EU AI Act in Life and Health Insurance (Annex III, 5)

Main article: High-risk AI under Annex III — step-by-step classification of AI systems against the eight areas of Annex III, with a decision tree.

1. Annex III no. 5(c)

What is covered is 'risk assessment and pricing in relation to natural persons in the case of life and health insurance.' (Annex III no. 5(c) AI Act; point (b) concerns creditworthiness assessment/credit scoring.) Number 5 of Annex III sits within the broader area of 'access to and enjoyment of essential private services and essential public services and benefits', which covers, among other things, creditworthiness, health and life insurance and emergency calls.

Legal consequence: AI systems that fall within an area listed in Annex III are deemed high-risk under Art. 6(2) AI Act. The exception in Art. 6(3) AI Act applies only where the system does not pose a significant risk to health, safety or fundamental rights — and it is excluded where the system performs profiling of natural persons. You should therefore assess each system in documented form: what exactly does it do, which inputs does it process, which output does it produce, and does that output materially influence the application or tariff decision?

Practical recommendation (not a legal obligation): interpret Art. 6(3) narrowly and, in case of doubt, classify as high-risk — an overly high classification costs effort, an overly low one carries the risk of a fine under Art. 99(4) AI Act.

2. Special categories of data under Art. 9 GDPR

Health data in insurance = Art. 9 GDPR. Required: an exception under Art. 9(2) GDPR + on the AI side, data governance with a bias review as a requirement for the high-risk system (Art. 10 AI Act). In detail: Art. 9(1) GDPR prohibits, in principle, the processing of health data and genetic data as well as of biometric data for the purpose of uniquely identifying a natural person; the prohibition is opened up only through the exceptions in Art. 9(2) GDPR, such as explicit consent. In addition, Art. 6(1) GDPR lists the six legal bases on which any processing must rely.

What this means operationally: where processing relies on consent, the controller must be able to demonstrate under Art. 7(1) GDPR that consent was given. Under Art. 7(3) GDPR, consent may be withdrawn at any time, and withdrawal must be as easy as giving consent — the withdrawal route therefore belongs in the application journey and in the portfolio process, not only in the privacy notice. Requests from data subjects under Art. 15 to 22 GDPR must be responded to without undue delay under Art. 12(3) GDPR, and at the latest within one month; in complex cases an extension of two months is possible, of which the data subject must be informed within the first month together with the reasons. Where parts of the processing are outsourced — scoring service providers, hosting, model operation — Art. 28(1) GDPR permits working only with processors that provide sufficient guarantees of appropriate technical and organisational measures; the data processing agreement must cover the minimum content of Art. 28(3) GDPR (subject matter, duration, nature and purpose of the processing, types of data, categories of data subjects, obligations and rights of the controller). On the AI side, the data governance concept under Art. 10 AI Act is one of the requirements for high-risk AI systems (see section 7).

3. FRIA obligation

Annex III no. 5(c) → FRIA mandatory. Risk: discrimination on grounds of pre-existing conditions or genetic predisposition. The fundamental rights impact assessment under Art. 27 AI Act does not apply to every high-risk AI system and not to every deployer: it applies to public bodies and to private actors performing public tasks, and specifically to the systems under Annex III no. 5(b) (creditworthiness assessment) and (c) (life/health insurance scoring). For life and health insurers it is therefore directly relevant. The FRIA is a deployer obligation, not a provider obligation.

In substance, Art. 27 AI Act requires four building blocks: a description of the AI use, identification of the persons affected, assessment of the risks to fundamental rights, and definition of the safeguards. The date of application for Annex III systems is 2 December 2027: Art. 27 AI Act belongs to Chapter III Section 3, whose application Regulation (EU) 2026/1744 — in force since 27 July 2026 — set for that date (Art. 113(3)(c)(i) AI Act as amended; see section 9).

Practical observation (as at the first version, 2 May 2026): banks are already actively building the FRIA methodology for credit scoring.

4. Prohibitions under Art. 5

Art. 5 AI Act prohibits certain AI practices entirely; for the health-related risks of life/health insurance, however, it is not the relevant provision — those risks are addressed through the high-risk obligations. Under Art. 5(1)(a) AI Act, subliminal techniques beyond a person's consciousness as well as purposefully manipulative or deceptive techniques are prohibited where they materially distort behaviour and thereby cause significant harm (or are reasonably likely to cause it). Art. 5(1)(b) AI Act prohibits the exploitation of a vulnerability or need for protection due to age, disability or a specific social or economic situation — an illness as such is not named there as a connecting factor. Health-related risks in life/health insurance are therefore addressed not through Art. 5, but through the high-risk obligations (Annex III no. 5(c) in conjunction with Art. 8 et seq., Art. 26, Art. 27 AI Act) and through Art. 9 GDPR.

