individual rights to contest important decisions. The precise legal rules differ across jurisdictions, but the underlying direction is consistent: innovation must remain compatible with fairness, security, consumer protection and demonstrable responsibility.

Best-Practice Framework for Responsible Digital Insurance

A practical framework can be expressed through six questions. First, is the purpose legitimate, necessary and clearly defined? Second, is the data accurate, proportionate and lawfully obtained? Third, has the model been independently tested for performance, bias, security and explainability? Fourth, are customers given understandable information and a meaningful route to challenge? Fifth, are responsibility, oversight and vendor obligations documented? Sixth, can the organisation detect, contain and remedy failure?

These questions should be applied throughout the lifecycle rather than only at product approval. Responsible digital regulation is therefore both a legal requirement and a management discipline. It connects innovation with actuarial integrity, customer conduct, operational resilience and institutional trust.

Chapter Summary

InsurTech changes insurance distribution, underwriting, administration, claims and prevention through technologies such as AI, telematics, IoT, smart contracts, APIs and connected platforms. Parametric insurance pays on objective triggers, while embedded insurance places cover within another customer journey. Automated systems can improve speed and consistency but create risks involving privacy, bias, inaccurate data, opacity, cyberattack and weak accountability.

Effective digital regulation requires explainable decisions, meaningful human oversight, lawful and proportionate data use, model validation, continuous monitoring, cybersecurity and clear responsibility for vendors and insurers. Regulatory sandboxes can support controlled experimentation, while open insurance requires permission-based sharing, interoperability and strong security. The central principle is that automation changes the method of decision-making, not the insurer’s responsibility to act fairly, lawfully and transparently.

Key Terms

InsurTech: The application of technology to insurance products, processes and distribution.

Telematics: Technology that collects and transmits information about the use or operation of an insured object.

Usage-based insurance: Insurance priced partly according to actual usage, such as distance driven.

Internet of Things: Connected physical devices that collect, process or exchange data.

Parametric insurance: Insurance that pays when a specified measurable trigger occurs.

Basis risk: The possibility that the parametric payment does not correspond to the policyholder’s actual loss.

Smart contract: Software that automatically performs coded actions when specified conditions occur.

Embedded insurance: Insurance offered within a non-insurance purchase or digital customer journey.

Automated underwriting: Use of rules or algorithms to assess risk and determine insurance terms.

Automated claims: Use of technology to assess, classify, investigate or settle claims.

Explainability: The capacity to communicate the significant factors and logic behind an automated decision.

Human oversight: Competent human supervision with authority to review, question or override an automated system.

Algorithmic accountability: Organisational responsibility for the lawful, fair, reliable and reviewable operation of algorithms.

Proxy discrimination: Unfair differentiation produced through variables that indirectly correlate with protected characteristics.

Data minimisation: Collection and use of no more personal data than is necessary for a defined purpose.

Regulatory sandbox: A controlled regulatory environment for testing innovative products or processes.

Open insurance: Controlled sharing and use of insurance data through permission-based systems and interfaces.

Model drift: Deterioration or change in model performance as data, behaviour or conditions change.

Operational resilience: The ability to continue important operations and recover from disruption.

Review Questions

Short Answer Questions

1. What is the difference between usage-based and behaviour-based insurance?

2. Why is basis risk important in parametric insurance?

3. What is meant by explainability in automated insurance decisions?

4. Identify two cybersecurity risks affecting connected insurance systems.

5. Why does outsourcing an AI system not remove an insurer’s accountability?

Long Answer Questions

1. Explain the legal and operational implications of telematics-based motor insurance.

2. Discuss the advantages and limitations of smart contracts in insurance.

3. Analyse the requirements of a sound algorithmic accountability framework.

4. Explain how human oversight should operate in automated underwriting and claims.

5. Discuss the regulatory opportunities and risks associated with open insurance and APIs.

Analytical / Application Questions

1. An insurer’s pricing model uses location, time of travel and mobile-device data. Design an assessment to identify privacy, proxy-discrimination and fairness risks.

