Solvency II and AI Model Risk: What Insurers Must Document

The Existing Model Governance Baseline

Solvency II does not need a separate AI regime to reach AI-driven models. Article 44 of Directive 2009/138/EC requires insurers to maintain an effective risk management system with a risk management function that covers underwriting, reserving, and the decisions models produce. Articles 112 through 127 govern internal models specifically and impose a "use test," meaning a model must be widely used and play a genuine role in the insurer's system of governance rather than sit alongside decision-making as a reference tool. Commission Delegated Regulation (EU) 2015/35 adds detail to this, requiring validation standards that cover methodology, assumptions, data quality, and known limitations, and a documented model change policy under which material changes are logged and, where significant, escalated to the supervisor. None of this is new. What is new is the type of model these obligations now have to reach.

Where AI and Agentic Systems Strain the Existing Template

Solvency II's validation standards were built for statistical and actuarial models with stable parameters that change infrequently and predictably. LLM-based or agentic AI systems behave differently. Their outputs can be non-deterministic, their behavior can shift after deployment through retraining or configuration changes, and agentic systems make tool calls and intermediate decisions that a traditional validation report never had to describe. Model inventories designed for actuarial models typically have no field for prompt or version history, no record of which tools or actions an agent is permitted to invoke, and no structure for capturing the decision chain behind a specific output. Ongoing monitoring requirements, written with periodic (often annual) validation cycles in mind, do not map cleanly onto systems that can drift between one validation date and the next. The audit trail expectation embedded in existing governance, meaning a clear record of who approved what and on what evidence, has to extend to AI decision rationale and intermediate reasoning steps, not just the final underwriting, pricing, or claims outcome.

The Use Test and Validation Independence Do Not Relax for AI

The use test raises a specific accountability question for agentic systems. If an AI agent is making autonomous underwriting or claims decisions rather than producing advisory output for a human to review, insurers need to be able to show how that model is embedded in genuine business decision-making and who is accountable for its outputs. Validation independence requirements apply equally: the function validating an AI model must be structurally separate from the team that built or deployed it, which means insurers need to define, in practical terms, who is qualified to independently review data lineage, drift metrics, or agent action logs, since this is a different skill set from traditional actuarial sign-off. Board and risk committee oversight obligations under Solvency II's governance rules extend to AI model risk as well, which means documentation needs an accessible layer that a non-technical board member can actually use to exercise oversight, not only a technical validation report.

Runtime Governance as a Compliance Enabler

Much of the documentation gap described above is a runtime problem before it is a policy problem: the evidence supervisors expect (agent identity, tool permissions, decision rationale, audit logs) has to be captured at the point the AI system acts, not reconstructed afterward from incomplete logs. Runtime governance platforms, including Trussed AI, focus on capturing agent identity, tool call activity, and permission enforcement continuously, and on maintaining audit logs that can be retrieved when an examination or internal review requires reconstructing a specific decision. This does not replace actuarial validation or supervisory judgment. It provides the underlying evidence that validation teams and boards need in order to satisfy the documentation obligations Solvency II already imposes.