13. InsurTech, AI and Digital Transformation

Introduction and Context

Insurance has always depended on information. Insurers collect facts about people, property, health, vehicles and businesses; classify risks; calculate premiums; settle claims; and maintain sufficient capital to meet uncertain future obligations. Digital transformation changes the speed, scale and form in which these activities occur. Data may now be collected continuously through connected devices, analysed by machine-learning systems and exchanged through cloud platforms or application programming interfaces (APIs). Policyholders may purchase cover through a mobile application, receive an automated underwriting decision within seconds and submit a claim using photographs or sensor data.

InsurTech refers broadly to the use of technology to create, distribute, administer or regulate insurance. It includes digital distribution, advanced analytics, artificial intelligence (AI), telematics, robotic process automation, cloud computing, distributed ledgers, smart contracts, digital identity and regulatory technology. InsurTech may be developed by established insurers, technology firms, specialist start-ups, intermediaries or partnerships among them.

Digitalisation creates opportunities for greater efficiency, improved risk assessment, wider access and more responsive customer service. It also changes the regulatory problem. A regulator must assess not only whether an insurer is financially sound, but also whether automated decisions are lawful, fair, explainable, secure, auditable and consistent with the insurer’s obligations to policyholders. Technology does not remove the fundamental principles of insurance regulation; it makes their application more complex.

The central question is therefore not whether an insurer uses AI or cloud computing. It is whether the insurer can demonstrate that its technology supports sound underwriting, fair treatment, effective governance, protection of personal data, operational resilience and the ability to meet contractual and regulatory obligations.

Learning Objectives

After studying this chapter, the learner should be able to:

1. Explain the meaning, scope and significance of InsurTech and digital transformation in insurance.

2. Analyse the regulatory implications of automated underwriting, telematics, cloud services, smart contracts and AI.

3. Apply concepts of explainability, model risk, bias, human oversight and accountability to insurance decisions.

4. Distinguish between regulatory sandboxes, innovation offices and other supervisory approaches.

5. Evaluate how RegTech can support compliance, reporting, monitoring and supervisory effectiveness.

6. Identify major ethical, operational, cyber, privacy and consumer-protection risks.

7. Recommend governance and control measures for responsible digital insurance.

From Digital Insurance to Intelligent Insurance

Digital insurance has several layers. At the most basic level, an insurer digitises existing documents and processes. A higher level involves redesigning processes around online channels, automated workflows and integrated data. At the most advanced level, the insurer uses predictive models and real-time information to create new products, pricing methods and claims services.

This progression can be understood through four capabilities. First, digital access allows customers to obtain information, quotations, policy documents and claims services through electronic channels. Second, process automation reduces manual intervention in repetitive activities such as data entry, identity verification and document classification. Third, analytical intelligence uses statistical or machine-learning models to predict risk, fraud, lapse, claims frequency or customer needs. Fourth, connected ecosystems permit insurers to exchange information with banks, hospitals, vehicle manufacturers, platforms, repair networks and public authorities.

The distinction between digitising a process and transforming a business model is important. Uploading a paper proposal form to a website is digitisation. Using connected vehicle data to offer usage-based motor insurance, automatically adjust risk signals and provide safety feedback is a broader transformation. Each additional level increases both potential value and regulatory complexity.

Important terminology includes:

• InsurTech: Technology-enabled innovation in insurance products, processes, distribution or regulation.
• Artificial intelligence: Computational techniques that perform tasks associated with human cognitive functions, such as prediction, classification or language processing.
• Machine learning: Methods that identify patterns in data and improve performance through training rather than relying solely on explicitly programmed rules.
• Automated underwriting: Use of software, rules or models to assess risk and make or support underwriting decisions.
• Telematics: Collection and analysis of data about behaviour, location or condition through connected devices, particularly in vehicles.
• Cloud computing: On-demand access to shared computing resources, storage and applications delivered through a network.
• Smart contract: Code deployed on a distributed ledger or similar system that automatically executes specified actions when programmed conditions are met.
• RegTech: Technology used by regulated firms to manage compliance, reporting, monitoring and risk obligations.
• SupTech: Technology used by supervisory authorities to collect, analyse and act on regulatory information.
• Model risk: The possibility that a model produces erroneous, unreliable or misused outputs.
• Explainability: The extent to which the operation or output of a model can be understood and communicated.
• Human oversight: Meaningful human ability to review, challenge, intervene in or reverse an automated process.

