Indian insurance is the last major BFSI sector to receive dedicated AI governance regulation from its primary regulator. RBI has FREE-AI, MRMF, and multiple IT governance directions. SEBI has its AI/ML circular and the imminent comprehensive guidelines. IRDAI has, until 2026, addressed AI governance indirectly through cybersecurity and outsourcing frameworks. That changed in the first half of 2026: the April 2026 Revised Information and Cybersecurity Guidelines create binding AI-specific obligations now, and the June 2026 constitution of IRDAI's Working Group on Artificial Intelligence (WG-AI) signals that comprehensive, dedicated AI governance obligations for insurers are coming.

What the April 2026 IRDAI Cybersecurity Guidelines Require NOW

Binding in FY2026-27 — These Are Not Proposals

The Revised Information and Cybersecurity Guidelines (April 2026) are binding on all IRDAI-regulated entities in the current financial year. Four provisions directly address AI systems:

Provision What it requires for AI systems Compliance deadline
AI-Specific Cyber Risk Assessment All AI/ML systems used in underwriting, claims processing, policyholder servicing, and investments must be included in the entity's cyber risk assessment. "AI risk" cannot be bundled into general IT risk — it requires separate identification and scoring. FY2026-27 (current year)
AI Incident Response Incident response plans must be updated to cover AI-specific failure scenarios: model compromise, adversarial inputs affecting claims decisions, AI-driven fraud enabling unauthorized policy modifications. FY2026-27 (current year)
Policyholder Data Protection for AI Processing Personal data of policyholders processed by AI systems (claims AI, underwriting models, health insurance AI) must meet enhanced data protection standards. Third-party AI vendors processing policyholder data are subject to the same requirements through contractual obligation. FY2026-27 (current year)
Board-Level AI Risk Reporting Material AI-related cyber risks must be reported to the board or its designated risk committee — not delegable to IT committee alone for risks above a defined threshold. FY2026-27 (current year)

IRDAI WG-AI — What to Expect

Composition and Mandate

IRDAI Office Order dated June 17, 2026 constitutes the Working Group on Artificial Intelligence (WG-AI). The seven-member composition includes:

  • Chair: Prof. Sandeep K. Shukla, IIIT Hyderabad (computer science, AI security expertise)
  • Representatives from ReBIT (Reserve Bank Information Technology — brings banking AI governance cross-pollination)
  • CERT-In (national cybersecurity agency)
  • Senior representatives from life, health, and general insurance companies

Mandate: Study AI adoption maturity across IRDAI-regulated entities; develop ethical and explainable AI frameworks; design AI-driven cybersecurity stress testing methodology; create AI audit frameworks for insurance-specific use cases.

Four Areas WG-AI Will Address (and What Insurers Should Prepare For)

1. Model Validation for Underwriting AI: WG-AI is likely to recommend validation requirements for AI-driven underwriting models analogous to RBI's Model Risk Management Framework (MRMF, June 2026) for banks. Insurers using ML models for health insurance pricing, life underwriting, or motor insurance risk scoring should begin documenting these models in a formal model inventory now — retroactive documentation is always harder.

2. Explainability Requirements for Claims AI: AI-driven claims rejection or partial settlement is a policyholder rights issue. WG-AI is expected to recommend that claims decisions made by AI be explainable to policyholders on request — creating a functional explainability duty analogous to DPDP's accuracy obligation and SEBI's explainability requirements for investment AI.

3. Stress Testing for AI-Driven Risk Pricing: Insurers that use AI to price catastrophe risk, health risk pools, or longevity risk in annuity products will likely face AI-specific stress testing requirements. The cyber stress testing component is already in scope of the April 2026 guidelines; WG-AI will extend this to model performance stress testing under adverse scenarios.

4. AI Audit Framework: WG-AI is developing an audit framework specific to insurance AI. Insurers that have already adopted ISO/IEC 42001 or NIST AI RMF governance structures will have a shorter path to compliance with whatever IRDAI specifies — the underlying controls are likely to overlap significantly.

Where IRDAI Diverges from RBI and SEBI

Framework IRDAI (current) RBI (banks) SEBI (securities)
Board-approved AI governance policy Implicit in cyber guidelines; not yet explicitly mandated Explicit in MRMF (June 2026) AI/ML circular requires senior management sign-off; board policy implied
Model risk management framework No equivalent yet; WG-AI likely to introduce Mandatory MRMF (June 2026) AI/ML circular requirements for validation; no full MRM mandate
Explainability mandate Not yet; WG-AI in scope Board-submittable explainability evidence (FREE-AI Sutra 4) For client-facing AI in investment context
Kill switch requirement No equivalent yet; WG-AI in scope Not explicitly for non-algo Explicit for algo trading AI; August 2026 signal for broader extension
Key Insight

This gap analysis shows that IRDAI-regulated entities have more runway than banks (where MRMF is already binding) but less time than they may assume — WG-AI recommendations are due September 2026, and IRDAI has shown it moves from consultation to binding circular in under 12 months.

Compliance Sequencing — Two Tracks

Track 1
Act Now — April 2026 Guidelines, FY2026-27
  • Update cyber risk assessment methodology to include AI-specific risks
  • Review and update incident response plans for AI failure scenarios
  • Audit third-party AI vendor contracts for policyholder data protection clauses
  • Establish board-level AI risk reporting cadence
Track 2
Prepare for WG-AI — Recommendations due September 2026
  • Begin AI system inventory (model name, purpose, data inputs, decision outputs, validation status)
  • Document underwriting, claims, and investment AI models — retroactive documentation will be required
  • Review explainability posture for claims AI: can the insurer explain a claims rejection driven by AI to a policyholder?
  • Identify gaps between current practices and ISO/IEC 42001 or NIST AI RMF — either will likely accelerate IRDAI audit framework compliance

Frequently Asked Questions

Are the April 2026 IRDAI cybersecurity guidelines binding on all IRDAI-regulated entities?
Yes. The Revised Information and Cybersecurity Guidelines (April 2026) are binding on all IRDAI-regulated entities — life insurers, general insurers, health insurers, reinsurers, and insurance intermediaries — in the current financial year FY2026-27. These are not consultative proposals; compliance is required now.
When will IRDAI WG-AI recommendations be published?
The IRDAI Working Group on Artificial Intelligence (WG-AI), constituted June 17, 2026, was mandated to submit recommendations within three months — placing the target submission date in September 2026. Publication of a consultation paper or binding circular based on WG-AI's work is likely in Q1 or Q2 of FY2027-28.
Does IRDAI have an equivalent of RBI's Model Risk Management Framework for insurance AI?
Not yet. RBI's MRMF (June 2026) is specific to RBI-regulated entities (banks, NBFCs). IRDAI WG-AI is expected to develop an AI governance framework that may include model validation requirements analogous to the MRMF for insurance-specific AI systems (underwriting, claims, actuarial). Insurers that build MRMF-equivalent documentation practices now will be well-positioned for whatever IRDAI specifies.