EU AI Act and Life and Health Insurance Pricing: Obligations After the Digital Omnibus

What has changed: the Digital Omnibus is now law

The Commission proposed the Digital Omnibus on AI on 19 November 2025. Earlier planning guidance often treated it as pending. It has since been adopted as Regulation (EU) 2026/1744, dated 8 July 2026, amending the AI Act (Regulation (EU) 2024/1689) along with two other regulations. The Commission states that it entered into force on 27 July 2026.

The main effect for actuaries is on timing. The AI Act's original application date for the high-risk rules was 2 August 2026. The Commission says delayed availability of standards put that date in jeopardy, so the Omnibus extends the timeline to 2 December 2027 for high-risk AI systems and 2 August 2028 for AI embedded in products. The Commission's original proposal had linked the timeline to confirmation that standards and tools were available, with an adjustment of up to 16 months. The outcome instead uses fixed dates, which is easier to plan against.

Standalone pricing and risk assessment tools in life and health insurance fall under the 2 December 2027 date. The 2 August 2026 date is superseded and should no longer anchor a programme plan.

Is a given pricing use high-risk?

Annex III covers AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance. Two phrases carry the classification. "Intended to be used" points to the system's purpose, not only its technical form. "In relation to natural persons" points to individual-level assessment and pricing.

A recital sets out what the Act does not treat as high-risk: AI systems provided for by Union law for detecting fraud in the offering of financial services, and AI systems used for prudential purposes to calculate the capital requirements of credit institutions and insurance undertakings. A fraud detection model or a capital requirement calculation therefore sits outside Annex III point (c) on the basis of that recital.

In practice, an underwriting risk score or a premium-setting model applied to individual applicants is the clear case. Borderline uses need a documented judgement, for example a model that informs assumptions at portfolio level but whose outputs could reach individual pricing decisions. Record the intended purpose, where the output goes and why you reached your conclusion. The Commission has published draft guidelines on classifying high-risk systems, with practical examples, and the reasoning should be checked against the final version. The Commission also reviews the Annex III list once a year, so classification is a recurring task, not a one-time exercise.

Provider and deployer obligations in pricing terms

High-risk systems carry requirements on risk management, data governance, record-keeping, transparency, human oversight, and accuracy and robustness. Which of them fall on you depends on your role. A vendor that supplies a pricing model is typically the provider and the insurer using it is the deployer. An insurer that builds and uses its own model may be both. Confirm the role for each system with legal review, because the duties differ.

Translated into actuarial workflows, the requirements raise practical questions. For data governance: is the rating data relevant, representative and examined for bias? For human oversight: who can question, override or stop a model output, and is that recorded? For record-keeping: can you reconstruct what a system produced for a given case, and under which configuration? For accuracy and robustness: do your monitoring and validation cover the AI component as it is actually used?

The Commission also states that operators providing high-risk AI systems that carry out price and risk assessments in life and health insurance shall perform a fundamental rights impact assessment and notify the national authority of the results. Plan for this for each in-scope pricing system.

A recital also indicates that the same regime should apply to insurance and reinsurance undertakings under Directive 2009/138/EC, framed around internal governance requirements under financial services law. Existing insurance governance records are a reasonable starting point for AI Act evidence, though gaps should be expected and mapped explicitly.

Dates to plan around

Separate what is settled from what remains open. The dates below reflect the adopted Regulation as the Commission describes it, as of November 2026.

• 19 November 2025: Commission proposes the Digital Omnibus on AI.
• 8 July 2026: Regulation (EU) 2026/1744 is adopted.
• 27 July 2026: The Commission states the Omnibus entered into force.
• 2 December 2027: Revised application date for high-risk AI systems, including Annex III pricing uses.
• 2 August 2028: Revised application date for AI embedded in products.

Where runtime controls fit, and where they stop

Record-keeping and human oversight both depend on being able to show what an AI system was permitted to do and what it did. Technical controls can support that evidence. They do not replace model validation, actuarial governance or legal review, and they do not by themselves establish compliance.

Trussed enforces policy in the execution path of AI interactions and tool calls: allow, redact, block, rate limit, or escalate for human approval. Because the policy is enforced at runtime, not reviewed after the fact, each decision produces audit-ready evidence that is mapped to the EU AI Act, among other frameworks. For a pricing workflow, that can mean a record that a given interaction was allowed, that sensitive data was redacted, or that an action was held for human approval. Trussed runs in production with customers in regulated verticals including insurance and healthcare, and supports self-managed deployment in the customer cloud with configurable retention and data residency.

The scope is individual interactions and tool calls. Trussed does not provide model lineage, dataset provenance or end-to-end tracing of workflows, so data governance and model documentation remain with your actuarial and compliance functions.