Automated Underwriting and Algorithmic Decision-Making

Underwriting traditionally involves collecting proposal information, applying eligibility rules, assessing hazards and selecting terms. Automated underwriting performs some or all of these tasks through rules engines, predictive models, external databases and decision workflows. A simple rules engine may reject an application when a clearly stated eligibility condition is not met. A machine-learning model may estimate expected claims cost from hundreds of variables and recommend a premium or referral to an underwriter.

Automated underwriting can reduce processing time and improve consistency. It may also enable insurers to evaluate risks that could not previously be assessed economically. However, an automated decision is still an underwriting decision. The insurer remains responsible for the policy terms, disclosures, pricing methodology and treatment of the applicant.

A sound automated-underwriting process normally contains the following stages:

1. Purpose definition: The insurer specifies the decision to be supported, such as acceptance, pricing, referral or fraud screening.

2. Data governance: Sources, permissions, quality, relevance, retention and security of data are assessed.

3. Model development: Variables, assumptions, target outcomes and validation methods are documented.

4. Testing: The model is tested for accuracy, stability, discriminatory effects, data leakage and performance across relevant groups.

5. Deployment controls: Access, thresholds, exception handling, logging and escalation are established.

6. Monitoring: Actual outcomes are compared with predictions, and drift or unexpected effects are investigated.

7. Review and retirement: The model is periodically revalidated, modified or withdrawn when its performance or purpose is no longer acceptable.

A key regulatory issue is the use of proxy variables. A model may not directly use a protected characteristic but may use variables strongly correlated with it, such as location, occupation, language, purchasing behaviour or digital activity. Correlation does not automatically establish unlawful discrimination, but it should trigger investigation into justification, proportionality, impact and available alternatives.

Explainability, Transparency and Human Oversight

Explainability is not identical to revealing source code. A policyholder generally needs an understandable explanation of the significant factors affecting a decision, the consequences of that decision and the means of obtaining review or correction. A regulator or independent validator may require more technical information, including model architecture, training data, performance metrics and validation results.

Three forms of explanation are useful. Global explanation describes how a model generally behaves. Local explanation identifies the factors that influenced a particular decision. Process explanation describes the governance, data sources, approval steps and controls surrounding the model. An explanation that merely states that an application was rejected by “the algorithm” is not meaningful transparency.

Human oversight must also be substantive rather than ceremonial. A human reviewer should have sufficient authority, competence, time and information to challenge an automated output. If employees are measured only on speed or are unable to depart from the system recommendation, human involvement may become a rubber stamp. High-impact decisions, unusual cases, complaints and suspected errors should have clear escalation routes.

The appropriate level of oversight depends on the consequences of the decision. Automated administrative tasks may require routine quality assurance. Decisions affecting coverage eligibility, claim repudiation, vulnerable customers or significant financial interests may require stronger review, documentation and appeal mechanisms.

Model Risk and Bias Management

Insurance models are abstractions of reality. They simplify complex behaviour and depend on historical data, assumptions and definitions. Model risk arises when data are inaccurate, the model is poorly specified, relationships change, the output is interpreted incorrectly or the model is used outside its approved purpose.

Model governance should assign ownership and establish a model inventory. Each model should have a documented purpose, owner, version, data description, materiality classification, validation status, limitations and approved uses. Independent validation should examine conceptual soundness, data quality, coding, performance, sensitivity and implementation. The intensity of review should reflect the model’s effect on customers, financial results and regulatory obligations.

Bias may enter through incomplete samples, historical discrimination, measurement choices, labels created by earlier human decisions or unequal data quality among groups. A model may have high overall accuracy while performing poorly for a smaller population. Therefore, insurers should examine performance across relevant segments and consider measures such as error rates, calibration, approval rates and premium or claim outcomes. No single fairness metric is universally correct; metrics may conflict, and their relevance depends on the product, legal framework and decision purpose.

Bias mitigation may occur before modelling, during model development or after deployment. Examples include improving data representation, removing unjustified variables, applying constrained modelling, adjusting decision thresholds, adding manual review and monitoring outcomes. Removing a sensitive variable does not necessarily remove bias because proxy variables may remain.

Telematics and Usage-Based Insurance

Telematics uses sensors, mobile devices, vehicle systems or other connected technologies to record information such as distance, speed, acceleration, braking, time of travel and location. In motor insurance, usage-based insurance may be structured as pay-as-you-drive, based mainly on distance, or pay-how-you-drive, based on behavioural indicators. Similar principles may be applied in commercial fleets, agriculture, property monitoring and health-related programmes.

