Artificial intelligence is already being used across general insurance, from underwriting and pricing to claims and complaints triage, fraud detection, vulnerability identification, data analysis and customer communications.
The governance challenge is not simply whether an AI system works. It is whether the system produces appropriate, defensible and consistent outcomes throughout its lifecycle.
Four principles provide a practical foundation: Fairness, Adaptability, Explainability and Reliability.
1. Fairness
Fairness means that any of the outputs generated by AI should be equitable and free from bias. It should not discriminate against any communities, groups, or individuals. Fairness can sometimes be a trade-off between procedural fairness (ensuring the system or process treats all people the same) and representational fairness (ensuring inequalities in the real world or past data, e.g. gender bias, aren’t perpetuated). [AI Fluency for directors, The University of Sydney, Sydney Executive Plus+ 2026)
In general insurance, this is particularly relevant where AI is used for:
- risk selection, pricing or policy renewal;
- claims triage and fraud detection;
- identifying potentially vulnerable customers;
- prioritising complaints; or
- recommending whether a claim should be accepted (in full or in part), investigated or declined.
Fairness does not necessarily mean treating every customer identically. Insurance legitimately differentiates between the type of consumer and general insurance product. The question is whether the differentiation is supported by relevant information, is legally permissible and does not operate as an inappropriate proxy for a vulnerability factor.
Controls should include testing datasets for bias, comparing outcomes across customer cohorts, reviewing false-positive and false-negative rates, and requiring human review before an adverse or high-impact decision is made.
2. Adaptability
Adaptability in an AI system refers to the ability to adjust to new information that falls outside its training data. A machine learning system that has learned to identify patterns in training data can be extremely efficient at predicting those patterns in the future. But they often struggle to cope with disruption and change, when the world changes and no longer matches its training data. (ibid, AI Fluency for directors)
Adaptability requires:
- monitoring for model drift and unexpected changes in outcomes;
- reassessment when the model, data, intended use or regulatory (or Code) environment changes;
- defined triggers for escalation, suspension or human intervention;
- change-management controls over vendor and internal updates; and
- a process for retiring AI systems that are no longer suitable.
Governance should therefore continue after implementation. Approval at the commencement of an AI project is not enough.
3. Explainability
AI should be transparent and explainable. Transparency is about how much of your system’s inner workings you can understand. Explainability means how and why certain decisions are made can be understood by the people who interact with the AI, be they employees or customers. (ibid, AI Fluency for directors)
This is critical where AI contributes to:
- premium or policy coverage decisions;
- the identification of suspected fraud;
- claim delays, part settlements or denials;
- complaint outcomes; or
- customer facing advice or communications.
Explainability does not require every employee to understand the technical construction of a model. It does require the business to understand the information used, the purpose and limitations of the system, and the factors materially influencing its outputs.
It also requires a senior executive to be accountable.
A claims handler or complaints officer should not rely on “the system made the decision”. The firm must remain capable of reviewing the outcome, explaining it in plain language and identifying who is accountable for the final decision. This supports procedural fairness, regulatory requirements (e.g., FAR and responsible Managers), effective internal dispute resolution and the firm’s ability to defend its position before AFCA, ASIC or a court.
4. Reliability
Reliability refers to an AI behaving consistently and predictability across different situations. For an algorithm to be reliable we need to be sure that it is able to provide accurate and useful outputs under real world conditions, not just training data. (ibid, AI Fluency for directors)
For general insurance businesses, this means:
- validating outputs before implementation;
- monitoring accuracy and error rates;
- testing unusual and high-impact scenarios;
- controlling data quality, privacy (the use of customer’s personal information) and system access;
- maintaining incident management and customer remediation processes;
- assessing third-party AI service suppliers; and
- retaining credible manual or alternative processes for important operations.
The level of testing and human oversight should reflect the potential consequence of failure. An AI tool that summarises internal documents does not require the same controls as one influencing whether a customer’s claim is declined.
Is management different for an APRA-regulated insurer?
Yes, but the difference is principally one of regulatory overlay, governance intensity and assurance, rather than different underlying principles.
All AFSL businesses must consider how their use of AI interacts with existing obligations, including providing financial services efficiently, honestly and fairly, maintaining adequate risk-management systems and ensuring representatives are appropriately trained and supervised (refer AFSL general obligations s912A(1)). ASIC has warned that AI adoption may outpace governance and expects licensees to update their arrangements as the nature and use of the technology evolve. (refer ASIC media release 26-092MR, ASIC calls for urgent cyber uplift as AI accelerates cyber threats, Published 8 May 2026)
An APRA-regulated general insurer is subject to those conduct obligations as an AFSL holder (other than risk management which is governed by CPS 220), together with a more extensive prudential framework. Its AI arrangements must be incorporated into board oversight, risk appetite, operational risk, information security, business continuity and third-party risk management.
In April 2026, APRA (APRA Letter to Industry on Artificial Intelligence) expressly called for a step-change in AI risk management. Its expectations include AI literacy at board level, an AI strategy aligned with risk appetite, an inventory of AI use cases, lifecycle accountability, human involvement in high-risk decisions, continuous monitoring and sufficiently capable independent assurance. APRA’s letter to industry also highlights model drift, unpredictable behaviour, supplier opacity and over reliance on point-in-time assurance.
Under CPS 230 Operational Risk Management, an insurer must also consider the resilience of AI-supported critical operations. Claims processing is expressly identified as a critical operation. Underwriting and claims management must generally be treated as material service providers unless the insurer can justify otherwise.
Consequently, an underwriting agency or TPA may not itself be directly regulated by APRA, but it can still experience APRA requirements through its binder agreement with an insurer. The insurer is likely to require stronger contractual rights, incident notification, data and security controls, performance monitoring, audit access, business-continuity arrangements and visibility of subcontractors and AI vendors. CPS 230 stipulates minimum requirements for agreements with material service providers.
A proportionate approach, not a two-tier standard
A broker, underwriting agency or TPA may adopt a less complex governance structure than a large insurer. Refer RG 104, based on the ‘nature, scale and complexity of your business’. It should not, however, adopt a lower standard for customer outcomes.
The appropriate controls should be determined by:
- the purpose of the AI use case;
- the degree of automation;
- its effect on customers;
- the sensitivity of the data;
- the consequences of an error;
- whether the activity has been delegated by an insurer; and
- the firm’s ability to identify and correct an inappropriate outcome.
A practical starting point for every general insurance business is an AI use-case register, risk classification, designated business owner, pre-implementation assessment, human-oversight requirements and ongoing outcome monitoring.
The governance framework may differ in scale between an insurer and other AFS Licensees. The essential objective does not: the business, not the technology provider, must remain accountable for the outcome.
Disclaimer: Reproduction of statements made in this article by media outlets, whether in full or in part, is strictly prohibited without the written express consent of the author. The views, opinions, and positions expressed within this article are those solely of the author and Compliance Advocacy Solutions Pty Ltd and not the views of other individuals, companies or organisations they may be affiliated with. The author and Compliance Advocacy Solutions Pty Ltd make no representations as to accuracy, completeness, currency, suitability, or validity of any information in this article and will not be liable for any errors or omissions or any loss or damage arising from its use or reliance. This article is intended for educational and informational purposes only and should not be relied upon as professional legal advice.