IRDAI AI Governance for Insurance Companies: India's First Insurance AI Framework 2026

On June 17, 2026, IRDAI issued an Office Order constituting a seven-member Working Group on Artificial Intelligence. The group's mandate: map the state of AI adoption across India's insurance sector, evaluate global regulatory approaches, and propose India's first formal AI governance framework for insurers. It has three months to deliver.

The working group is chaired by Prof. Sandeep K. Shukla, Director of IIIT Hyderabad, with members drawn from ReBIT, CERT-In, SBI Life Insurer, Star Health, ICICI Lombard, and IRDAI itself. The composition is deliberate — it brings together cyber security expertise (ReBIT, CERT-In), actuarial and data expertise from major life and health insurers, and the regulator's own oversight function.

Three months is a short window. Insurers that wait for the final framework will have weeks, not quarters, to build governance infrastructure. Those that align to RBI MRMF, FREE-AI, and DPDP Act obligations now — which the IRDAI framework is expected to closely parallel — will have most of the work done before the ink is dry.

Why Insurance AI Governance Is Different

Insurance AI operates on two axes that make governance distinctly complex. First, the stakes per decision are high: a claims approval AI that incorrectly rejects a legitimate claim causes direct financial harm to a vulnerable policyholder, often at a moment of acute need (illness, accident, death). Second, the data inputs are among the most sensitive in the economy — health records, lifestyle data, financial history, and in some products, genetic and biometric data.

These two axes produce three failure modes that IRDAI's framework is expected to address directly.

Discriminatory underwriting. Underwriting AI trained on historical claims data can encode historical exclusion. Geographic proxies — a pincode that correlates with income, caste, or occupation — can function as indirect discriminatory features. A model trained to predict claims frequency may have learned that rural populations or certain communities are higher-risk because they were historically underserved by the health system, not because they are intrinsically higher risk. The output of a biased underwriting model is a premium schedule that perpetuates financial exclusion.

Opaque claims decisions. When a claims automation system rejects a policyholder's claim, the policyholder has a right to understand why. An insurer that says "the model said no" and cannot explain the decision in terms the policyholder can understand is, under the DPDP Act and the emerging IRDAI framework, failing its obligations. Explainability for claims AI is not optional — it is the basis on which a policyholder can exercise their right to a human review.

Chatbot mis-selling. Insurance chatbots that provide product recommendations or policy guidance are providing financial advice. If the chatbot's recommendation is incorrect — based on a hallucination, an outdated policy document, or a misconfiguration — the insurer bears the mis-selling liability. This is a new and largely ungoverned risk category that IRDAI's working group has specifically flagged.

The Five AI Use Cases IRDAI Will Govern First

Based on the Working Group's stated scope — claims processing, fraud detection, underwriting, ethical AI, and explainable AI — five use cases will be in the first wave of IRDAI AI governance obligations.

1. Claims Automation and Cashless Processing

Health insurance cashless claims processing is now substantially automated at India's large insurers and third-party administrators (TPAs). An AI system scores each claim against the policy terms, hospital network status, pre-authorisation criteria, and historical claims data, and returns an approve/reject/query decision. At scale, these systems process lakhs of claims monthly.

Governance requirements: model documentation covering the features, training data, and decision logic; output explainability at the individual claim level; false positive and false negative rate monitoring; quarterly bias testing across demographic segments; and a documented human-review pathway for all rejected claims above a threshold amount.

2. Underwriting and Premium Pricing AI

Life and health insurers use AI to price premiums — incorporating age, medical history, occupation, location, and increasingly wearable and lifestyle data from health apps and telematics devices. Models that predict mortality, morbidity, and claims frequency determine whether a customer can get insurance and at what cost.

Governance requirements: DPDP Act consent management for sensitive health data inputs; data minimisation validation (is the model using more data than necessary?); demographic fairness testing for premium distributions across rural/urban, gender, and health status segments; model documentation for actuarial review; and independent validation of the premium pricing logic by a team independent of the model development team.

3. Insurance Fraud Detection

Fraud detection models score claims, applications, and transactions for fraud indicators. False positives — legitimate claims flagged as fraudulent — are a significant harm to policyholders. False negatives — fraudulent claims approved — are a financial harm to the insurer and ultimately to the premium-paying customer base. Both error types need to be monitored and reported.

Governance requirements: separate model performance metrics for false positive and false negative rates; demographic analysis of false positive rates (are certain customer segments being disproportionately flagged?); audit trail for every claim flagged and its outcome; and a documented escalation pathway for fraud decisions that affect a customer's ability to make future claims.

4. Policy Recommendation and Distribution AI

Recommendation engines used in online policy sales — whether on insurer platforms or insurance aggregators — suggest products based on customer profile data. When these engines are not governed, they can optimise for commission rather than customer need, recommend higher-premium products to customers with limited financial literacy, or exclude products from view for certain demographic segments.