Telematics may improve risk differentiation and encourage safer behaviour. It can support immediate assistance after an accident, facilitate claims verification and reduce certain forms of fraud. Nevertheless, continuous data collection raises questions about consent, purpose limitation, data minimisation, retention, third-party access, cybersecurity and the accuracy of sensor measurements.

A regulatory assessment should ask whether the data are necessary and proportionate to the insurance purpose; whether customers understand the effect of participation; whether non-participation results in unfair exclusion; whether the data can be corrected; and whether location or behavioural information exposes individuals to additional risks. Insurers should not assume that technical availability makes data ethically or legally appropriate to use.

Cloud Services, Outsourcing and Operational Resilience

Cloud services allow insurers to obtain computing capacity, storage, analytics and software without owning all the underlying infrastructure. They can support scalability, disaster recovery, collaboration and rapid deployment. Cloud arrangements may involve public, private, hybrid or multi-cloud environments and may include several subcontractors.

Cloud adoption does not transfer regulatory responsibility to the service provider. The insurer remains accountable for protecting policyholder information, maintaining records, managing access, ensuring continuity and satisfying supervisory requirements. A written contract should address service levels, security controls, audit rights, incident notification, data location where relevant, subcontracting, exit assistance, data return and secure deletion.

Concentration risk is significant. If many insurers rely on the same provider, a disruption may affect the wider market. Insurers should identify critical services, test recovery arrangements, maintain dependency maps and avoid assuming that a cloud provider’s general reputation substitutes for firm-specific controls. Business continuity planning should cover loss of connectivity, ransomware, corrupted data, provider failure and inability to migrate quickly.

Smart Contracts and Distributed Ledgers

A smart contract is software that executes an action when programmed conditions are met. In insurance, a distributed ledger may support shared records, identity management, reinsurance administration or claims settlement. For example, a parametric policy might specify that a payment is triggered when an independently verified weather index crosses a threshold.

Automation can reduce reconciliation costs and settlement delays. Yet code cannot determine all the legal and factual questions that arise in insurance. A weather index may not reflect the policyholder’s actual loss. An oracle—the service supplying external information—may be inaccurate, manipulated or unavailable. Code may also contain defects, and an irreversible transaction may be difficult to correct.

The legal relationship should therefore remain clear. The parties must know which document defines coverage, how ambiguous conditions are interpreted, who may pause or reverse execution, how disputes are resolved and what happens when the underlying data are wrong. Smart contracts should supplement, not obscure, policy wording and consumer rights. Independent code review, access controls, oracle governance and emergency intervention procedures are essential.

Regulating Artificial Intelligence in Insurance

AI may be used in marketing, customer service, underwriting, pricing, fraud detection, claims triage, document analysis, reserving, investment operations and compliance. The regulatory intensity should be based on the function and impact of the use case rather than on the label attached to the technology.

A practical AI governance framework includes:

• Board and senior-management accountability: The organisation approves risk appetite, material use cases and reporting arrangements.
• Use-case classification: Applications are ranked by customer impact, sensitivity of data, autonomy and potential harm.
• Data governance: Data are lawful, relevant, accurate, secure and appropriately retained.
• Technical validation: Models are tested for performance, robustness, bias, drift, adversarial manipulation and failure modes.
• Documentation: The insurer records purpose, design, data, assumptions, limitations, controls and changes.
• Human and customer safeguards: Customers receive appropriate information, access to correction and meaningful review.
• Monitoring and incident management: Unexpected outputs, complaints, breaches and near misses are recorded and remediated.
• Third-party governance: External models and foundation-model services are assessed rather than treated as black boxes outside responsibility.

Generative AI creates additional concerns. It may produce inaccurate statements, disclose confidential information, reproduce bias or generate inconsistent explanations. It should not be permitted to issue binding coverage advice or make high-impact decisions without controls appropriate to the use case. Retrieval restrictions, approved knowledge bases, output testing, human review and secure logging are important safeguards.

Regulatory Sandboxes and Innovation Supervision

A regulatory sandbox is a controlled environment in which an innovator can test a product or process under specified conditions and for a limited period. A sandbox may provide dialogue with supervisors, clarity about applicable rules, restricted customer exposure, reporting requirements and agreed safeguards. It is not a general exemption from law and does not guarantee authorisation or commercial success.

