Navigating GenAI risk in insurance

Generative artificial intelligence is quickly becoming an important tool in the insurance industry.  In fact, actuaries and other professionals working with insurers are deploying large language models and AI agents to support a range of business activities, including actuarial modeling, valuation and reporting, risk assessment and pricing support.

GenAI can improve efficiency across the insurance industry by reducing operational effort, making unstructured information more accessible, accelerating reporting and documentation, and supporting more consistent workflows. At the same time, GenAI introduces risks that insurers must understand and manage.

Transformative potential also presents practical limitations

The opacity of LLMs creates issues around interpretability and explainability, which presents challenges to actuaries who must justify methods, assumptions and results to important stakeholders.

GenAI’s limitations are often in three categories:

1. Output-related limitations
2. Model-related constraints
3. Input-related issues

Output-related limitations often take the form of factual hallucinations: false or unverifiable responses presented with unjustified confidence. LLMs can also produce “faithfulness” hallucinations, which occur when they ignore instructions, contradict information provided by the user or use inconsistent logic.

Lack of transparency is considered a model-related constraint. Most companies purchase proprietary LLMs from vendors, and the datasets used to train the models typically are not disclosed. Therefore, the companies that purchase these LLMs can’t confirm whether the data contains biases or other problems.

Inherent complexity is another model-related constraint. LLMs are often considered black boxes because their internal mechanisms are inaccessible or too complex to understand.

These model-related issues make it harder to determine who is accountable and what caused an error — a growing concern as regulators demand greater explainability.

Prompt sensitivity is an example of input-related issues. LLMs can be very sensitive to a prompt’s phrasing, meaning even small wording changes may produce different responses. An LLM’s robustness refers to its ability to deliver dependable, accurate results despite minor alterations in phrasing, context or data.

With greater opportunity come greater risks

AI system design and architecture can create new safety risks through the ways models, data, prompts, retrieval tools and users interact. Data leakage is one such risk. For example, a malicious user could craft prompts designed to extract sensitive information about other policyholders.

Another risk involves potential attacks that manipulate a model’s inputs, context or training data to bypass its intended behavior or safety controls. These attacks may cause the model to reveal confidential data, follow prohibited instructions or produce false content. A common example is prompt injection, such as telling the model to ignore its rules.

GenAI models can also produce potential bias in their outputs. For example, feedback from an expert panel on AI and actuarial responsibility hosted by the Society of Actuaries  Research Institute indicates that healthcare data can be impacted by social and systemic influences, which can affect the performance and fairness of AI systems trained on such information. In other words, legacy data reflects legacy decisions and often reproduces past structural unfairness.

Mitigation strategies: Building protection into every layer

Coordinating safeguards is key to protecting GenAI systems and their outputs. For example, a mitigation strategy organized by defense layer focuses on a specific stage of a system, rather than each GenAI limitation or outside threat.

Starting with the user’s input, controls can help reduce the risk of malicious inputs being processed. Prompt sanitization tools offer one such control, automatically anonymizing sensitive information in a prompt before it’s transmitted to the model to prevent data leakage. Likewise, input filtering frameworks can block harmful prompts before they reach the model. Prompt design techniques and ethical instructions can also help mitigate biased outputs.

Additionally, access controls ensure only authorized users can use the system and see role-relevant data, while architecture-level controls limit exposure of sensitive data and reduce the attack surface. Output-level controls review and filter the system’s responses before they reach the user, helping prevent harmful or policy-violating content from getting through. The SOA Research Institute’s Model Governance/Ethics for GenAI Models—Practical Guide and Educational Handbook provides information about several tools currently available.

Furthermore, continuous monitoring of GenAI systems can help identify threats, performance degradation and evolving biases through:

• Stress testing the system’s safeguards with simulated attacks
• Drift monitoring to assess whether the system’s behavior is consistent with expectations
• Feedback loops to allow end users to flag incorrect or biased outputs
• Toxicity testing to assess the risk of the system producing harmful or biased content

Beyond these monitoring strategies, the SOA’s AI and ethics expert panel suggested actuaries complement statistical modeling with insights from social science, behavioral economics and history. By questioning unfair outcomes, biased results and incomplete data, actuaries can help ensure models are used responsibly.

Governing GenAI from planning through post-deployment

The risks and mitigation methods demonstrate the need to apply governance to GenAI systems throughout their lifecycle.

The framework outlined below can help ensure safety, data governance and model and system governance during each phase of an AI system’s lifecycle:

• Planning: defining scope and business objectives, identifying risks, setting governance structures, establishing risk criteria and initializing lifecycle documentation
• Design: turning objectives, risk assessment and governance structures built in the planning phase into technical and organizational choices
• Development: building, aligning and validating the AI system
• Deployment: packaging the built and validated AI system into a maintainable product
• Post-deployment: using governance structures established in earlier phases to facilitate continuous monitoring

While governance structures, processes and frameworks serve as crucial guides to meet current best practices and regulatory expectations, they should remain adaptable as technology develops and regulations evolve. To stay at the forefront of ethical and effective AI, actuaries must keep learning and stay current with evolving professional and regulatory standards.

© Entire contents copyright 2026 by InsuranceNewsNet.com Inc. All rights reserved. No part of this article may be reprinted without the expressed written consent from InsuranceNewsNet.com.

R. Dale Hall, FSA, MAAA, CERA, is managing director of research, Society of Actuaries Research Institute. Contact him at dale.hall@innfeedback.com.