What AI governance obligations does IRDAI's Regulatory Sandbox Regulations 2025 create for insurers and InsurTechs deploying AI?

IRDAI (Regulatory Sandbox) Regulations 2025 — notified January 3, 2025, replacing the 2019 sandbox regulations — create a mandatory pre-market approval framework for innovative insurance technology, explicitly covering AI/ML applications in insurance. The IRDAI InsurTech Working Group identified AI/ML in underwriting, wearables in health and life insurance, telematics/IoT in motor, and chatbot/voicebot claims handling as the primary technology use cases under sandbox governance. Five AI governance obligations: (1) Mandatory IRDAI pre-deployment sanction: entities cannot deploy AI/ML tools in a live insurance context without first obtaining IRDAI's sandbox sanction. This pre-market approval requirement means no 'ship and disclose later' approach for AI insurance products — the AI tool must be reviewed and approved before any policyholder interaction. The sanction covers the scope of AI use (which insurance functions, which customer segments, which risk classes); (2) Policyholder protection obligation during AI experimentation: sandbox participants must demonstrate throughout the sandbox period that AI-driven underwriting, claims assessment, or advisory outputs maintain policyholders' interests. IRDAI has explicit authority to suspend or terminate sandbox participation if policyholder harm risk materializes — creating an ongoing monitoring obligation throughout the AI deployment trial; (3) Data compliance obligation: participants are solely responsible for compliance with data protection law (DPDP Act 2023), policyholder consent requirements, and data security throughout the AI experimentation period. Consent obtained for sandbox AI testing may have different scope than consent for full production deployment; (4) Monitoring and reporting throughout sandbox period: active progress reporting to IRDAI throughout the sandbox period is required. AI models cannot be materially changed after sandbox sanction without fresh IRDAI notification — a significant constraint on iterative AI model development in insurance; (5) Non-transferable sole entity liability: the insurer or InsurTech, not the AI vendor, bears all regulatory and consumer liability arising from AI-driven insurance outcomes during and after the sandbox period. Sandbox status does not create regulatory immunity for AI failures.

Which AI insurance use cases require IRDAI Regulatory Sandbox approval before deployment?

The IRDAI InsurTech Working Group and the 2025 Sandbox Regulations identify five AI insurance application categories as primary sandbox use cases: (1) AI/ML in underwriting: algorithmic underwriting that uses machine learning models to assess risk, price policies, or determine insurability without traditional manual underwriter review. This includes LLM-based automated risk assessment, AI-driven health underwriting using medical records or wearable data, and ML-based commercial property risk scoring; (2) AI in telematics-based motor insurance: AI models that process GPS, accelerometer, and driving behaviour data to generate PAYD/PHYD scores and premium adjustments — the same AI governance already addressed in the IRDAI Motor Insurance AI Telematics 2024 post, but here in the context of new experimental telematics models requiring sandbox approval before deployment; (3) AI in wearables-based health and life insurance: AI models that process continuous health monitoring data from wearables (heart rate, sleep data, activity levels, blood glucose) to dynamically adjust health or life insurance premiums or coverage terms. These models are classified as innovative because wearable-based underwriting has no established Indian insurance actuarial precedent; (4) Chatbot and voicebot AI in claims: AI conversational systems that handle first notice of loss, claims triage, document collection, and preliminary claims assessment. An AI chatbot that advises a policyholder on claim eligibility or settlement amount is providing insurance advisory functionality — sandbox approval required; (5) AI in embedded insurance: AI models that assess insurance eligibility and pricing within non-insurance customer journeys — a fintech payment app that offers embedded travel insurance based on AI risk assessment of the trip booking data. The AI insurance function embedded in a non-insurance platform requires sandbox sanction.

How does IRDAI's regulatory sandbox create a unique AI governance pathway in Indian insurance compared to global insurance AI regulation?

IRDAI's mandatory pre-deployment approval framework for AI insurance tools is a unique regulatory architecture with no close parallel in major insurance regulatory frameworks globally. Four distinguishing characteristics: (1) Mandatory approval (not notification): IRDAI's sandbox requires affirmative pre-deployment sanction — the regulator must approve before deployment. The EU AI Act's insurance-related provisions (AI Act applies to high-risk AI in insurance under Annex III) require conformity assessment and registration, but deployment is not paused pending regulator approval. IRDAI's prior-approval requirement is more similar to new product approval in the pharmaceutical sector than to typical AI compliance frameworks; (2) Policyholder harm as real-time suspension trigger: IRDAI's explicit authority to suspend sandbox participation when policyholder harm risk materializes creates a regulatory exit mechanism specific to AI deployment risk. No US (NAIC), UK (FCA), or EU (EIOPA) insurance regulatory framework has an equivalent provision that specifically links AI trial suspension to policyholder protection; (3) Immutability after approval: the prohibition on materially changing the AI model post-sanction without fresh notification reflects IRDAI's recognition that AI model changes can fundamentally alter the risk profile of the insurance product — a re-trained ML underwriting model with different feature weights is effectively a different underwriting product. This is an operationally stringent constraint that forces insurers to version-lock AI models during the sandbox period; (4) Gateway for production: successful sandbox completion is the pathway through which genuinely novel AI insurance applications reach India's 55 crore+ insurance policy market. The 2025 regulations' broader scope and streamlined process compared to the 2019 regulations reflects IRDAI's intent to enable AI innovation while maintaining pre-deployment governance — a distinctly different regulatory philosophy from the EU's post-deployment compliance model.