Sandboxes are valuable when a product is genuinely novel and the regulatory treatment is uncertain. They can help supervisors learn about emerging technology and help innovators identify risks early. However, participation may favour firms with resources to prepare applications, and a controlled test may not reveal risks that arise at scale. Supervisors should therefore define entry criteria, customer safeguards, exit conditions, data requirements and post-test evaluation.

Innovation offices, thematic guidance, pilot programmes and supervisory dialogues are alternative or complementary approaches. The objective is not to lower standards but to make regulation sufficiently intelligible and adaptable to responsible innovation.

RegTech and SupTech Applications

RegTech enables insurers to automate compliance tasks. Applications include electronic know-your-customer checks, sanctions screening, regulatory change management, automated policy reviews, complaint analytics, suspicious-activity monitoring, capital reporting and control testing. Natural-language processing can identify obligations in new regulatory material, while dashboards can link obligations to owners, controls and evidence.

The value of RegTech depends on data quality and governance. Automating a defective process may increase the speed and scale of non-compliance. A compliance dashboard should distinguish between an absence of evidence and evidence that no breach occurred. Alert thresholds need calibration to reduce both false positives and missed risks.

SupTech assists regulators through data analytics, risk-based supervision, early-warning indicators, network analysis and automated validation of regulatory returns. Supervisors may use these tools to identify unusual claims patterns, rapid premium growth, concentration exposures or repeated consumer complaints. Supervisory technology itself must be explainable, secure and subject to legal authority and due process.

An Illustrative Case: Meridian Mutual’s Automated Motor Platform

Background. Meridian Mutual, a fictional mid-sized insurer, launched a mobile application offering usage-based motor insurance. Customers consented to the collection of driving data through a device connected to the vehicle. A machine-learning model generated a risk score based on mileage, braking, acceleration, time of travel and location-related variables. Claims were initially triaged automatically, and a cloud provider hosted the platform.

Situation. After twelve months, Meridian observed lower average claims among participating customers but also a higher complaint rate. Customers in particular urban areas received less favourable scores. Some customers reported that the device recorded journeys when another person was driving. The claims model referred relatively few claims for human review, including several involving vulnerable policyholders. A cloud outage delayed access to policy records.

Analysis. An internal review found that location was functioning as a proxy for several socioeconomic characteristics. The model had been validated on the overall portfolio but not across relevant customer segments. Consent information described data collection but did not clearly explain how driving behaviour affected premiums. The human-review team lacked authority to override the automated claims recommendation. The outsourcing contract did not provide sufficiently detailed recovery-testing rights.

Approach. Meridian paused expansion and classified the underwriting and claims models as high-impact applications. It commissioned independent validation, examined segment-level performance and removed location data where it could not demonstrate a necessary and proportionate purpose. It redesigned customer notices, created a correction and appeal process, and required human review for vulnerable-customer indicators and disputed decisions. The board approved a model-risk policy, established a model inventory and required quarterly monitoring. Meridian also revised the cloud contract, conducted recovery tests and developed a contingency process for policy access.

Outcome. The revised platform produced fewer automated decisions but stronger documentation, improved review quality and clearer customer communication. Meridian accepted that slower processing in sensitive cases was an appropriate cost of fair treatment and operational resilience.

Learning points. The case demonstrates that innovation should be evaluated as an end-to-end socio-technical system. Data consent, model performance, human authority, outsourcing and customer remedies are interconnected. A positive aggregate result does not establish fairness, and a human placed at the end of an uncontrolled workflow does not necessarily provide meaningful oversight.

Challenges, Ethical Issues and Common Mistakes

Digital insurance can intensify information asymmetry. The insurer may understand a model far better than the customer, while the customer may have little practical ability to challenge a decision. Personalisation can also fragment risk pools and weaken solidarity if pricing becomes excessively individualised. Regulators must balance actuarial relevance with fairness, access and social policy.

Common mistakes include treating compliance as a technical certificate, assuming that vendor responsibility removes insurer responsibility, relying on accuracy without testing fairness, failing to monitor models after deployment, retaining data indefinitely, and using automated explanations that do not assist customers. Another mistake is to introduce AI before defining the business problem, legal basis, decision rights and acceptable level of risk.

Cybersecurity threats include data theft, ransomware, model poisoning, adversarial manipulation, credential compromise and unauthorised changes to automated rules. Privacy and security controls should be designed into systems rather than added after deployment. Professional judgement remains important because models cannot fully capture changing social conditions, exceptional circumstances or the meaning of a customer’s individual situation.

