What the AI Act says about credit and insurance
Annex III of the AI Act (Regulation (EU) 2024/1689) lists the areas in which AI systems are considered high-risk. Point 5 includes two uses in financial services: AI systems intended to evaluate the creditworthiness of natural persons or establish their credit score, except systems used to detect financial fraud; and AI systems intended for risk assessment and pricing in relation to natural persons in life and health insurance. Deployers of these two categories must also carry out a fundamental rights impact assessment before first use (Article 27).
The timing changed this year. The Digital Omnibus on AI, published as Regulation (EU) 2026/1744 and in force since 27 July 2026, moved the rules for high-risk systems in Annex III to 2 December 2027. Other parts already apply: the prohibited practices and the duty to support AI literacy since 2 February 2025, and most remaining rules, including the transparency rules of Article 50, since 2 August 2026. This summary follows the consolidated text published by the Commission’s AI Act Service Desk; it is not legal advice.
Insurance supervision is not waiting for December 2027. On 6 August 2025 EIOPA published an Opinion on AI governance and risk management, aimed at AI systems that are not prohibited or high-risk under the AI Act. It sets no new requirements but explains how existing insurance law applies, with a risk-based and proportionate approach covering data governance, record-keeping, fairness, cybersecurity, explainability and human oversight. EIOPA names pricing, underwriting, claims management and fraud detection as areas where AI use is growing.
What it shows
The high-risk label follows the purpose, not the technology. A model that sets a credit score or a life insurance premium is high-risk; the same kind of model summarising a damage report is not a use listed in Annex III. Claims handling as such is not on the list, but every use still needs its own assessment, and a system that would effectively decide on cover or amounts deserves a much closer look than one that prepares a summary.
That suggests a practical order. Much of the time in claims handling goes into reading: the claim form, expert reports, invoices, photos, policy conditions and earlier correspondence. Much of the time in a credit file goes into collecting and checking documents. These are tasks where assistive AI can save time while the decision stays visibly with a person, and where a record of what the system read and suggested is easy to keep.
- Read the file. Extract the key facts from claim forms, reports and invoices, each linked to the page it came from.
- Summarise for the handler. A short overview of what is known, what is missing and what contradicts, ready for review.
- Leave the decision. Cover, amounts and credit decisions are taken by the handler or underwriter, with the summary as one input.
Where Meridian fits
Meridian AI is assistive: it reads documents, answers with references to the source and prepares summaries and drafts. It runs in your own environment, with logged access and keys held by you. Document analysis and source-backed answers are existing capabilities; connecting your claims or credit systems is a project integration. Meridian AI does not set prices, does not score customers and does not decide on claims or credit. Using AI for those decisions is a high-risk use with its own obligations and needs its own assessment with your legal and compliance advisers. This article does not suggest that any organisation named in the sources uses Meridian.
Start with one claim type
A practical pilot takes closed files of one claim type, such as water damage in home insurance, and a small group of handlers. Compare the time to a first complete overview of a file today with the time using source-backed summaries, and record how often a handler corrects a summary. Agree the acceptance criteria in advance and leave the step where a person decides unchanged.
What Meridian would set up
- Connect
- Closed claim files of one claim type: forms, expert reports, invoices and photos
- The policy conditions that apply to those files
- Build
- Key facts extracted from each document, each linked to its source page
- A file summary with open questions and contradictions, for the handler to review
- A record of accepted and corrected summaries per file
- Run
- In your own environment, with access limited to the pilot handlers and logged
- Decisions on cover and amounts stay with the handler
Illustrative set-up — every deployment is designed with the operator. Source systems stay where they are; Meridian’s data layer runs inside the operator’s own environment.
Start where AI helps people read. Keep the decisions where the law, and your customers, expect a person.
- AI Act Service Desk — Annex III: high-risk AI systems, point 5
- AI Act Service Desk — Implementation timeline (amended by the Digital Omnibus on AI)
- AI Act Service Desk — Article 27: fundamental rights impact assessment
- EIOPA — Opinion on AI governance and risk management (6 August 2025)
Meridian is not involved in the incidents or investigations described. Facts from public sources, as of 5 November 2026.