Sector · Insurance regulatory compliance
Regulatory compliance for insurers: DORA, GDPR and the EU AI Act
Insurance regulatory compliance now rests on three EU regulations. Insurers and reinsurers have been within DORA since January 2025, process their policyholders’ health data and increasingly use AI models for pricing and claims. That is why DORA, GDPR and the EU AI Act are best managed together.
Key regulations for insurance regulatory compliance
DORA and insurance regulatory compliance
DORA applies to insurance and reinsurance undertakings and to insurance and reinsurance intermediaries, although with exemptions for the smallest. For insurance regulatory compliance, it requires an ICT risk management framework, reporting major incidents to the supervisor, resilience testing and oversight of ICT providers through a register of information and minimum contractual clauses.
Health data and GDPR
In insurance regulatory compliance, health data is a special category, so you need a stronger legal basis, impact assessments for high-risk processing, proportionate security measures and breach notification to the data protection authority within 72 hours.
AI in pricing and claims
In addition, the EU AI Act classes as high-risk the AI systems that assess risk and set prices in life and health insurance for natural persons. Those obligations apply later, from 2 December 2027. However, transparency, such as telling people they are talking to a chatbot, has been enforceable since August 2026.
Insurance compliance: key deadlines
| When | What |
|---|---|
| 17 January 2025 | DORA fully applicable. |
| 4 h · 72 h · 1 month | Major incident reporting under DORA. |
| 72 hours | Personal data breach notification (GDPR). |
| 2 August 2026 | Transparency of AI systems (Article 50). |
| 2 December 2027 | High-risk AI in life and health insurance. |
Business continuity
Claims handling and policyholder service, above all, cannot stop. Therefore, a continuity plan based on ISO 22301, linked to the DORA ICT risk assessment, avoids assessing the same processes twice.
Reviewed on 14 October 2026. For information only, not legal advice.
How Atalaya GRC helps with insurance regulatory compliance
- An inventory of pricing and claims AI models, as well as their risk classification.
- The ICT provider register of information and incident reporting with DORA deadlines, so every deadline stays visible.
- Tracking of impact assessments and, when they occur, health data breaches.
- Continuity plans and business impact analysis (BIA), also linked to ICT risk.
FAQ
Frequently asked questions
Are insurance brokers within DORA?
Insurance and reinsurance intermediaries fall within DORA, unless they are micro, small or medium-sized enterprises.
Which insurer AI is high-risk?
Specifically, AI that assesses risk or sets prices in life and health insurance for natural persons. Other uses, such as customer service chatbots, carry transparency obligations.
Do I need an impact assessment?
Under GDPR, yes, when large-scale processing of health data or profiling poses a high risk to policyholders.
Other sectors: Banking and fintechPublic-sector suppliersEnergy and essential servicesConnected-product manufacturers
Shall we look at it with your own services?
We’ll show you the platform with a real case from your sector. No commitment, no sales script.