Best-Practice Framework for Insurers

A proportionate digital-governance programme should begin with an inventory of technologies, vendors, models and data flows. Each use case should have a named owner and an impact classification. Before deployment, the insurer should conduct legal, ethical, privacy, security and operational assessments. It should maintain documentation that an independent reviewer can understand.

During operation, controls should include access management, version control, audit logs, performance monitoring, drift detection, complaint analysis, incident escalation and periodic reapproval. Customers should receive clear information, correction mechanisms and review routes. Boards should receive reports that translate technical indicators into business and policyholder consequences.

The strongest practice combines technology with institutional discipline. Responsible innovation is not achieved by avoiding automation; it is achieved by matching automation with accountability, competence, transparency and resilience.

Current Developments and Emerging Directions

Insurance is moving toward embedded distribution, real-time risk monitoring, synthetic data, open insurance ecosystems, automated claims assessment and increasingly general-purpose AI tools. These developments may lower transaction costs but also increase dependence on shared platforms and data intermediaries. Regulatory attention is likely to focus on high-impact automated decisions, third-party technology concentration, operational resilience, cross-border data flows, cybersecurity and the governance of general-purpose AI.

Future regulation will probably become more risk-based and technology-neutral. Rather than prescribing one technical architecture, supervisors are likely to ask whether firms can demonstrate reliable outcomes, effective controls, traceability and fair treatment. Insurers that build strong data and model governance will be better positioned to adopt new technologies without repeatedly redesigning their control environment.

Chapter Summary

InsurTech applies digital technologies to insurance design, distribution, underwriting, claims, operations and regulation. Automated underwriting, telematics, cloud services, smart contracts and AI can improve efficiency and risk assessment, but they also create risks involving bias, privacy, explainability, model error, cyber threats, outsourcing and operational concentration. The insurer remains accountable even when technology or a third-party provider performs the activity.

Effective governance requires clear purpose, controlled data, validated models, documentation, meaningful human oversight, monitoring, customer remedies and senior-management accountability. Regulatory sandboxes can support responsible experimentation but do not remove legal obligations. RegTech and SupTech improve compliance and supervision when their data, assumptions and alerts are themselves governed. The central principle is that digital transformation must strengthen, rather than weaken, fairness, resilience, transparency and confidence in insurance.

Key Terms

InsurTech: Technology-enabled innovation in insurance products, distribution, operations or regulation.

Artificial intelligence: Computational capability used to perform tasks involving prediction, classification, reasoning or language processing.

Machine learning: A method in which systems learn patterns from data to produce predictions or decisions.

Automated underwriting: Technology-supported assessment and selection of insurance risks.

Telematics: Digital collection of behavioural, location or condition data from connected devices.

Usage-based insurance: Insurance pricing or coverage linked partly to actual use or observed behaviour.

Cloud computing: Network-based access to shared computing, storage and software resources.

Smart contract: Software that automatically executes programmed actions when specified conditions occur.

Oracle: A service that supplies external information to a smart contract or distributed ledger.

Model risk: The risk of loss or harm resulting from an incorrect, misused or poorly governed model.

Explainability: The capacity to communicate how a model operates or why it produced an output.

Human oversight: Meaningful human capacity to review, challenge or change an automated outcome.

Algorithmic bias: Systematic and unjustified differences in model outcomes or errors among groups.

Model drift: Deterioration or change in model performance as data, behaviour or conditions change.

Operational resilience: The ability to continue important services through disruption and recover effectively.

RegTech: Technology used by regulated firms to manage compliance and reporting.

SupTech: Technology used by supervisors to analyse information and conduct supervision.

Regulatory sandbox: A controlled setting for testing innovative products under supervisory conditions.

Embedded insurance: Insurance offered within a non-insurance customer journey or platform.

Third-party risk: Risk arising from dependence on external providers, vendors or technology partners.

Review Questions

Short Answer Questions

1. What is meant by InsurTech, and how does it differ from simple digitisation?

2. Why does removing a protected characteristic from a model not necessarily eliminate bias?

3. State two regulatory concerns associated with telematics.

4. What is the purpose of model validation?

5. Distinguish between RegTech and SupTech.

Long Answer Questions

1. Explain the regulatory governance requirements for automated underwriting.

2. Discuss explainability and meaningful human oversight in AI-supported insurance decisions.

3. Analyse the benefits and risks of cloud outsourcing by an insurer.

4. Explain how smart contracts may be used in insurance and identify their legal and operational limitations.

5. Describe a comprehensive framework for responsible AI governance in an insurance organisation.

Analytical / Application Questions

1. An insurer’s pricing model produces accurate aggregate predictions but substantially higher error rates for a small customer group. What investigations and corrective actions should management undertake?

