What is IRDAI's Working Group on AI (WG-AI) and what will it produce?

IRDAI constituted the Working Group on AI (WG-AI) through an Office Order dated June 17, 2026. The group is chaired by Prof. Sandeep K. Shukla of IIIT Hyderabad and includes members from ReBIT (Reserve Bank Information Technology), CERT-In, and several insurance companies. The mandate covers seven areas: AI adoption and governance maturity across regulated insurers, ethical and explainable AI frameworks for claims and underwriting, AI-driven cybersecurity risks, sector-wide AI stress testing, AI audit framework requirements, capacity building for compliance teams, and policyholder data protection. Recommendations are due within three months of constitution — approximately September 17, 2026. The WG-AI recommendations will likely be converted to IRDAI circulars or guidelines, making them binding on all regulated insurance companies.

What AI governance obligations already apply to IRDAI-regulated insurers before the WG-AI recommendations?

Before the WG-AI recommendations, IRDAI-regulated insurers face AI governance obligations from three existing instruments. IRDAI (Insurance Products) Regulations 2024 require board-approved governance for AI-driven product pricing — AI underwriting is compliant only if pricing stays within IRDAI-filed actuarial rates and decisions are explainable. IRDAI Master Circular on Health Insurance Products (May 29, 2024) covers health insurance rationalization — AI-driven health risk scoring must not produce outcome distributions that diverge from the actuarial bases filed with IRDAI. IRDAI Digital Distribution Regulations 2024 require disclosure that AI is involved in insurance recommendations, that the recommendation basis is generated in customer-understandable terms, and that a human advisor offer is made before policy purchase. These instruments already impose explainability, fairness, and governance obligations that the WG-AI recommendations will extend and formalize.

What are the AI governance requirements for health insurance underwriting under DPDP Act and IRDAI?

Health insurance AI underwriting sits at the intersection of two governance frameworks. DPDP Act 2023 classifies health data as a sensitive personal data category — health history, medical records, genetic information, and wearables data used for AI risk scoring are sensitive personal data that require explicit consent and heightened protection. An AI health underwriting model that uses wearables data from a customer's fitness tracker requires: (a) informed consent for the specific use in underwriting; (b) data minimization — only the features from the wearables data that are directly relevant to risk assessment, not the full behavioral dataset; (c) DPDP Section 8 security safeguards — the health data used for AI training must be protected against breach. IRDAI Products Regulations 2024 add an insurance-specific layer: the AI underwriting decision must be explainable in terms that the customer can understand (why their premium is higher, what health factors contributed), and the model's risk classifications must not diverge materially from the actuarial bases filed with IRDAI. A black-box model that produces systematically different premium distributions from the actuarially filed rates is both an IRDAI filing violation and an explainability failure.

What should insurance companies do now to prepare for the IRDAI WG-AI recommendations?

Insurance companies should prepare for WG-AI recommendations by completing four actions before the recommendations land. First, AI inventory: catalogue every AI system in production use across claims processing, underwriting, fraud detection, customer service, and distribution — the WG-AI's mandate includes an AI adoption and governance maturity assessment across regulated insurers, and IRDAI will likely request this inventory early. Second, DPDP data mapping: map all data used in AI systems to DPDP lawful bases — health data in underwriting models, behavioral data in motor telematics models, and biometric data in claims verification systems are all sensitive personal data requiring specific governance. Third, explainability audit: assess which AI systems can generate explanations for their outputs and which cannot — the WG-AI mandate explicitly covers explainable AI, and models without explainability infrastructure are likely to require remediation once the guidelines land. Fourth, board AI policy: draft a board-approved AI governance policy — the WG-AI recommendations will almost certainly require one, and having it ready before the guidelines land avoids a rushed implementation under a compliance deadline.

AI Governance · IRDAI · Insurance · WG-AI · India BFSI

IRDAI WG-AI 2026: What India's Insurance Companies Must Prepare Before the AI Governance Framework Lands

IRDAI constituted its Working Group on AI (WG-AI) on June 17, 2026. Recommendations are due September 2026. The mandate covers seven areas — ethical AI for claims and underwriting, explainability requirements, DPDP Act health data governance, AI-driven cybersecurity risks, and sector-wide AI stress testing. No global AI governance vendor has covered IRDAI WG-AI. Prepare now.

Zytra Research Team · June 2026 · 12 min read

📖 Part of the India BFSI AI Governance Complete Guide 2026 — RBI, SEBI, IRDAI, NPCI & DPDP in one place.

India's insurance sector is one of the most AI-intensive in BFSI. Fraud detection models process millions of claims annually. AI underwriting tools score health, motor, and life risk in real time. AI chatbots handle policyholder queries and pre-sale interactions. Claims automation AI processes hospitalisation pre-authorisations at scale. Motor telematics AI uses driving behavior data for usage-based insurance pricing.

Until June 2026, India had no comprehensive insurance-specific AI governance framework — IRDAI's existing instruments imposed governance obligations on specific AI use cases (Digital Distribution Regulations 2024 for AI in distribution, Products Regulations 2024 for AI-driven pricing) but did not provide a sector-wide architecture. The IRDAI Working Group on AI, constituted June 17, 2026, will change this. Its recommendations — due within three months — will form the basis for IRDAI's comprehensive AI governance framework for the insurance sector.

