When AI Starts Acting: Rethinking Governance for Insurers

AI adoption in insurance has moved well past experimentation. The 2026 Evident AI Index, which benchmarks 30 of the largest insurers across North America and Europe, shows the industry deploying AI across claims, underwriting, fraud detection, customer service, risk assessment, and document processing. Most of that started as productivity work: summarizing documents, assisting employees, answering questions. However, AI is fast moving into the decisions themselves, and soon into the actions that follow them.

That's why provenance is becoming part of governance. Once an AI system's output can change how a claim is investigated or how a policy is priced, knowing that the application passed a review six months ago stops being enough. If a decision gets challenged, the insurer needs to know which model and version produced it, what data it saw, what policy was in effect, and whether a person actually reviewed it before it took effect. That's a different kind of record than a governance approval. It has to be tied to the specific transaction, not to the system in general.

Agentic AI Raises the Stakes

An agent doesn't just return an answer. It can pull data, call tools, talk to other systems, hand off to other agents, and carry out a sequence of actions on its own. A single claim could pass through several models and agents, touch multiple data sources and APIs, and only meet a human at one or two checkpoints, if that.

Picture a fairly ordinary near-future claims workflow: an agent gathers the documents, reviews the photos, checks the claim against the policy terms, pulls in outside data, flags anything that looks like fraud, asks for more documentation if needed, recommends a settlement, and kicks off the payment. Increasingly, much of that could happen before a person looks at it. At that point, what matters isn't just what the AI said. It's what it did, and which models, agents, tools, and data were behind each step.

Traditional Governance Is No Longer Enough on Its Own

Traditional AI governance is built to answer which systems are approved, who owns them, and whether they meet policy, all at a point in time, and that work doesn't go away. Transaction governance sits on top of it and asks something harder: what did the AI actually do in this transaction, on what data, through which models and agents, under what policy, and where did a person step in?

That question gets harder every quarter, because the models, agents, prompts, tools, and policies behind any given system keep changing underneath it, and an approval from a review last spring won't tell you what happened on a specific claim last week.

It also doesn't matter who or what is on the other end of the interaction. A claims adjuster prompting a model, an underwriter using an AI assistant, and another AI agent invoking that same model as part of a larger workflow all need the same governance. The user might be a person or a piece of software, but the questions the insurer has to be able to answer afterward don't change: what was accessed, what was said, what was done, under what policy. Governance can't be built around the assumption that a human is always the one asking.

Governance Has to Follow the Same Path

As insurers let AI go deeper into claims, underwriting, fraud investigation, and customer interactions, this kind of evidence becomes increasingly important. The path is simple to describe: productivity, then recommendation, then decision, then action. Governance has to follow the same path. The next phase of AI governance will be less about whether an AI system was approved and increasingly about whether an insurer can govern and reconstruct what happened in a specific transaction, no matter whether the actor was a person or a machine.

That's the problem Trussed AI exists to solve. We help regulated enterprises govern AI as it moves from assisting people to participating in consequential business decisions and actions, working from the belief that governing AI means governing what it can see, what it can say, what it can do, and what it can build. The bigger shift this asks of insurers goes beyond any one platform: governance has to move from approving systems in advance to accounting for what those systems actually did in the transactions they participate in.