Insurance
AI governance for insurers.
See where AI meets policyholder data, put rules on it, and keep the evidence the EU AI Act and DORA call for.
The rules that apply
Pricing life and health cover with AI is a high-risk use under the EU AI Act.
AI systems used for risk assessment and pricing in life and health insurance are high-risk under the EU AI Act (Annex III, point 5(c)). Deployers of these systems must carry out a fundamental rights impact assessment before first use (Article 27). The high-risk obligations for these systems apply from 2 December 2027.
Insurers are also in scope of DORA, which has applied since 17 January 2025. It asks financial entities to manage ICT third-party risk, including the AI services they buy, and to keep a register of information on those contracts.
Claims and underwriting teams handle health data every day, and health data is a special category of personal data under the GDPR (Article 9).
Common scenarios
Three situations you will recognise, and how Qastel handles each.
Scenario 1
Health details in a claims summary
A claims handler pastes a medical report into an AI assistant to summarise it. Qastel's detectors recognise health data, including medical record numbers and diagnosis codes, and a policy can redact or block it before the prompt is sent.
Scenario 2
A model used for underwriting or pricing
Qastel classifies each AI system against the EU AI Act risk tiers and shows its reasoning, so systems used in underwriting or pricing can be reviewed well before 2 December 2027. The Compliance Report gathers the evaluations, violations and recommendations.
Scenario 3
AI vendors outside the third-party register
Qastel keeps one inventory of every AI system in use, sanctioned or not, with the vendor, DPA status and data residency of each, so your DORA register of information starts from what is actually there.
Questions people ask.
Can Qastel carry out our fundamental rights impact assessment?
No. The assessment is yours. Qastel gives you the inputs: which AI systems are in use, how each is classified under the EU AI Act, what data reaches them and which policies apply.
Does Qastel store what our staff type?
Prompt analysis is off by default and only an admin can turn it on. When it is on, prompt text is classified in memory and never stored: Qastel keeps the category of what it found, not the text.
This page is general information, not legal advice.
See it in action.
Get a 30-minute overview of how Qastel discovers, assesses and controls the AI used across a business.