EU AI Act and insurance: what changed between July and September 2026

The short version

• High-risk rules for Annex III systems, which include risk assessment and pricing in life and health insurance, now apply from 2 December 2027 instead of 2 August 2026.
• Article 50 has applied since 2 August 2026: people talking to a chatbot must be told it is an AI system.
• In Italy, since 30 September 2026, anyone harmed by an AI system can sue the liability insurer of the person responsible directly (Legislative Decree 160/2026, art. 20).
• The AI literacy duty (art. 4) stays, reworded: firms must take measures, but no longer guarantee a «sufficient» level for every person.

The Digital Omnibus moves high-risk obligations to 2 December 2027

The Council gave its final approval on 29 June. The text became Regulation (EU) 2026/1744 of 8 July 2026, published in the Official Journal on 24 July and in force since 27 July. For stand-alone high-risk systems listed in Annex III of the AI Act, the application date moves from 2 August 2026 to 2 December 2027. Systems embedded in products covered by Annex I legislation get until 2 August 2028.

For insurance the relevant entry is Annex III, point 5(c): AI used for risk assessment and pricing of natural persons in life and health insurance. These systems are still high-risk and still need risk management, technical documentation, logging and human oversight. The Omnibus changed the date and left the list alone.

Most intermediaries meet this through an insurer's rating engine, which remains the insurer's system. A broker that builds, or commissions, its own model to score individuals for life or health cover is in a different position and should read the Annex III requirements now. A little over a year is not long to document a model to that standard.

What already applies: chatbot disclosure and AI literacy

Article 50 kept its date. Since 2 August 2026, systems that interact with people must be designed so that users know they are dealing with AI, unless that is obvious from the context. The duty sits with the provider. If a brokerage runs an assistant on its website or on WhatsApp, the question for the vendor is specific: where does the notice appear, and what does it say?

There is a short extension for synthetic content. Generative systems placed on the market before 2 August 2026 have until 2 December 2026 to meet the machine-readable marking duty in Article 50(2).

Article 4 on AI literacy has applied since 2 February 2025. The Omnibus reworded it: providers and deployers must take measures to train the people using their systems, but are no longer required to ensure a «sufficient» level for each of them. A short, documented training session for staff who use AI tools is still the easiest evidence to keep on file.

Italy's Decree 160/2026: direct action against the insurer for AI harm

For anyone selling liability cover in Italy this is the change that matters most. Legislative Decree no. 160 of 9 September 2026, published in Official Gazette no. 214 on 15 September and in force since 30 September, implements the AI delegation in Law 132/2025. Title II, Chapter II gives claimants new procedural tools when they seek compensation for harm caused by the use of an AI system, in contract or in tort.

• Art. 17: courts can order disclosure of evidence on how the system worked, including the logs required by art. 12 of the AI Act, risk-management records, technical documentation and human-oversight settings. If a party fails to disclose without good reason, the court may draw inferences; where the missing material is that AI Act documentation, the court, having weighed the other evidence, treats the facts alleged by the requesting party as admitted (para. 5).
• Art. 18: where the harm results from a breach of an AI Act obligation, causation is presumed unless proven otherwise.
• Art. 19: compliance with the AI Act, even when certified, does not by itself rule out liability.
• Art. 20: the injured party has a direct action against the defendant's liability insurer, up to the sum insured. Before suing, they can ask the alleged wrongdoer whether a liability policy covers the loss; the answer, with policy details and insurer name, is due within thirty days. The request is not a precondition for suing; a missing or incomplete answer lets the court draw inferences (art. 116 of the Code of Civil Procedure).

For brokers this turns into client work. The thirty-day request will land on policyholders, who will forward it to their broker, so you need to know quickly whether a client's general or professional liability policy responds to AI-related harm and what it excludes. Policy defences can only be raised against the claimant if they predate the loss (para. 3), and an insurer that pays can recover from its policyholder where it could have refused or reduced cover (para. 4). Software and AI wording in liability policies becomes something to explain before the client signs.

The decree also adds art. 25-vicies to Legislative Decree 231/2001, Italy's corporate criminal liability law. Companies can now be liable for two AI offences: failing to adopt safety measures for high-risk systems (new art. 437-bis of the Criminal Code) and unlawful distribution of AI-generated or altered content (art. 612-quater). Firms with a 231 compliance model need to update their risk map.

Dates to keep

Four checks for a brokerage before year end

• List the AI tools in use, with vendor and the data that flows through them: writing assistants, call transcription, document reading, chatbots.
• For every client-facing chatbot, check the AI notice and what the bot is allowed to say about products and prices. EIOPA's executive director has just weighed in on the second point, in a piece for Eurofi Magazine, covered in EIOPA and IVASS on AI.
• Write down who received AI training, when, and with which material.
• Review the liability policies of clients who use AI at work, such as professional firms and SMEs: exclusions, definitions of loss, limits. Draft a standard reply to the thirty-day request.

This article explains public sources and is not legal advice. Check the original texts linked below before acting on them.