IRDAI's insurance AI working group, underwriting fairness, claims settlement integrity, distribution suitability, and CERT-In cyber reporting — what insurers need to build before the framework lands.
IRDAI convened a dedicated AI governance working group for insurance in June 2026, with IIIT Hyderabad in the chair and representation from ReBIT, CERT-In, SBI Life, Star Health, and ICICI Lombard. [Note: confirm the chair's name, the convener's name, and the exact formation date against IRDAI's official notification before publication.] The working group's brief covers every IRDAI-regulated entity — life, general, and health insurers, and intermediaries — and its recommendations will become the baseline against which every insurer's AI deployment gets measured during the next supervisory cycle.
India's insurance market is not the world's fifth-largest by premium volume. What's true and more interesting than the ranking is the growth rate and the AI intensity: LIC runs AI for lapse prediction and premium forecasting across a policyholder base in the tens of crores; ICICI Lombard's motor claims AI processes volumes no manual team could review line-by-line; Star Health's underwriting AI reads health declarations at a scale where sampling is the only practical fraud control without automation. The working group exists because supervision built for a paper-and-actuary era cannot audit that.
For insurers, the real deadline isn't the working group's report date — it's the gap between today and whenever IRDAI converts its recommendations into a binding circular. Every insurer that waits for the final framework before building an AI inventory will spend that gap in reactive mode. The ones who've sat through an IRDAI onsite inspection know the drill: the examiner doesn't ask whether your AI is good, they ask whether you can produce the file showing you tested it.
Underwriting AI and the Proxy Discrimination Problem Unique to India
Health, motor, and life underwriting AI carries the sector's sharpest fairness exposure, and India's underwriting data has a structural problem that off-the-shelf fairness toolkits don't catch. Pincode, occupation, and prior claims history are standard underwriting features — and in India, pincode correlates with religion and caste composition in ways that a model trained on historical approval patterns can silently absorb. An insurer that hasn't run a proxy-correlation test between its top twenty underwriting features and Census-derived demographic data at the pincode level does not know whether its model discriminates; it only knows that nobody has looked.
Three further obligations sit underneath this. IRDAI's policyholder protection regulations require that declinations be explained in terms a policyholder can act on — a raw model confidence score is not an explanation, and an insurer that hands a customer a probability number instead of a reason is one grievance-cell escalation away from a regulatory finding. Health underwriting models trained on data that includes undisclosed genetic information or conditions the customer never declared at inception create liability under IRDAI's material-fact rules — the fix is data provenance validation against the actual proposal form, not a model-level fairness patch. And AI used for PMJJBY and PMSBY eligibility has to be held to a higher bar than commercial underwriting, because these are universal-coverage schemes: an eligibility model that quietly screens out exactly the population the scheme was built to cover defeats the scheme's purpose even if every individual decision looks defensible in isolation.
Claims AI: Settlement Accuracy, Fraud False Positives, and Repudiation Documentation
Claims is the highest-volume AI deployment in Indian insurance, and it's also where AI failure is most visible to the policyholder — nobody notices a biased underwriting model until they're declined, but everybody notices a lowball settlement. Automated settlement AI needs to be benchmarked against human adjudicator outcomes on a rolling basis, because systematic under-settlement is invisible in aggregate loss-ratio numbers but shows up immediately in a sample audit against the same claims a human would have adjudicated differently.
Fraud detection AI has a less obvious but equally real harm: a model that flags 30% of genuine claims as suspicious while catching 90% of actual fraud is still causing real damage to the 30%, who now face settlement delays for claims that were never fraudulent. False positive rate belongs in the governance pack next to recall, not as an afterthought — and it should be disclosed, because an examiner who finds it buried will assume it was hidden. Cashless claims AI at network hospitals needs clinical validation against the policy's actual medical necessity criteria, not just diagnosis-code pattern matching, because a rejection on a code mismatch that a doctor would call appropriate is a hospitalized customer's worst day made worse.
Repudiation is where documentation discipline matters most. An AI-assisted repudiation file has to name the specific policy clause violated, state the grounds plainly, and tell the customer how to grieve — exactly what IRDAI's repudiation guidelines already require of a human-adjudicated file. If the model's output can't be translated into that four-part structure automatically, the claims team is writing the real repudiation letter by hand anyway, and the AI isn't actually doing the governance-relevant work.
