India InsurTech AI Governance 2026: IRDAI Regulatory Sandbox and AI Obligations

India's InsurTech sector operates in a distinctive regulatory environment: 150+ active companies, the world's second-largest insurance regulatory sandbox, and a market growing at 15%+ annually with AI as the primary growth driver. Unlike banking AI governance — where RBI's FREE-AI Framework (August 2025) and MRMF (June 2026) provide explicit and detailed obligations — IRDAI's AI governance framework is still being constructed in real time. The IRDAI Working Group on AI (constituted June 19, 2026) has not yet published its recommendations. The April 2026 cybersecurity guidelines are binding now. The result is a regulatory environment where obligations are partially visible, partially inferred, and significantly different for sandbox InsurTechs versus licensed insurers.

This analysis maps those two tracks — and explains why the governance gap between sandbox operation and permanent approval is a compliance risk that must be managed now, not at sandbox exit.

India's InsurTech AI Landscape

Five Primary AI Use Cases in Indian InsurTech

India's InsurTech ecosystem deploys AI across five primary workflow categories, each with distinct governance implications:

• Underwriting AI: parametric insurance pricing (crop, weather, event), risk scoring for SME commercial lines, health underwriting AI using wearable data and medical history analysis
• Claims processing AI: document verification, fraud detection, automated claims triage, image recognition for motor claims damage assessment
• Distribution AI: customer matching and product recommendation, digital sales funnel optimization, persistency prediction (policy lapse AI)
• Telematics and IoT AI: vehicle behavior scoring for motor insurance, health monitoring integration for life and health policies
• Customer service AI: claims status chatbots, policy explanation AI, grievance resolution AI

The governance intensity is highest in underwriting and claims — where AI decisions directly affect policyholder rights and obligations — and lower in customer service, where AI decisions are primarily informational. IRDAI's Working Group AI is expected to formalize this risk tiering in its Q4 2026 recommendations.

IRDAI Regulatory Sandbox: Who Operates Under It

The IRDAI Regulatory Sandbox, launched in 2019, permits InsurTechs to test innovative products and processes under relaxed regulatory requirements for a defined period. Key operational features:

• Sandbox entities can test products not permissible under standard IRDAI regulations
• Policyholder protections apply throughout sandbox operation — they are not relaxed
• Sandbox authorization is time-limited (12 months, extendable on application)
• Successful sandbox products can be granted permanent regulatory approval

The AI governance complication arises from a regulatory drafting gap. The IRDAI AI Working Group recommendations (expected Q4 2026 after the September deadline) and the April 2026 cybersecurity guidelines were issued primarily for licensed insurers. Sandbox entities occupy an ambiguous position — they are regulated under the Regulatory Sandbox guidelines, subject to policyholder protection requirements, but not fully subject to standard IRDAI regulations. Whether the AI governance obligations issued for licensed insurers apply to sandbox entities is not yet explicitly clarified by IRDAI.

Two-Track Obligations: Licensed Insurers vs. Sandbox InsurTechs

Track 1 — Licensed Insurers

Licensed insurers face binding and anticipated obligations across three regulatory instruments:

Track 2 — Sandbox InsurTechs

Sandbox InsurTechs face a different obligation profile — not zero obligations, but obligations that flow from sources other than the primary IRDAI AI governance instruments:

• Policyholder protection provisions: AI that affects policyholder rights — claims decisions, coverage determination — faces implicit fairness and explainability obligations under the IRDA(Protection of Policyholders' Interests) Regulations 2024. AI-driven claims denial must be explainable and reversible under ombudsman review.
• DPDP Act (unconditional): DPDP Act applies to all entities processing personal data of Indian residents. Sandbox authorization from IRDAI provides zero exemption from DPDP consent, DPIA, and data principal rights obligations. InsurTechs processing health data — a special category under the DPDP Act — require explicit consent for underwriting use, ongoing monitoring use, and model training use.
• Sandbox exit requirements: Sandbox products moving to permanent approval must satisfy standard regulations as of the exit date. Any AI governance gap created during sandbox operation becomes a remediation obligation before permanent approval. Building WG-AI-aligned governance during sandbox operation eliminates this cost.
• CERT-In registration: InsurTechs processing personal data must register with CERT-In. AI system compromise — model poisoning, unauthorized model access, adversarial input events — is a CERT-In reportable incident.

AI-Specific Governance for Each InsurTech AI Use Case

Underwriting AI Governance

Parametric insurance AI models require documentation of how triggers are determined, validation against independent data sources (such as India Meteorological Department weather data for crop parametric products), and testing for basis risk — the difference between the trigger event and the actual loss. Basis risk in parametric models is a known policyholder harm: a trigger does not fire despite an actual loss, or fires without one. The AI governance obligation is to quantify and disclose basis risk, not to eliminate it.

Anti-discrimination in underwriting is an explicit IRDAI obligation. AI models that use occupation, region, or name as features may violate this even without discriminatory intent — proxy discrimination testing is required. An AI model that learns to use postal code as a proxy for caste or religion would violate IRDAI's anti-discrimination provisions regardless of the developer's intent.