2. A parametric crop policy pays only when rainfall recorded by one sensor falls below a threshold, although several farmers report drought losses. Analyse the legal and product-design issues and recommend safeguards.

3. A claims algorithm rejects photographs from older mobile phones at a much higher rate than photographs from newer devices. Propose a governance, technical and customer-remedy response.

22. Multiple Choice Questions with Answers

Question 1

Which feature most clearly distinguishes parametric insurance from traditional indemnity insurance?

A. It always uses artificial intelligence to calculate premiums.

B. Payment depends on a defined objective trigger rather than assessed actual loss.

C. It can only be sold through an embedded platform.

D. It eliminates the possibility of underwriting risk.

Correct Answer: B. Payment depends on a defined objective trigger rather than assessed actual loss.

Question 2

A telematics model charges night-shift workers more because it treats all night driving as equally risky. What is the primary governance concern?

A. Ledger immutability

B. Proxy discrimination and insufficient contextual analysis

C. Failure to create a parametric trigger

D. Excessive claims reserving

Correct Answer: B. Proxy discrimination and insufficient contextual analysis

Question 3

Which statement best describes a smart contract in insurance?

A. It is automatically a complete legal contract in every jurisdiction.

B. It is software that executes coded actions when specified conditions occur.

C. It prevents all disputes concerning policy interpretation.

D. It removes the need for regulatory supervision.

Correct Answer: B. It is software that executes coded actions when specified conditions occur.

Question 4

What is the most appropriate response when an automated claims system rejects a high-impact claim?

A. Accept the result because automated systems are neutral.

B. Delete the model output to protect commercial secrecy.

C. Provide meaningful human review and an opportunity to challenge the decision.

D. Require the customer to purchase a new policy before review.

Correct Answer: C. Provide meaningful human review and an opportunity to challenge the decision.

Question 5

Which practice best supports algorithmic accountability?

A. Keeping models undocumented to prevent reverse engineering

B. Maintaining a model inventory with owners, purposes, inputs and review dates

C. Measuring only overall prediction accuracy

D. Allowing vendors to make all compliance decisions

Correct Answer: B. Maintaining a model inventory with owners, purposes, inputs and review dates

Question 6

Why can a high accuracy score fail to establish that an insurance model is fair?

A. Accuracy is unrelated to all insurance decisions.

B. A model may be accurate overall while producing unequal errors or outcomes across groups.

C. Fair models cannot use data.

D. Accuracy applies only to manual underwriting.

Correct Answer: B. A model may be accurate overall while producing unequal errors or outcomes across groups.

Question 7

What is a central risk of basis risk in parametric insurance?

A. The policyholder may suffer a loss without the specified trigger occurring.

B. The insurer must always inspect the physical damage before payment.

C. The policy cannot use an external data source.

D. The trigger is necessarily confidential.

Correct Answer: A. The policyholder may suffer a loss without the specified trigger occurring.

Question 8

Which control is most relevant to third-party AI governance?

A. Removing audit rights from the vendor contract

B. Allowing unrestricted secondary use of customer data

C. Requiring security standards, breach notification and continuity obligations

D. Prohibiting all technology outsourcing

Correct Answer: C. Requiring security standards, breach notification and continuity obligations

Question 9

A regulatory sandbox should primarily be understood as:

A. A permanent exemption from insurance law

B. A controlled test environment with defined safeguards and reporting

C. A guarantee that the tested product is commercially safe

D. A replacement for customer complaints procedures

Correct Answer: B. A controlled test environment with defined safeguards and reporting

Question 10

What is the principal regulatory concern in embedded insurance?

A. Insurance can never be distributed through a non-insurance platform.

B. Convenience may obscure the insurer, coverage, exclusions and customer choice.

C. Embedded products cannot use APIs.

D. Embedded insurance eliminates the need for licensing.

Correct Answer: B. Convenience may obscure the insurer, coverage, exclusions and customer choice.