Governance requirements: documentation of the optimisation objective (what is the model maximising?); audit of whether recommendations align with customer need; DPDP Act compliance for customer profile data used in recommendations; and periodic testing for recommendation bias across income, age, and geographic segments.

5. Chatbots and AI-Assisted Customer Service

Insurance chatbots handle policy queries, claims status, renewal reminders, and in some deployments, first-notice-of-loss (FNOL) for claims. When a chatbot provides incorrect policy information — for example, stating that a condition is covered when it is not, or giving incorrect premium information — the insurer's liability exposure depends on what governance exists over the chatbot's outputs.

Governance requirements: hallucination detection and guardrails at the output layer; policy document version control (the chatbot must reference the current version of the policy); escalation to human agents for complex queries; logging of all chatbot interactions for audit review; and explicit disclosure to the customer that they are speaking with an AI system.

Which Insurers Are Most Exposed

All IRDAI-regulated entities are in scope. But exposure varies by AI deployment depth and customer impact scale.

Standalone health insurers face the highest exposure: Star Health, Niva Bupa (formerly Max Bupa), Care Health, and Aditya Birla Health have the most automated claims pipelines and process the most sensitive data — health records. Their claims AI decisions directly affect whether policyholders receive treatment. Two of the four (Star Health, ICICI Lombard) are represented on the IRDAI Working Group, which signals that the framework will be informed by their current practices.

Large life insurers — LIC, SBI Life, HDFC Life, ICICI Prudential Life, Bajaj Allianz Life, Max Life — face exposure primarily in underwriting AI, premium pricing models, and the growing use of AI in surrender value prediction and policyholder churn prevention. LIC alone covers 300+ million policyholders; any systematic bias in its underwriting or claims AI has population-level impact.

General insurers — New India Assurance, United India, ICICI Lombard, Bajaj Allianz General, HDFC Ergo — face exposure in motor claims AI (the largest volume use case), where automated damage assessment from photographs is already deployed, and in commercial lines fraud detection.

How IRDAI Framework Will Align with RBI MRMF and FREE-AI

The IRDAI Working Group includes ReBIT — the technology arm that underpins the RBI's own technology governance frameworks, including MRMF. This structural connection makes it highly likely that IRDAI's framework will parallel RBI MRMF in its core obligations.

Five Steps to Build Before IRDAI Publishes

The working group's three-month clock started in June 2026. By September 2026, IRDAI will have draft recommendations. Insurers that complete these five steps in the interim will be structurally prepared.

Step 1: AI inventory. Map every AI and ML model used in material decisions — claims, underwriting, fraud, recommendation, chatbot. Document purpose, data inputs, output actions, and who owns the model. This is the foundation for everything else; IRDAI will ask for it first.

Step 2: Risk tier the inventory. Not every model carries the same risk. Claims approval AI that denies policyholders' requests is Critical tier. A model that predicts renewal probability for marketing campaigns is Low tier. Tier the inventory using a consistent framework — impact × likelihood — and prioritise governance investment accordingly.

Step 3: DPDP Act gap analysis. For each high-risk AI system, document the personal data being processed, the legal basis, and whether consent architecture supports purpose limitation and withdrawal. Health and biometric data inputs are Sensitive Personal Data under DPDP and require explicit consent.

Step 4: Establish bias monitoring for claims and underwriting. Begin quarterly analysis of claims rejection rates and premium levels across demographic segments. A demographic disparity that exists in the data today will be discoverable by IRDAI when the framework requires it to be reported. Finding and addressing it proactively is better than discovering it in a regulatory inspection.

Step 5: Document the human-review pathway. For every AI system that makes a decision that affects a policyholder — claims, underwriting, fraud flag — document how a policyholder can request a human review. This pathway is both a DPDP Act obligation (right to review automated decisions) and an expected IRDAI requirement. It must exist before the framework requires it, because building it after a regulatory finding is a compliance failure, not a compliance action.

The Zytra Approach for Insurance AI Governance

Zytra's AI governance platform deploys in an insurer's own VPC or on-premises environment — no patient data or claims data leaves the insurer's boundary. The platform covers the expected IRDAI requirements directly:

• Aval guardrails — real-time output monitoring for claims chatbots, covering hallucination, mis-selling, incorrect coverage statements, and escalation triggers at 0.5% false-positive rate
• Prism governance workflows — model inventory, risk tiering, independent validation workflows, and DPDP consent gap analysis mapped to the expected IRDAI framework structure
• INDIC-BIAS testing — demographic fairness analysis for claims approval, underwriting premium, and fraud scoring models across India-specific population segments
• Audit trail export — tamper-evident, hash-chained evidence packs exportable as PDF or OSCAL for IRDAI review
• DPDP compliance module — consent registry, purpose-limitation monitoring, and automated decision transparency for IRDAI-regulated entities