Even so, a documented prohibition screening belongs in every AI inventory: Chapters I and II of the AI Act — and therefore Art. 5 — have applied since 2 February 2025 under Art. 113 AI Act, and infringements of Art. 5 sit in the highest fine tier at up to EUR 35 million or 7 % of worldwide annual turnover (Art. 99(3) AI Act). Alongside points (a) and (b), Art. 5(1) AI Act names, among other things, social scoring, biometric categorisation to infer sensitive attributes, and emotion recognition in the workplace.

5. Conformity assessment Art. 43

For high-risk AI systems under Annex III nos. 2 to 8 — and therefore also for life/health insurance under Annex III no. 5(c) — Art. 43(2) AI Act provides for the conformity assessment procedure based on internal control pursuant to Annex VI, 'which does not provide for the involvement of a notified body'. A notified body is therefore precisely not envisaged here: the provider carries out the assessment itself, draws up the EU declaration of conformity (Art. 47 AI Act), affixes the CE marking (Art. 48 AI Act) and registers itself and the system in the EU database before placing on the market or putting into service (Art. 49(1) AI Act).

On registration under Art. 49 AI Act in detail: the provider obligation under paragraph 1 applies to all high-risk AI systems under Annex III, with the sole exception of systems under Annex III no. 2 (critical infrastructure) — Annex III no. 5(c) is therefore covered. Under paragraph 2, providers that conclude for their system under Art. 6(3) AI Act that it is not high-risk must also register. On the deployer side, the registration obligation under paragraph 3 applies only to public authorities and to Union institutions, bodies, offices and agencies; a private-sector insurer acting purely as a deployer is not covered.

This must be kept separate from supervision: the market surveillance authority for high-risk AI systems of supervised insurers is, under Art. 74(6) AI Act, the authority designated for financial supervision — in Germany, BaFin (§ 2(3) and (4) KI-MIG, in force since 29 July 2026). As at the date of this article (17 August 2026), Austria has not designated a market surveillance authority under Art. 70 AI Act; the AI service desk of RTR is an information and advisory body without supervisory powers. Responsibility under national insurance supervisory law (Solvency II, VAG) remains unaffected alongside this.

Note on Austria: the AI Act is a directly applicable EU regulation — in Austria the same articles and the same deadlines apply (Art. 113 AI Act as amended by Regulation (EU) 2026/1744, in force since 27 July 2026), and there are no diverging national provisions. On supervision, however, the position is different: under Art. 74(6) AI Act the authority designated nationally for financial supervision of these institutions is deemed to be the market surveillance authority; Austria, however, has not designated an authority under Art. 70 AI Act as at the date of this article (17 August 2026) — the AI service desk of RTR is an information and advisory body without supervisory powers. A diverging designation is possible only under Art. 74(7) AI Act. On the data protection side, the GDPR likewise applies unchanged, but national supervision lies with the Austrian Data Protection Authority (Datenschutzbehörde, DSB), with the Austrian Data Protection Act (DSG) as a supplement (not the German state data protection authorities with the German Federal Data Protection Act (BDSG)).

6. Provider or deployer — who bears which obligation

The burden of obligations follows the role: providers (Art. 3 no. 3 AI Act) develop an AI system or place it on the market and bear risk management, technical documentation, conformity assessment and the EU database entry; deployers (Art. 3 no. 4 AI Act) use it under their own authority and bear input data, log and information obligations as well as — in the case of Annex III no. 5(b)/(c) — the FRIA. Anyone deploying a bought-in tariff or application assessment system is initially a deployer. In the event of a substantial modification of the intended purpose or functionality, or where the system is placed on the market under its own name, the role changes under Art. 25 AI Act to that of a provider — with all provider obligations.

7. The high-risk requirements at a glance

For Annex III high-risk AI, the AI Act requires a coherent package of obligations that goes beyond classification alone. The following overview lists the requirements together with their reference; each row is a statutory requirement of the AI Act, not a practical recommendation. The associated dates of application are set out in section 9.

Practical assessment: for the application and tariff journey, Art. 10 and Art. 14 AI Act have the greatest effect on processes — the data governance concept addresses the training and input data, human oversight the question of where in the process a person reviews the machine assessment.

8. Anti-discrimination law alongside the AI Act — DE and AT separately

Equal treatment law applies independently of the AI Act deadlines and is framed differently in Germany and Austria. In Germany, disadvantage on grounds of race or ethnic origin, gender, religion, disability, age or sexual identity is impermissible under § 19(1) of the German General Equal Treatment Act (AGG) in civil law obligations that typically arise without regard to the person in a large number of cases (mass transactions) or that concern private insurance; for race and ethnic origin, the prohibition applies comprehensively beyond that under § 19(2) AGG. Procedurally, § 22 AGG applies: where, in a dispute, one party proves indications suggesting disadvantage on a ground named in § 1 AGG, the other party bears the burden of proving that there was no infringement.