2. A start-up proposes a parametric flood product using a smart contract and satellite data. Advise the regulator on sandbox conditions, customer safeguards and operational controls.

3. An insurer wants to deploy a generative-AI claims assistant that drafts repudiation letters. Evaluate the use case and recommend controls before deployment.

22. Multiple Choice Questions with Answers

Question 1

Which statement best describes the regulatory principle underlying digital insurance?

A. Technology providers assume all regulatory responsibility when their systems are used by insurers.

B. The use of technology does not remove the insurer’s responsibility for fair treatment, sound governance and compliance.

C. Automated decisions are outside insurance regulation if they are statistically accurate.

D. Digital insurance is regulated only through cybersecurity requirements.

Correct Answer: B. The use of technology does not remove the insurer’s responsibility for fair treatment, sound governance and compliance.

Question 2

Why can a model remain biased even when it does not directly use a protected characteristic?

A. All machine-learning models are inherently discriminatory.

B. Protected characteristics are irrelevant to insurance decisions.

C. Other variables may act as proxies for the protected characteristic.

D. Removing variables always reduces model accuracy but not bias.

Correct Answer: C. Other variables may act as proxies for the protected characteristic.

Question 3

Which practice represents meaningful human oversight?

A. A reviewer confirms every automated decision without seeing the reasons for it.

B. Employees are allowed to challenge and reverse outputs using relevant information and defined escalation procedures.

C. A vendor is contractually described as responsible for all decisions.

D. The insurer disables audit logs to protect model confidentiality.

Correct Answer: B. Employees are allowed to challenge and reverse outputs using relevant information and defined escalation procedures.

Question 4

A telematics programme records vehicle location continuously. Which issue is most directly relevant to proportionality?

A. Whether continuous location data are necessary for the stated insurance purpose.

B. Whether the vehicle has sufficient fuel.

C. Whether all customers prefer mobile applications.

D. Whether the insurer has printed policy documents.

Correct Answer: A. Whether continuous location data are necessary for the stated insurance purpose.

Question 5

What is a central cloud-outsourcing principle for insurers?

A. Cloud providers automatically become responsible for the insurer’s regulatory obligations.

B. The insurer may disregard business continuity because cloud services are always available.

C. The insurer remains accountable and should control security, continuity, audit and exit arrangements.

D. Cloud services eliminate concentration risk.

Correct Answer: C. The insurer remains accountable and should control security, continuity, audit and exit arrangements.

Question 6

What is the main function of an oracle in a smart-contract insurance arrangement?

A. It supplies external information used to trigger or prevent programmed actions.

B. It replaces the policyholder’s legal rights.

C. It validates every underwriting model independently.

D. It provides capital to the insurer.

Correct Answer: A. It supplies external information used to trigger or prevent programmed actions.

Question 7

Which activity is most clearly part of model-risk management?

A. Increasing model complexity without documentation.

B. Maintaining a model inventory, independent validation and performance monitoring.

C. Allowing a model to operate indefinitely after its initial approval.

D. Evaluating only overall accuracy and ignoring segment-level results.

Correct Answer: B. Maintaining a model inventory, independent validation and performance monitoring.

Question 8

What is the proper character of a regulatory sandbox?

A. A permanent exemption from insurance law.

B. A controlled test environment with defined safeguards and supervisory conditions.

C. A guarantee that the tested product will receive authorisation.

D. A replacement for consumer-protection rules.

Correct Answer: B. A controlled test environment with defined safeguards and supervisory conditions.

Question 9

Which is an example of RegTech?

A. An insurer’s automated system for monitoring regulatory obligations and generating compliance evidence.

B. A customer’s vehicle sensor measuring braking behaviour.

C. A smart contract paying a weather-index claim.

D. A regulator’s market-wide early-warning dashboard.

Correct Answer: A. An insurer’s automated system for monitoring regulatory obligations and generating compliance evidence.

Question 10

An insurer’s claims model performs well overall but poorly for vulnerable customers. What is the most appropriate immediate response?

A. Deploy it more widely because aggregate accuracy is acceptable.

B. Remove all human review to improve efficiency.

C. Investigate segment-level performance and introduce proportionate review and remediation controls.

D. Delete the performance records to avoid reputational risk.

Correct Answer: C. Investigate segment-level performance and introduce proportionate review and remediation controls.