This article is by Kevin Gaut, Chief Technology Officer, INSTANDA
Insurance has moved quickly up the AI maturity curve. Most insurers now use AI to summarise documents, extract data or give a skilled user a faster answer to a well-defined question. The next stage is different. Agentic AI does not simply produce an output for a person to act on. It can carry out a sequence of tasks within a workflow, which raises a harder question about how people stay in control of what it does.
That shift creates a compliance problem the industry has not yet properly confronted. Almost every control insurers rely on assumes that a person makes each decision, or it has followed a predefined flow and set of deterministic rules, with human oversight over both. Competence frameworks assume someone was trained and assessed. Under the Senior Managers and Certification Regime, accountability traces back to a named individual.
The answer is not to loosen human oversight. Accountability for customer outcomes must stay with people, and people must stay firmly in the loop. The challenge is making oversight meaningful when an agent can complete many steps in the time it takes a person to review one. Insurers need a model that keeps humans in control of what agents can do, when they must stop and hand over, and how their work is checked. The good news is that the industry already has one.
Govern agents like coverholders
Insurers have spent decades working out how to let someone else make decisions on their behalf without losing control. Delegated authority is built on exactly that. A binding authority agreement sets out what a coverholder can write, in which classes, and up to what limits. Anything outside those boundaries is referred back. The coverholder reports what it has done through bordereaux, the insurer retains audit rights, and authority can be adjusted if performance or conduct falls short. The same logic already applies in claims, where third-party administrators settle within agreed limits and refer anything larger or unusual.
This is a far more practical template for agentic AI than a general commitment to human oversight, because each element translates directly into a point of human control:
Authority limits become the defined scope of each agent: which products, which decisions and what value thresholds.
Referral rules become escalation points, where an agent must hand over to a person, for example when a risk falls outside appetite or a customer shows signs of vulnerability.
Bordereaux become the agent’s action log: a complete, structured record of what it did and on what basis.
Audit rights become continuous human monitoring, checking outcomes against expectations rather than sampling a handful of cases once a year.
Withdrawal of authority becomes the ability to narrow or switch off an agent quickly, without disrupting the rest of the operation.
Framing it this way also settles the accountability question. No insurer believes that delegating authority to a coverholder transfers responsibility for customer outcomes, and the same applies to AI. A coverholder never operates without the insurer: people set its authority, handle every referral and review what it has done. The same must be true of agents, with a named person accountable for the authority each one is given and how that authority is used.
Test products before customers do
Agentic AI also changes when insurers can find problems. Today, most evidence about whether a product works for customers arrives after launch, through complaints, cancellations, drop-off rates and file reviews. By the time a pattern emerges, real customers have already been affected.
Consumer Duty asks firms to avoid foreseeable harm, and AI could help them identify potential harm before it happens. Before a product goes live, agents can act as synthetic customers with different circumstances and personas, working through the full journey: reading the wording, answering the questions and trying to buy a policy. Where they get stuck, misread a disclosure, are wrongly declined or end up with cover that does not fit their situation, the insurer has evidence it can act on before anyone is harmed.
This does not replace user research or human review. But it turns customer understanding and fair value testing into something that can run on every change, rather than a periodic exercise that struggles to keep pace with how often products now change.
Authority only works if the rules are explicit
Neither approach works if the rules an agent is meant to operate within are unclear. An agent can only stay inside its authority if that authority is written down in a form it can read. Product rules, rating logic, eligibility criteria, referral triggers and permissions need to be held explicitly in the core system, not buried in custom code, spreadsheets or the experience of a few long-serving staff.
This is where the pace of change becomes a governance issue in its own right. Configurable platforms already let insurers change products far more often than before, and agents will accelerate that further. Sign-off processes designed for a handful of releases a year will not scale to dozens of changes a month. The answer is not more reviewers, but systems where every change is versioned, every approval is recorded and the impact of a change can be tested before it reaches customers.
Keeping people in control by design
None of this diminishes the role of people, but it does change where their judgement is applied. As AI agents support more parts of the value stream, underwriters and compliance teams will still review decisions and handle every referral. Alongside that, they will spend more time designing the
boundaries agents work within: setting limits, defining referral points, monitoring outcomes and adjusting authority when the evidence says they should.
That is a familiar job in insurance. The industry has managed delegated authority for decades. Applying the same discipline to AI agents may be the most practical route from experimentation to live use, keeping people firmly in the loop and never losing sight of who is accountable when something goes wrong.
Be the first to comment