EIOPA and IVASS on AI: what supervisors expect from insurance intermediaries

The short version

• On 17 July 2026 IVASS asked Italian insurers for a board-level report on cyber risk from advanced AI models, due by 31 December 2026. Intermediaries are not addressees.
• On 31 July the three European Supervisory Authorities called for governance and controls over ICT risks from frontier AI models.
• On 16 September EIOPA's executive director, in a contribution to Eurofi Magazine, drew a line between chatbots: one that gives general explanations may sit outside the IDD, one that helps a customer choose a product may trigger registration, disclosure and conduct rules.
• In published tests, general-purpose AI goes wrong where advice matters: Franke und Bornberg saw ChatGPT recommend the weakest policy on the clauses that count.

IVASS: a board report on AI cyber risk by 31 December

On 17 July 2026 the Italian supervisor published a market communication on digital operational resilience and advanced AI models. Its starting point is technical. Recent models make it easier to find software vulnerabilities and, at the same time, to generate ways to exploit them, which shortens the window between discovery and attack and removes the need for specialist skills.

The requests are aimed at insurers. The board reviews the communication with the statutory auditors and sends IVASS, by 31 December 2026, a report on risk exposure and on the adequacy of controls, with a work plan covering actions, timing and investment. Each insurer names an accountable function, for example second-line ICT risk control. The framework is DORA, and part of the text deals with outside IT suppliers: supply chains that run across several tiers and rely on a handful of providers can turn a contained problem into a widespread one.

Agencies and brokers have no direct obligations under it.

The European authorities on frontier models

On 31 July EBA, EIOPA and ESMA issued a joint statement on ICT risks from frontier AI models. Financial entities are expected to have robust governance and risk management in place; national supervisors are asked for a consistent cross-sector approach, tied to DORA oversight of critical ICT third-party providers. On 7 July the same authorities had backed the ESRB's warning on systemic cyber risk from these models.

EIOPA's executive director: when a chatbot is distributing insurance

This is the part that reaches intermediaries. In a contribution to Eurofi Magazine, republished on EIOPA's website on 16 September 2026, the authority's Executive Director Damian Jaworski writes that the authority has been asked whether chatbots that collect personal data, filter products or make recommendations are carrying out insurance distribution. If they are, whoever deploys or provides them may have to meet IDD rules on registration, information and conduct.

The piece also flags dark patterns, design choices that steer customers towards products paying higher remuneration, and suggests supervision should look at the whole digital customer journey as well as the product. It is a signed piece, not an official EIOPA position or guidance. The binding reference points remain the IDD and EIOPA's Opinion of 6 August 2025 on AI governance and risk management, addressed to national supervisors, which clarifies how the IDD and Solvency II apply to AI systems that are neither prohibited nor high-risk.

How brokers and agencies actually use AI

The common uses are desk work: reading a vehicle registration document or a company record and filling in the quote, summarising policy wording, drafting a first email. The European picture points the same way. In EIOPA's February 2026 survey of 347 insurers in 25 countries, nearly two-thirds were already using generative AI, mostly for internal tools, and hallucinations (plausible but wrong answers) were the most cited risk.

Customer-facing use is just starting. In the US, Insurify launched an app inside ChatGPT in February to compare car insurance rates, with the purchase completed on its own site. That is the model the EIOPA executive director's piece describes when it calls AI the interface between customers and insurers.

How good is general-purpose AI as an adviser? German rating agency Franke und Bornberg tested ChatGPT on home contents insurance (Hausrat) on 19 March 2026, a test reported by Insurzine in August. The risk profile the chatbot built was fairly plausible. The product it ranked first, though, was the weakest on two decisive clauses, gross negligence and waiver of underinsurance, and it ignored how past claims affect the premium.

For people in this trade the takeaway is practical. AI helps collect the data and set up the comparison; the recommendation stays with the intermediary, who answers for it.

Use by use: which rules to check

This article explains public sources and is not legal advice. Check the original texts linked below before acting on them.