← Vetro Attest · Free Art. 12/14 checker · Free EU AI Act tools

EU AI Act for life and health underwriting

*Engineering guidance, not legal advice. Your legal team decides how the Act applies to your products.*

Where this sector lands

Annex III point 5(c) covers AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance. The scope is narrower than it looks, and precision matters:

• In scope: underwriting assistants that read medical questionnaires or attending physician statements and propose a rating, models that set premiums or exclusions for an individual, agents that decide whether to refer or decline.
• Usually outside 5(c): claims handling, fraud detection and non-life lines such as motor or home, unless another Annex III point applies. Classification depends on intended purpose. The broader picture is on the insurtech page.

Deployers of 5(c) systems must carry out a fundamental rights impact assessment before first use (Art. 27), even as private companies. Pricing on health data is where discrimination concerns concentrate.

The logging duties that follow

• Art. 12 (providers): the underwriting system automatically records events, so each rating can be traced to the evidence it used.
• Art. 19 (providers): keep logs under your control for at least six months.
• Art. 26 (deployers), the insurer: competent human oversight by underwriters (Art. 26(2)), logs kept for at least six months (Art. 26(6)), and informing applicants that a high-risk system is used in decisions about them (Art. 26(11)). Insurers subject to internal-governance rules under EU financial services law may keep these logs as part of that documentation.

Life policies last decades, and disputes about non-disclosure surface at claim time. Six months is a floor; the useful retention is the life of the policy. Applicants can also ask for an explanation of the system's role (Art. 86).

On timing: the Digital Omnibus agreement moves Annex III high-risk obligations to December 2027 (details and caveats).

What counts as evidence

Years later, at claim time, the question will be what the underwriter knew and what the system recommended when the policy was written.

Abbreviated ledger excerpt (prev, hash and sig omitted):

{"seq":1,"type":"tool.call","data":{"name":"extract_questionnaire","input":{"application":"LIF-448193","sections":["cardio","lifestyle"]}}}
{"seq":2,"type":"tool.result","data":{"name":"extract_questionnaire","output":{"bp_treated":true,"smoker":false}}}
{"seq":3,"type":"tool.result","data":{"name":"rating_engine","output":{"loading_pct":50,"basis":["bp_treated"],"manual":"UW-2026.2"}}}
{"seq":4,"type":"tool.call","data":{"name":"underwriter_sign_off","input":{"uw":"uw_031","final_loading_pct":25}}}

The underwriter's deviation from the engine is recorded, not overwritten.

How Vetro Attest fits

Vetro Attest accepts an OpenTelemetry GenAI trace (OTLP/JSON) or a native Vetro ledger, with nothing to install. Verification is free. For 49 USD per ledger, one-off:

• a full EU AI Act report (Markdown and HTML) mapping the run onto the logging obligations, with an explicit list of what the log cannot show;
• an ed25519 countersignature over the ledger digest, event count and timestamp, verifiable by anyone with our published public key.

A practical pattern: countersign each underwriting run at issue, and keep the attestation with the policy file for its lifetime. Redact health data before export; the attestation itself covers only a digest.

Limits, stated plainly: the countersignature proves the log verified clean at a time, not that the rating was actuarially justified or non-discriminatory. The report supports a compliance conversation; it is not a conformity assessment. Paid ledgers are deleted after 7 days, and the report and attestation are emailed to you to keep.

Next steps

• Run the free EU AI Act Art. 12/14 checker against your current setup.
• Verify a trace free, then get the countersigned report for 49 USD.
• Compare approaches: vs. WORM storage, vs. signing your own logs.

See a sample ledger verified in one click, check your own logs free or get the countersigned EU AI Act report.