What does the IRDAI Regulatory Sandbox 2025 require in terms of AI documentation and regulatory submission for InsurTech applicants?

InsurTechs and insurers seeking sandbox approval for AI insurance tools must prepare comprehensive regulatory documentation covering the AI model's characteristics, governance structure, and policyholder protection measures. Key documentation requirements: (1) AI model description and scope: technical description of the AI tool's function, inputs (data sources, data types), outputs (decisions, recommendations, pricing), and the insurance functions it affects. The scope must be specific — 'AI underwriting system' is insufficient; the scope must specify risk classes, customer segments, policy types, and geographic coverage; (2) Data governance and consent framework: documentation of policyholder data used by the AI model, the consent architecture for data collection and AI processing, DPDP Act compliance mapping, and data security controls. For wearable-based AI, the continuous health data collection consent structure requires specific documentation; (3) Policyholder protection measures: how the AI model ensures policyholders are not unfairly discriminated against, how AI decisions are communicated to policyholders, and what recourse policyholders have if they disagree with AI-generated outcomes; (4) Model accuracy and bias assessment: actuarial or technical validation evidence that the AI model performs accurately across the intended risk segments, with bias assessment for protected characteristics (age, gender for life and health insurance, where IRDAI's anti-discrimination provisions apply); (5) Change management: process for notifying IRDAI of material model changes; what constitutes a material change (change in training data, feature set changes, significant accuracy drift) must be defined upfront in the sandbox application; (6) Exit plan: plan for transitioning from sandbox to full production, or for withdrawing the AI product and remedying policyholder outcomes if the sandbox is terminated.

AI Governance · IRDAI · Regulatory Sandbox · InsurTech · AI Pre-Approval · India BFSI

IRDAI Regulatory Sandbox Regulations 2025 AI Governance: Mandatory Pre-Deployment IRDAI Approval for AI/ML Insurance Tools, Policyholder Protection Obligation During AI Experimentation and Sole Entity Liability for AI Outcomes for Insurers and InsurTechs India

IRDAI (Regulatory Sandbox) Regulations 2025 — notified January 3, 2025, replacing the 2019 sandbox regulations — create a mandatory pre-market approval framework for innovative insurance technology, explicitly covering AI/ML in underwriting, telematics, wearables, chatbot/voicebot claims, and embedded insurance. No AI insurance tool can be deployed in a live policyholder context without IRDAI sandbox sanction. Applies to all IRDAI-licensed insurers (24 life, 25+ general, 7 standalone health, 2 reinsurers) and InsurTech entities seeking to test AI in Indian insurance markets. Policyholder protection is an ongoing obligation during AI trials — IRDAI can suspend sandbox participation if harm risk materializes. AI models cannot be materially changed post-sanction without fresh notification. Sole entity liability for all AI outcomes cannot be delegated to AI vendors. Zero global competitor coverage.

Zytra Research Team · January 2025 · 11 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

Most AI governance frameworks ask you to document what you've deployed. IRDAI's sandbox asks you to get permission before you deploy. For AI tools in insurance, this is a meaningful difference — it places regulatory scrutiny at the design stage, not the incident stage.

The 2025 regulations are more expansive than the 2019 sandbox they replace. A broader set of AI applications qualify, the process is streamlined, and the policyholder protection provisions are more explicit. IRDAI is opening the sandbox wider — but the fundamental requirement, that novel AI insurance products require pre-deployment approval, remains unchanged and is now on stronger regulatory footing.

The Model Immutability Constraint

The prohibition on materially changing an AI model after sandbox sanction without fresh notification is operationally significant for ML-based insurance tools. ML models trained to classify risk or assess claims are continuously updated — retraining on new data, adding features, adjusting hyperparameters. Under IRDAI's sandbox framework, each material update potentially requires a new notification and potentially a new sanction review. InsurTechs that assume rapid iterative model development is compatible with sandbox approval need to rethink their model governance cadence for the Indian market.

IRDAI Regulatory Sandbox AI Governance Checklist

☐ Sandbox scope assessment: determine whether planned AI insurance deployment requires sandbox sanction; categorize as novel AI application vs. incremental improvement on existing approved methodology
☐ Pre-deployment sanction obtained: IRDAI sandbox application filed; sanction received before any live policyholder interaction with AI tool; scope of sanction documented and matched to deployment scope
☐ AI model documentation: technical description of AI inputs, outputs, affected insurance functions, risk classes, policyholder segments — prepared for IRDAI submission
☐ Data and consent framework: DPDP Act compliance mapping; policyholder consent architecture for AI data processing; continuous data collection consent (for wearables, telematics) documented
☐ Policyholder protection measures: AI decision communication to policyholders documented; recourse mechanism for AI-adverse decisions defined; bias assessment completed
☐ Change management policy: material change definition established; fresh notification process defined; version control for AI model in sandbox period
☐ Liability documentation: sole entity liability for AI outcomes acknowledged in governance framework; AI vendor contracts reviewed for consistency with sole liability assumption
☐ Exit plan: production transition plan or withdrawal plan documented; policyholder remediation process for sandbox termination scenario