Health data AI for underwriting requires explicit DPDP consent for health data processing. Under the DPDP Act, health data is a special category requiring heightened consent specificity — consent for underwriting use does not extend to ongoing health monitoring use or model training use without separate consent.

Claims AI Governance

Claims decision explainability is both a customer service obligation and a legal defense requirement. Insurance Ombudsman complaints increasingly challenge AI-assisted claims denial. An AI system that cannot produce a comprehensible explanation for a claims decision — what factors drove it, how they were weighted, what the policyholder can do — will fail ombudsman review and IRDAI examination. This is the highest-priority AI governance obligation for claims-processing InsurTechs.

Computer vision models for motor claims damage assessment must be validated against ground truth regularly. Surveyor assessment data is the appropriate validation set. Model drift in image classification directly affects claims payouts — a model that systematically underestimates damage categories increases claims denial rates and creates both financial harm and regulatory exposure.

Claims fraud AI with high false-positive rates is more regulated than credit fraud AI. Insurance claims denial has direct policyholder harm consequences equivalent to adverse credit decisions. A fraud detection model that flags 20% of legitimate claims as suspicious is not an AI governance success story regardless of its true-positive rate on actual fraud — the false-positive cost falls on policyholders with legitimate claims.

Distribution AI Governance

Product recommendation AI must satisfy IRDAI's suitability requirements. An AI that recommends high-premium products to customers whose risk profile would be adequately served by lower-cost products violates suitability obligations. Suitability AI governance requires documentation of the recommendation rationale, not just the recommendation output.

Persistency AI — models predicting which customers will lapse — must not be used to design manipulative retention practices. Identifying lapse-risk customers is a legitimate business function. Using lapse-risk predictions to design retention communications that obscure policy terms, misrepresent benefits, or apply pressure tactics is an IRDAI fair practices violation. The AI governance boundary is: prediction is permitted, manipulation is not.

IRDAI WG-AI Implications for InsurTech

IRDAI's Working Group on AI was constituted June 19, 2026, chaired by Professor Sandeep Shukla of IIIT Hyderabad, with members from ReBIT and CERT-In. The three-month mandate covers AI adoption assessment across the insurance sector, an ethical AI framework for underwriting and claims, cybersecurity standards for insurance AI, stress testing and audit frameworks, and DPDP Act compliance for insurance AI.

WG-AI recommendations, expected Q4 2026, will likely:

1. Classify insurance AI use cases by risk tier — underwriting and claims denial as high-risk, distribution as medium-risk, customer service AI as lower-risk
2. Require independent validation for high-risk AI — underwriting models and claims denial models, analogous to RBI's MRMF independent validation requirement for high-tier banking AI
3. Establish explainability standards for consumer-facing AI decisions — the practical ombudsman-response standard is the expected baseline
4. Address DPDP Act intersection for health data AI — likely requiring specific consent architecture for health-data-driven underwriting models

InsurTechs should anticipate that WG-AI recommendations, when converted to IRDAI circular, will apply to sandbox entities either directly or through sandbox exit requirements. The window to build WG-AI-aligned governance is now — during active sandbox operation — not at exit, when production systems are already live and remediation requires downtime.

Five Controls InsurTech AI Governance Programs Must Build

1. AI Model Inventory for Sandbox

Catalog all AI in policyholder-affecting workflows — underwriting, claims, customer communications. The inventory must include model purpose, data inputs, output type, accountable owner, last validation date, and current deployment status. This is the foundation for all other governance controls and for demonstrating governance maturity at sandbox exit. Map to IRDAI risk tier when WG-AI publishes classification.

2. Claims AI Explainability Stack

Implement explanation capability for all AI-assisted claims decisions before production deployment. Required for three purposes: Insurance Ombudsman response (the immediate practical requirement), IRDAI examination (the regulatory requirement), and DPDP Act right-to-explanation compliance (the data protection requirement). An explanation capability retrofit after production deployment is significantly more costly than building it into the model pipeline from the start.

3. DPDP Consent Architecture for Health Data

Separate consent for health data AI processing across three distinct uses: underwriting (one-time assessment), ongoing health monitoring (continuous), and model training (aggregated learning). Each requires distinct consent, and each requires an erasure-capable data pipeline — a policyholder exercising the right to erasure must be removable from underwriting data, monitoring data, and training datasets independently. Build erasure capability into the data architecture now; retrofitting it after scale-up is the DPDP compliance nightmare scenario.

4. Sandbox-to-Licensed Transition Checklist

Map current AI governance against anticipated WG-AI requirements. Identify gaps before sandbox exit — the time to close governance gaps is during sandbox operation, when the AI systems are under development and governance controls can be built in, not at exit when systems are in production. IRDAI has historically required applicants for permanent approval to demonstrate governance maturity. A checklist built now becomes the evidence package for the permanent approval application.

5. CERT-In Registration and AI Incident Playbook

Register with CERT-In as required for entities processing personal data. Build an AI-specific incident response playbook that covers model poisoning, unauthorized model access, adversarial input events, and claims fraud AI bypass. CERT-In 6-hour reporting applies to AI system compromises — an InsurTech discovering that its claims fraud detection AI has been bypassed through adversarial input must report within 6 hours. A playbook that enables this reporting timeline requires preparation before incidents occur.

Frequently Asked Questions