One AI management system for an insurer
Year:
2026
Service:
AI Governance & EU AI Act
Industry:
Insurance
Team:
4 specialists, 14 weeks (typical)
Reference scenario: an insurer based in Edinburgh with an EU entity builds one ISO/IEC 42001 style AI management system: a model and agent registry, vendor review, release gates and an incident process mapped to UK regulators and the EU AI Act.
Introduction
The scenario: a life and health insurer headquartered in Edinburgh sells into the EU through a subsidiary. It runs pricing and underwriting models, a document pipeline for claims, and two agents that have just moved from pilot to production: one triages claims, one answers policyholders.
The trigger is ordinary. Corporate clients start asking for ISO/IEC 42001 in procurement questionnaires, the risk committee cannot say how many models and agents are live, and the two entities answer to different rulebooks.
The 14-week engagement builds one AI management system for both entities: policy and roles, a registry of models and agents, a vendor review, release gates with evaluation evidence, and an incident process. Controls are enforced in the delivery pipeline, not only described in a policy.
Challenge
The two jurisdictions pull in different directions. The UK has no AI-specific statute and no government AI bill; regulation runs through existing regulators. The FCA's Mills Review of 6 July 2026 recommends no new AI-specific rules, but asks the FCA to clarify how the Consumer Duty and the Senior Managers Regime apply when decisions are distributed across systems and agents. The Bank of England and the PRA said in April 2026 that the existing technology-agnostic framework applies. The reformed UK GDPR rules on automated decision-making (Articles 22A to 22D) have been in force since 5 February 2026, with updated ICO guidance expected in winter 2026.
The EU entity faces a statute with dates. Article 50 transparency has applied since 2 August 2026, high-risk obligations for Annex III systems follow on 2 December 2027, and DORA has applied since 17 January 2025.
Inside the firm the gaps are the usual ones: policies with no technical enforcement, both agents running under one shared service account, evaluation done once at launch, and no single list of models, vendors and owners.
Solution
The management system rests on three principles.
One system, two mappings. A single management system on the ISO/IEC 42001 structure, with each control mapped twice: to UK expectations (Consumer Duty, Senior Managers Regime, UK GDPR automated decision-making) and to the EU AI Act and DORA.
Enforce in the pipeline. No model or agent is released without a registry entry, a named accountable owner, evaluation evidence and an approved risk tier. The gate is code, not a form.
Certification follows, it does not lead. ISO/IEC 42001 does not give presumption of conformity under the AI Act. EN 18286 is the quality management standard written for that purpose, and its Official Journal citation is still pending. The system is designed for real control first and audit readiness second.
What is built in the scenario:
AI policy, risk process and role map, with an accountable senior manager for each system
A registry of models, agents, datasets and vendors, linked to deployed versions
Vendor review: GPAI Code of Practice signatory status, ISO/IEC 42001 certificates from bodies accredited against ISO/IEC 42006, data residency, DORA third-party records
A unique SPIFFE/SPIRE identity for each agent, and least-privilege tool access through an MCP gateway with central access control and full action logs
Pre-release evaluation and adversarial testing with Garak, and MLflow tracing in production
Impact assessments following ISO/IEC 42005, including pricing and underwriting models assessed against Annex III
An incident register and playbook aligned to AI Act serious-incident reporting and to DORA, with one clock and one owner
Result
Week 14 closes with an internal audit against ISO/IEC 42001 and a management review, not with a certificate. Operating measures are set as targets:
Target: 100 percent of production agents with a unique identity and scoped permissions
Target: evaluation evidence attached to every release of a model or agent
Target: mean time to detect and contain an agent incident measured from day one and reviewed each quarter
Acceptance criterion: for any system the registry shows who owns it, which vendor is behind it, what it may do and how it was last tested
The insurer owns the policy set, the registry, the release gates as code, the vendor review pack, the evaluation suites, the incident playbook and the control mapping for both jurisdictions. If it later chooses certification, our advice is to use a certification body accredited against ISO/IEC 42006.
The regulatory mapping in this scenario is information, not legal advice, and reflects the position on 2 October 2026.