Distribution AI: PoSP Suitability, Bima Sugam Neutrality, and Vernacular Risk
AI-enabled distribution — PoSP recommendation tools, Bima Sugam, and web aggregators — has a built-in conflict of interest that governance has to actively counter. A PoSP recommendation engine optimized for commission rather than customer fit violates the fair practices code regardless of intent, and the only way to catch that in practice is to test whether the model's top recommendation correlates more strongly with payout than with the customer's stated need. Bima Sugam, as IRDAI's unified comparison platform, carries a specific obligation to avoid favoring insurers with better distribution economics — any insurer feeding product data into it should assume IRDAI will eventually audit ranking neutrality and should want to be on the right side of that audit before it happens.
Web aggregators face the same test in reverse: systematically de-ranking insurers they have no commercial relationship with is a disclosure failure, not a neutral algorithm choice. And vernacular AI — chatbots and recommendation engines operating in any of India's twenty-two scheduled languages — needs language-specific accuracy validation, because a mistranslation in a regional-language sales conversation is a mis-selling incident, not a localization bug.
AI Cybersecurity: Why IRDAI Asked About Frontier Threats Before the Framework Existed
IRDAI asking insurers in early 2026 to assess frontier AI cyber exposure — ahead of any formal framework — is the clearest signal available that AI security is a supervisory priority on its own timeline, not something insurers can wait on. Adversarial manipulation of underwriting inputs (gamed documents that shift a risk score) creates adverse-selection exposure that compounds quietly over a book of business. Prompt injection against customer-facing GenAI chatbots can redirect a conversation into unauthorized commitments or, worse, into disclosing another customer's policy data — a DPDP Act incident, not just a chatbot bug. Model extraction against proprietary underwriting models is both an IP loss and, if the extracted parameters retain training-data fingerprints, a personal data exposure.
CERT-In's six-hour reporting clock for cybersecurity incidents applies to AI failures that qualify as incidents, which means an insurer needs a definition in hand before the first incident, not during it. Model poisoning detection, an adversarial attack on claims AI, or a data breach surfaced through model inference all need to map to a pre-agreed incident classification — because figuring out whether something counts as a reportable incident during the six-hour window is how insurers miss the six-hour window.
The working group's mandate explicitly includes AI stress testing, which mirrors the stress-testing language already in RBI's MRMF and the Basel IRRBB framework — except insurance stress testing asks a different question: does underwriting AI produce sound risk assessments when the loss environment (pandemic, catastrophic climate event) looks nothing like the training data? Building that capability now, ahead of a formal requirement, is cheaper than building it under an examination deadline.
What This Means for LIC, Health Insurers, and Conglomerate Groups
LIC's AI governance has a wrinkle private insurers don't face: as a public sector insurer, its AI-driven decisions intersect with RTI obligations and public-sector accountability norms that don't apply to ICICI Lombard or HDFC Ergo. IRDAI's eventual framework will need to address that distinction explicitly rather than applying one governance template to both ownership structures.
Health insurers carry the heaviest AI load in the sector, and India's underlying health data infrastructure is thinner than the AI's appetite for clinical detail — which means training-data representativeness gaps show up unevenly across income and geography, not as a uniform accuracy problem. Star Health's seat on the working group is a direct signal that health underwriting AI governance is a first-wave priority. And for conglomerate groups spanning banking and insurance — SBI, HDFC, ICICI — RBI's MRMF and IRDAI's eventual framework are arriving on parallel but separate tracks; the practical move is a single AI inventory and evidence layer that serves both regulators rather than two duplicate compliance programs built by two different teams.
Action Checklist: Before IRDAI's Framework Becomes Binding
- Run a proxy-correlation audit on underwriting features (pincode, occupation, claims history) against demographic data before a regulator or a plaintiff's lawyer does it for you.
- Rebuild declination and repudiation templates so every AI-assisted output maps to a customer-comprehensible reason and a named policy clause — not a confidence score.
- Disclose fraud AI false-positive rates alongside recall in governance reporting; don't let detection performance hide the cost to genuine claimants.
- Test distribution AI for commission bias — PoSP tools and Bima Sugam feeds both need a ranking-neutrality check you can produce on demand.
- Define what counts as an AI cybersecurity incident now, so the CERT-In six-hour clock doesn't start with a classification argument.
Related Articles
IRDAI-ready AI governance for India insurers — before the framework lands.
Zytra's governance platform builds the AI inventory, fairness assessment, explainability infrastructure, and vendor accountability documentation that India's IRDAI AI framework will require — aligned with RBI FREE-AI and MRMF so financial conglomerates manage both obligations from one platform.
Talk to sales