High-risk system
The central category of the AI Act, gathering the AI systems subject to binding obligations because of their potential impact on people's safety or rights.
The high-risk system is the cornerstone of the AI Act, Regulation (EU) 2024/1689. The text sorts uses on a risk pyramid, from prohibited uses at the top to minimal risk at the base. Most of the constraint falls on the middle tier, high risk. A system gets there by one of two routes. Annex I covers a safety component embedded in an already regulated product. Annex III covers eight sensitive standalone-use areas, such as biometric identification, employment, critical infrastructure or access to essential services. The classification triggers a full set of obligations: risk management, data governance, technical documentation, logging, transparency, human oversight, accuracy, robustness and cybersecurity, all checked through a conformity assessment. For insurance, point 5(c) of Annex III is decisive. It expressly classifies as high-risk the AI used for risk assessment and pricing in life and health insurance. That puts the insurer's pricing engine under direct regulatory supervision.
Textbook case: a health insurer using a model to price its individual contracts deploys a high-risk system within the meaning of Annex III, point 5(c), and must therefore document its data governance and ensure human oversight of its algorithm.
Follow the research
One letter a week. First, the week's underwriting note, when one is published: a dated, argued decision, signed by Paul Bernardski. Then what the observatory published on cyber risk, political risk and insurance. No account, no tracking.
No spam, one-click unsubscribe, no data ever sold.