In Austria, access to goods and services is not governed by the AGG but by the Austrian Equal Treatment Act (GlBG): under § 31 GlBG (Part III), no one may be discriminated against directly or indirectly on grounds of ethnic affiliation, including in access to and supply of goods and services available to the public. The competent support body is the Ombud for Equal Treatment (GAW) under § 3 of the GBK/GAW Act, and in Germany the Federal Anti-Discrimination Agency (Antidiskriminierungsstelle des Bundes) under §§ 25, 27 AGG. The German § 19 AGG and the Austrian § 31 GlBG therefore do not cover the same set of characteristics — equating the two regimes would be incorrect.

9. Timeline: what applies from when

The application schedule follows Art. 113 AI Act as amended by Regulation (EU) 2026/1744 (Digital Omnibus AI), in force since 27 July 2026: the general date of application of 2 August 2026 remains unchanged (including Art. 50), but the high-risk obligations of Chapter III Sections 1–3 apply to Annex III systems only from 2 December 2027 and to Annex I systems from 2 August 2028. For life and health insurers under Annex III no. 5(c), 2 December 2027 is therefore the central cut-off date.

On Regulation (EU) 2026/1744 (Digital Omnibus AI): it goes back to the Commission proposal of 19 November 2025 and has been in force since 27 July 2026. It postpones the high-risk obligations of Chapter III Sections 1–3 for Annex III systems to 2 December 2027 and for Annex I systems to 2 August 2028 (Art. 113(3)(c) AI Act as amended). This also covers Art. 27 AI Act, which belongs to Chapter III Section 3. Art. 4, Art. 5, the GPAI obligations and Art. 50 are unaffected by the postponement; the general date of application of 2 August 2026 remains in place. These are fixed calendar dates without any triggering mechanism.

10. Penalties and supervision

Infringements are penalised under two separate regimes that apply side by side. Art. 99 AI Act provides for a three-tier scale: up to EUR 35 million or 7 % of worldwide annual turnover for infringements of the prohibition of AI practices under Art. 5 (paragraph 3); up to EUR 15 million or 3 % for infringements of certain other obligations, including those of providers under Art. 16, of deployers under Art. 26 and of the transparency obligations under Art. 50 (paragraph 4); and up to EUR 7.5 million or 1 % for incorrect, incomplete or misleading information supplied to authorities (paragraph 5). The higher amount applies in each case; under Art. 99(6) AI Act, the lower value is applied to SMEs and start-ups.

Alongside this there is the GDPR penalty regime: up to EUR 10 million or 2 % of worldwide annual turnover for infringements of, among others, Art. 25 to 39 GDPR (Art. 83(4)) and up to EUR 20 million or 4 % for infringements of the processing principles, the conditions for consent (Art. 5, 6, 7, 9 GDPR) or data subject rights (Art. 12 to 22 GDPR) — Art. 83(5) GDPR. In addition, in Germany § 43(2) and (3) BDSG makes certain infringements — incorrect handling of a request for access or of consumer information under § 30 BDSG — an administrative offence subject to a fine of up to EUR 50,000; no fines are imposed on public authorities and other public bodies. In Austria, under § 62(1) DSG, an administrative offence subject to a fine of up to EUR 50,000 is committed by anyone who intentionally obtains unlawful access to data processing or intentionally transmits data in breach of data secrecy (§ 6 DSG) — but only in so far as the act does not already constitute an offence under Art. 83 GDPR or is not otherwise subject to a stricter penalty; the competent authority is the Datenschutzbehörde.

Keep responsibilities clearly separate: AI Act market surveillance for supervised insurers has been with BaFin in Germany since 29 July 2026 (Art. 74(6) AI Act, § 2(3) and (4) KI-MIG); Austria has not designated an authority under Art. 70 AI Act as at 17 August 2026 (see section 5). Data protection supervision in Germany lies with the authority competent for non-public bodies under state law (§ 40(1) BDSG), and in Austria with the Datenschutzbehörde (§ 18(1) DSG).

11. Implementation: sequence and practical rhythms

The law prescribes the what, not the sequence — the following order is a practical recommendation and does not establish a legal obligation of its own. First: an AI inventory per system, with name and provider, use case, role (provider/deployer/both), risk class, the types of data processed including special categories under Art. 9 GDPR, and the persons responsible for oversight and escalation. Second: clarification of the role for each system under Art. 3 no. 3 and no. 4 AI Act, including the question of whether Art. 25 AI Act triggers the provider role. Third: the FRIA under Art. 27 AI Act for the systems under Annex III no. 5(c) and, separately from that, the assessment of the DPIA triggers under Art. 35 GDPR (see FAQ). Fourth: evidence and record-keeping under Art. 26(4) and (6) AI Act.

Practical rhythms (recommendation, not statutory intervals): update the inventory and role allocation whenever a system changes substantially, renew the FRIA and the bias review on an event-driven basis when the model changes or tariffs are reworked, and test the escalation routes for human oversight under Art. 14 AI Act regularly. These rhythms are values drawn from implementation practice and are not based on any deadline rule in the AI Act.