Newsletters
Risk Central
Digital EditionITC Vegas 2026: The Next Phase of A.I. Governance
A fundamental new challenge has emerged as A.I. moves rapidly from experimentation to deployment. As technology capabilities and use cases advance, carriers must ensure their use of new technology follows standards of fairness, accountability, and compliance. The discussion has shifted from wondering about the potential of A.I. to realistic concerns about how carriers can deploy it safely while remaining accountable for oversight and decisions.
The session, “AI Safety and Governance in Claims,” at the recent ITC Vegas conference explored the topic of A.I. governance from the dual perspectives of operations and regulation. Moderated by Yiannis Broustas, head of marketing at Assured, the discussion included Justin Lewis-Weber, CEO of Assured, and David Heales, partner at Willkie Farr & Gallagher LLP.
The discussion raised a new reality for carriers to manage: A.I. governance can no longer be a collection of policies and principles, a nice-to-have standard operating procedure to reference and forget. It must become embedded in operational discipline, able to withstand regulatory scrutiny and function reliably across insurance functions.
The Continued Evolution of A.I. Safety and Governance
The acceleration of A.I. deployment across insurance operations has raised a defining question about control. How can carriers retain control while still benefiting from the growing capabilities of A.I.? Regulators want to encourage the safe usage of A.I., Heales noted, given the opportunities it brings both for individual carrier outcomes as well as the potential for improvements to the overall industry.
“[Regulators] know that carriers want to use these tools that are now at their disposal because of the humungous opportunity for improvements to systems and processes, and a lot of those improvements can go straight to the bottom line and thus be better for solvency, better for rates, and can mitigate rate rises in P&C,” said Heales. The other side to consider, he noted, is that regulators have decades of well-established frameworks for regulating insurance companies and the sudden need to vet deeply technical systems presents a challenge.
The NAIC’s Model Bulletin on the Use of Artificial Intelligence Systems by Insurers began the framework for expectations around governance, documentation, risk management, and oversight for carriers. Heales explained regulators have growing concerns around carriers’ ability to demonstrate their A.I. governance frameworks are functioning as expected. Written A.I. policies alone are no longer sufficient if carriers are unable to explain how their systems are used, how decisions are made, and how compliance is monitored.
The speakers reinforced that third-party technology does not remove regulatory responsibility from the carrier, and that carriers need to maintain an inventory of their A.I. applications along with clearly assigned roles, accountability, oversight, and control over system performance. Governance must be proactive, beginning before implementation rather than being reconstructed after deployment. Regulatory scrutiny will only become more structured as technology advances, making it more critical that carriers can show compliance with controls.
Embedding A.I. Governance Into Operations
Another significant point made during the session is that effective A.I. governance must be embedded within system design. This includes claims-specific testing, guardrails, documentation, and accountability, particularly as multistep agentic A.I. processes are rolled out.
Lewis-Weber described how processes that are not considered during system design can fail in real-world environments where things like claims can be incredibly complex and varied. “It doesn’t work outside of the happy path use cases demos are doing, and it’s failing both from a capability standpoint and a safety perspective. It doesn’t have the appropriate guardrails, things are getting hallucinated, and there’s issues of jailbreaking going on.”
And different activities call for different levels of control. For example, an A.I. system that requests missing documentation or sends a compliance notice presents a different risk profile from one that recommends a coverage denial. This means that testing and oversight should be customized to use cases, and documentation should explain which models were used, what information informed a decision, and whether appropriate controls were in use. Equally important is continuous monitoring of A.I. systems and their operating environments to reassess performance and refine controls after implementation.
A.I. Governance is Foundational for Innovation
A recurring theme from the session was that carriers must balance innovation with accountability. There are competing risks of moving too quickly or too slowly when it comes to deploying new technologies. Embedding technology quickly allows carriers to see the benefits sooner and gain a competitive advantage, but a poorly executed deployment can create regulatory risk, litigation exposure, and reputational harm. Instead, carriers need a balanced approach connecting technological innovation with disciplined decisions.
The session ended with takeaways for carriers. Heales advised, “Don’t be slow. There’s no reason to wait in deploying these tools. The regulators have set out a clear pathway for you to do it in a way that they would be comfortable with.”
Lewis-Weber closed with this advice: “I think the carriers who do this rapidly and who do it successfully will just outperform their competitors and ultimately increase their market share. I think the gulf will widen.”
The next evolution of A.I. governance in the insurance industry will be less about what systems can accomplish and instead will be defined by whether carriers can explain, defend, and be accountable for their A.I. systems.
