The Rules for AI in Insurance Are Coming Through the Back Door
While the national AI policy is being rewritten, financial-sector standards are quietly setting the governance bar for insurers.
Sign up for my Substack daily AI newsletter here.
Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/
South African insurers are adopting artificial intelligence at speed, and with no national AI policy in place, each is writing its own rules. That sounds like a vacuum, and in Pretoria it is one. Look instead at the financial regulators and at how they responded to a major insurance data breach this year, and a different picture emerges. The rules for AI in insurance are already arriving, not through a national policy but through the back door of conduct standards, prudential supervision and data protection law. For insurance boards, the question is no longer whether to govern AI before the state acts. It is whether the frameworks they are writing today will satisfy the regulators who will soon inspect them.
CONTEXT AND BACKGROUND
KPMG’s South African Insurance Survey 2026, which analysed 29 non-life insurers, 15 life insurers and four reinsurers, finds insurers catching up with banks on AI. AI is mainly used for drafting documents and emails, with some use in routine claims, underwriting, fraud detection and client engagement, but not in actuarial valuations. As KPMG’s Jan van der Merwe put it, “AI is not trusted yet to just run by itself without human oversight.” Meanwhile, the draft National AI Policy remains withdrawn after it cited fictitious references, with finalisation now targeted for the 2026/27 financial year.
The pattern is continental. The African Insurance Organisation reports that many insurers have run AI pilots, but few have built them into daily operations, held back by poor data, scarce skills and regulatory uncertainty. South Africa matters disproportionately: it is the only assessed market where insurance spending, at 11.5% of GDP, exceeds the global average of 7.4%.
INSIGHT AND ANALYSIS
The national gap matters less than it seems. The FSCA’s regulation plan for 2026 to 2029 includes an AI discussion paper with the Prudential Authority, high-level AI governance principles for a planned Joint Standard on Culture and Governance, and draft standards on operational resilience and on cloud computing and offshoring of data.
Regulators have also shown where accountability sits. After the breach at IT provider MIP Holdings, whose chief executive said about 45 client organisations, almost all life insurers, were affected, MIP paid a ransom for a promise that the data would be destroyed. The promise did not hold, and Hollard funeral policyholders’ details appeared on a dark web leak site. The Prudential Authority’s view was blunt: “The obligation, again, lies with the insurers.” The breach was a conventional cyber attack, not an AI failure, yet the principle covers every supplier, AI providers included, and no AI policy was needed to establish it.
I have previously written about this, arguing that organisations rarely know which model sits beneath the AI tools they buy, and that due diligence must reach a vendor’s own suppliers. KPMG’s concern about fourth-party risk, the suppliers of suppliers, is the same problem, and the MIP case shows how it ends.
Insurers are also exposed from the other side. Lawyers at Webber Wentzel warn of “silent AI”: clients using AI that was never considered when their professional indemnity, cyber, product or directors’ liability cover was priced.
IMPLICATIONS
The strongest counter-argument is that existing law already applies, and that principles may serve better than an AI rulebook. British regulators have chosen exactly that route, relying on senior managers’ accountability rather than AI-specific rules. Yet they still expect firms to prove their governance works through AI inventories, board minutes and assessments of third parties. Principles do not lower the bar. They shift the burden of proof onto the board. The real friction locally is that insurers answer to the FSCA, the Prudential Authority and the Information Regulator at once, without a shared AI vocabulary.
In Europe, life and health insurance pricing appears among the high-risk uses listed in the AI Act, with human-oversight duties expected from December 2027 if final guidelines confirm the classification.
For boards, the practical response is to write internal frameworks to the standard regulators are likely to apply: a register of every AI system in use, a named executive accountable for each, a map of suppliers and their suppliers, human sign-off on decisions that affect claims and pricing, and proposal forms that ask clients about their own AI use.
CLOSING TAKEAWAY
Insurers going solo on AI is not the problem. Going solo without a floor is. The national policy will return in time, but the standards that will govern insurers are being written now by the FSCA and the Prudential Authority, and the MIP breach has already shown that accountability does not travel down the supply chain. The boards that treat today’s internal frameworks as a rehearsal for tomorrow’s inspection will be ready. Those waiting for Pretoria may find the rules arrived while they were looking the other way.
Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence’s impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan’s work at https://www.aiforbusiness.net
Comments