Point 5(c) of Annex III classifies as high-risk AI systems intended to be used for risk assessment and pricing in relation to natural persons for health and life insurance . Recital 58 AI Act explains that such systems can have a significant impact on a person’s livelihood and , if not properly designed, developed , and used, can infringe their fundamental rights and can lead to serious consequences for their life and health, including financial exclusion and discrimination. The conditions that an AI system must fulfil to be classified as high-risk pursuant to point 5(c) of Annex III and related concepts are analysed in more detail in the following subsections.
i. Definition of risk-assessment and pricing
The high-risk use case listed in point 5(c) of Annex III covers two types of AI systems in relation to natural persons for health and life insurance: those that perform a risk assessment and those that price insurance premiums, or both. To qualify as high-risk system under point 5(c) of Annex III it is not necessary that the system is intended to be used solely for these use cases.
Risk assessment should be understood to entail the evaluation of a natural person’s risk profile to determine whether to offer, deny, revoke or deliver services related to health and life insurance, in particular full/partial insurance coverage, including the establishment or change of policy terms and conditions (e.g. coverage, exclusions, deductibles, policy limits). The AI system may carry out the risk assessment with a view to any of the steps of access and enjoyment of these insurance services as described above.
Pricing should be understood to refer to the methodologies and criteria used to determine insurance premiums as an integral part of policy terms and conditions. Usually, a risk assessment will be a prerequisite for pricing. However, the AI system need not be intended to be used both for the risk assessment and pricing, sincea system performing an assessment may result inaccess being denied or the performance of an insurance contract being affected in a manner that justifies its classification as high-risk, set out in Recital 58 AI Act.
ii. In the case of health and life insurance
To be classified as a high-risk pursuant to point 5(c) of Annex III, the AI system must be intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance. Other insurance services (e.g. car or motor insurances, home insurance etc.) are not covered by the use case . Insurance-based investment products as defined in Article 4(2) of Regulation (EU) No 1286/2014 are not to be understood as health or life insurance within the meaning of point 5(c) of Annex III.
This means that the AI system’s intended purpose (risk assessment or pricing) should be to provide information for a potential decision on the access and enjoyment of a health or life insurancepolicy. The access to and enjoyment of health and life insurance is not restricted to those cases resulting in the conclusion of an agreement. It covers all steps leading to the conclusion or denialof an insurance policy, including its revocation, or changes to its terms and conditions.
The notion of health and life insurance may differ across Member States for the purpose of point 5(c) of Annex III. The term life insurance may be understood to cover the classes of insurance listed in Annex II of Directive 2009/138/EC. In contrast, point 5(c) of Annex III should not be understood as covering classes of non-life insurance listed in Annex I of Directive 2009/138/EC, with the exception of those listed under points1 and 2 under Section A of that Annex (classification of risks according to classes of insurance). The risks referred to in those points (e.g. accident, including industrial injury and occupational diseases, as well as sickness) should be considered to be covered by health insurance services within the meaning of point 5(c) of Annex III, sincethey usually cover the costs of medical treatment.
The term health and life insurance should also be considered to cover private long-term care insurance, since that constitutes a health insurance service within the meaning of point 5(c) of Annex III. Such insurance has a significant impact on a person’s livelihood and can lead to serious consequences for their life and health similar to health and life insurance in line with recital 58 AI Act. It should also be considered to cover personal pension products in so far as these can have a significant impact of a person’s livelihood in old age.
Credit life insurance contracts should also be considered to fall within the scope of point 5(c) of Annex III, since they constitute life insurance regardless of their function as payment protection insurance (credit insurance). Credit life insurance is typically offered when a person borrows a significant amount of money, such as for a mortgage, car loan, or large line of credit. The policy pays off the loan in the event the borrower dies. In relation to that type of insurance , the risk assessment may take the form of an evaluation of the creditworthiness or the establishment of a credit score of the natural person-borrower.
The health and life insurance covered by point 5(c) of Annex III may be offered on a private or public basis (see above). For example, an AI system intended to be used by a health insurance company based on public law will also fall within the scope of point 5(c) of Annex III, so long as that system is intended to be used to carry out a risk-assessment or pricing with regards to natural persons.
Privately serviced health insurance is seen as an essential private service within the meaning of point 5 of Annex III, even if the Member State in which it is offered has a public health care system that offers universal health care. In this case, the private health insurance would constitute an addition to that public care, for example to cover more treatment options or access to private treatment.
iii. Fraud detection
In contrast to the use case listed inpoint 5(b) of Annex III, point 5(c) does not provide an exception for fraud detection. Therefore, an AI system intended to be used for risk assessment or pricing in the case of health and life insurance will be classified as high-risk even if it also has a feature that can be used for fraud detection . Only where that feature can be considered to constitute a distinct system in its own right will that system fall outside the scope of point 5(c) of Annex III, while the system intended to be used for risk assessment and pricing in the case of health and life insurance will be classified as high-risk. This is in line with Recital 58 AI Act, which clarifies that systems used for fraud detection should not be classified as high-risk in general.
a) Practical examples of AI systems falling within the high-risk use case of point 5(c)
Risk assessment and pricing
- An AI system intended to be used by an insurer that reviews applications for life insurance, so long as it qualifies as a risk assessment as defined above. This is usually the case if the AI system processes data provided by the applicant, such as age, health status, family history, lifestyle habits and occupation and relies on mortality tables, that estimate the probability of death for each applicant within a given period. This processing guides whether the insurer accepts the application and what conditions apply.
- An AI system intended to be used by an insurer to predict the expected annual medical cost for a risk group. The AI system may calculate and add expenses for administration and a profit margin. The final figure becomes the premium charged to members of that group.
b) Practical examples of AI systems falling outside the high-risk use case of point 5(c)
Claims management
- AI systems intended to be used for claims management in case of health insurance products in case the insured event happens. This is because these systems are intended to to verify whether a claim is valid under the policy terms or to determine the amount to be paid, they do not fall within the use case of point 5(c) of Annex III. These use cases are distinct from carrying out a risk assessment or pricing, even though their outcome might affect the enjoyment of the health insurance. In the same vein, those systems may fall outside the use case of point 5(c) of Annex III if they are intended to be used in claims management to improve the quality of claims processing and decision-making by contributing to the accuracy, by inter alia the validation of claimant information against various databases. Product design for life insurance
- AI systems intended to be used in product design for life insurance fall outside the use case of point 5(c) of Annex III , if they are not intended to be used for risk assessment and pricing in individual cases. Those AI systems typically support a data-driven approach to product design by analysing large volumes of demographic, behavioural, and socio-economic data. By identifying emerging customer needs, risk patterns, and coverage gaps, the AI system enables insurers to create tailored life insurance products that are both relevant and competitively priced. For example, these AI systems can detect underserved segments and recommend product features or pricing models suited to their profiles. Scenario simulations and predictive modelling may help to assess the potential impact of new product offerings before launch, reducing development time and market risk. Those AI systems usually represent a prior and separate stage in the value chain of insurance companies. The product design may set the framework on what insurance products are offered and within which pric ing framework. However, there is no evaluation of a natural person’s risk profile involved to determine whether to offer, decline, revoke or deliver services related to health and life insurance.