AI in Life and Health Insurance 2027 – FRIA, Pricing, and Human Oversight | Word/PDF/Excel

FRIA for AI in life and health insurance – risk assessment, individual premium setting, and human oversight. The EU AI Act treats AI systems intended to assess individuals’ risks or price their life and health insurance as a specific use case in Annex III, point 5(c). For relevant high-risk systems, Article 27 means that private insurers in the role of users (deployers) must also assess the impact on fundamental rights – a FRIA. This is a specialized document package to structure that assessment before AI is put into use.

Quick facts: 7 Word documents (DOCX), 7 corresponding searchable PDFs, and 1 Excel workbook with nine tabs = 15 files in a digital ZIP. Five work templates and a guide are in Swedish, plus a separate English user guide. The English guide does not mean that all Swedish forms are available in English translation. The PDF files are printable and searchable, but not electronically fillable forms.

Who is the FRIA package intended for?

Swedish life and health insurers, risk and product managers, insurance actuaries, legal and compliance functions, data protection officers, AI officers, and procurement/supplier officers who want to prepare and document AI systems for individual risk assessment or premium setting.

Example 1: An AI system uses individual risk data to propose life insurance premiums or determine underwriting conditions. Example 2: A premium is increased after a model version change, and the business wants to test the possibility of a human explanation and correction. Example 3: An insurer needs to assess whether health data and potential automated risk assessment comply with GDPR, alongside an FRIA.

This is not included: insurance terms and conditions, ready-made individual insurance decisions, actuarial premium formulas, technical AI certification, full legal opinions, or formal notification to an authority. The package is not intended to store actual health data or individual customer premiums.

Exactly what is included – document by document

Excel with nine tabs

Start, System, Classification, FRIA Process, Affected Groups, Rights Risks, Human Oversight, GDPR-DPIA, and Decisions & Sources. The workbook helps the insurer link models, risks, controls, measures, and sources with secure internal case and evidence references. Control formulas mark Missing documentation or Documentation registered – MANUAL REVIEW, never that the law is met. The customer file is empty and contains no policyholder data or test data.

EU AI Act – high risk for certain insurance models

According to the European Commission’s guidance on essential services, Annex III point 5(c) covers certain AI systems intended for risk assessment and pricing of natural persons in life and health insurance. Classification is based on the actual purpose and Article 6, including an assessment of applicable exemptions and potential personal profiling. Claims handling after an insurance claim or general product design without individual risk pricing does not automatically fall under this use case.

Date: For high-risk systems under Article 6.2 and Annex III, the relevant rules in Chapter III, Sections 1–3, will apply from 2 December 2027 according to Regulation (EU) 2026/1744. For systems already put into use, special transitional provisions apply, including Article 111. Rules that apply from earlier dates are not automatically affected by the later date.

FRIA – six fundamental rights elements under Article 27

Article 27 requires affected users of high-risk AI, including Annex III 5(c), to assess (a) the business process where the system is used, (b) the period and frequency, (c) the affected persons and groups, (d) the risks to harm and fundamental rights, (e) human oversight, and (f) measures, internal governance, and complaints when risks materialize.

Article 27 also contains rules on updates and a notification of the FRIA result to the competent market surveillance authority using the prescribed questionnaire when the obligation applies, with certain exceptions. This product contains internal preparation and documentation – not an official submission form.

GDPR already applies: health data, DPIA, and automated decisions

Health data are special categories of personal data. GDPR requires a suitable legal basis under Article 6 and a separate permitted situation under Article 9 when such data are used. Article 22 covers certain decisions based solely on automated processing that produce legal or similarly significant effects. A signature from a human processor is not automatically evidence of meaningful human decision-making control. IMY explains the boundary. Assess separately whether a data protection impact assessment under GDPR Article 35 (DPIA) is required. FRIA and DPIA can be cross-referenced where Article 27.4 allows, but they are different legal obligations.

Six-step workflow

1. Map the model, supplier, insurance product, and whether AI affects individuals’ risk assessment or premiums.
2. Document the legal assessment of Annex III 5(c), Article 6, legacy systems, and applicability dates.
3. Perform the FRIA under Article 27(a–f) and identify concrete risks to equal treatment, access to protection, and privacy.
4. Assess GDPR Articles 6, 9, 22, and 35 separately, with the appropriate legal officer and data protection officer.
5. Test genuine human oversight with fictitious cases involving an incorrect data source, proxy variable, or unclear premium change.
6. Make a manual pilot/stop decision, check any authority notification through the official channel, and follow up on changes.

Frequently asked questions

Is all AI in the insurance industry high-risk?

No. Annex III 5(c) applies to certain AI systems for risk assessment and pricing in life and health insurance. Claims handling and general product design are not automatically classified in the same way.

Must private insurance companies conduct an FRIA?

Article 27 expressly covers users of high-risk AI under Annex III points 5(b) and 5(c), not just public organizations. Assess whether the system and its use truly fall within the provision.

When do the relevant AI Act high-risk requirements apply?

2 December 2027 for Annex III systems under Amending Regulation 2026/1744, with special transitional rules. Separate GDPR requirements may already apply.

Is a GDPR-DPIA the same as an FRIA?

No. A DPIA assesses the protection of personal data processing under GDPR Article 35. An FRIA assesses the impact on fundamental rights under AI Act Article 27. References between them can be used where applicable.

Can Excel automatically perform a GDPR or FRIA assessment?

No. The register only checks whether fields are filled in and is used to collect internal evidence references. It does not calculate premiums, review medical data, or issue legal approvals.

Can customers’ health data be entered into Excel?

No. Use pseudonymous internal system and evidence IDs without personal identity numbers, actual health status, or individual premiums. Such data requires specially secure and lawful processing in intended systems.

Are the PDF files electronically fillable, and are all templates available in English?

The PDF files are searchable and printable but not electronically fillable. The Word files are editable. The work templates are in Swedish; a separate English user guide is included.

Related document templates from the Template Store

For general AI governance, see the AI Governance Package. For the independent data protection impact assessment, see DPIA / GDPR Impact Assessment. For other industry-specific FRIA needs, see our templates for AI in social services and AI in schools. This product, however, is specifically for life/health insurance risk assessment and premium effects.

Sources and responsibility

Consolidated AI Act (EU) 2024/1689, Amending Regulation (EU) 2026/1744, European Commission examples for life/health insurance, Article 27, GDPR, and IMY guidance.

Version 1.0. Legal sources checked 12 November 2026 with AI assistance. No independent lawyer has approved the product. No documents constitute official forms, actuarial decisions, insurance terms and conditions, or evidence of regulatory compliance. The product is delivered as a digital ZIP after being separately published and linked by the store administrator.