Publishing this analysis before the WG-AI recommendations land is valuable for one reason: the insurers, TPAs, and health-tech and insurtech companies that prepare now will have a governance head start over those that wait for the guidelines and then implement under a compliance deadline.

The WG-AI Constitution: Who Is on the Committee and Why It Matters

The IRDAI Office Order of June 17, 2026 constituted WG-AI with a composition that signals its scope and approach:

Chair: Prof. Sandeep K. Shukla, IIIT Hyderabad — a leading academic in cybersecurity and AI safety, whose research focuses on AI robustness and adversarial threats. His presence signals that the WG-AI mandate extends beyond governance bureaucracy to technical AI safety.
ReBIT (Reserve Bank Information Technology) — RBI's technology subsidiary that developed the RBI IT Governance Master Direction and supports MRMF implementation. ReBIT's involvement suggests the WG-AI recommendations will align with MRMF's model governance architecture, creating cross-regulator consistency.
CERT-In — the national cybersecurity agency. CERT-In's membership on an insurance AI working group is significant: it reflects IRDAI's recognition that AI-driven cybersecurity risks (deepfake claims fraud, AI-augmented phishing targeting policyholders, AI-powered synthetic identity in new policy applications) require cybersecurity expertise alongside insurance expertise.
Insurer representatives — operational experience from life and general insurance companies ensures the recommendations are grounded in the actual AI deployment landscape, not theoretical governance constructs.

The Seven WG-AI Mandate Areas

1. AI Adoption and Governance Maturity Inventory

The WG-AI will first establish a baseline: what AI is deployed across regulated insurers, at what scale, and with what governance infrastructure. This inventory exercise is likely to become a standing IRDAI reporting requirement — similar to how RBI's model inventory requirement under MRMF created an ongoing obligation for regulated banks to maintain and report their AI model registers.

Insurance companies should prepare for this by maintaining their own AI inventory now. The inventory should cover: AI system name and function, deployment date, the decision it influences (claims approval, premium pricing, fraud flag, customer service), customer-facing vs internal, and current governance status (validated, monitored, explainability-capable).

2. Ethical and Explainable AI Frameworks for Claims, Fraud Detection, Underwriting

This is the most operationally consequential mandate area. Three insurance AI use cases have distinct ethical and explainability obligations:

Claims processing AI: A claim rejected by AI or auto-approved with reduced amount must be explainable to the policyholder. Under IRDAI's Insurance Ombudsman rules, a policyholder who receives an unexplained AI-driven claim rejection can escalate to the Insurance Ombudsman. The Ombudsman will require the insurer to produce the basis for the rejection — "AI decision" is not sufficient. An insurer whose claims AI cannot produce a claim-specific explanation on request faces Ombudsman adverse orders and IRDAI compliance risk simultaneously.

Fraud detection AI: A policyholder whose legitimate claim is flagged as fraudulent by an AI model and held pending investigation faces severe harm. The false-positive rate in insurance fraud AI is a governance metric, not just a model performance metric. Under Consumer Protection Act 2019, an insurer that routinely holds legitimate claims based on AI fraud flags without an expedited human review process has a service deficiency liability.

AI underwriting: An applicant denied coverage or charged a higher premium based on AI risk scoring has a right to understand the basis of that decision. The IRDAI Products Regulations 2024 already require that AI-driven pricing be explainable and consistent with filed actuarial rates. The WG-AI framework will formalize this into a specific explainability obligation: the AI underwriting model must generate a per-application explanation, and that explanation must be deliverable to the applicant on request.

3. AI-Driven Cybersecurity Risks

CERT-In's membership on WG-AI reflects the specific AI cybersecurity risks in the insurance sector:

Deepfake claims fraud: AI-generated video used to bypass video KYC in claims verification. Health insurance claims using AI-generated hospital documentation or medical reports. This is not hypothetical — CERT-In's April 2026 advisory documented deepfake vKYC incidents at financial institutions, and insurance's documentation-heavy claims process is a high-value target.
Synthetic identity in new policy applications: AI-generated synthetic identity documents that defeat traditional document verification, enabling fraudulent policy applications at scale.
AI-augmented policyholder phishing: AI-personalized phishing targeting policyholders with plausible-seeming claim status updates or renewal urgency messages that harvest credentials.

The WG-AI will likely recommend that insurers implement AI-specific defenses for each of these threat categories — deepfake detection in claims video verification, synthetic document detection at new policy application, and CERT-In advisory-aligned cybersecurity controls for policyholder-facing AI systems.

4. Sector-Wide AI Stress Testing

AI stress testing for insurance has a dimension that does not exist in banking: catastrophe scenarios. An AI claims processing system that functions correctly under normal claims volumes may produce systematically biased outputs in a catastrophe scenario — when claim volumes spike, edge cases proliferate, and the model's training distribution is challenged. The WG-AI framework will likely require insurers to test their claims AI under simulated catastrophe conditions, not just normal operating conditions.

5. AI Audit Framework

Third-party audit requirements for insurance AI, analogous to the audit requirements under FREE-AI Pillar 6 for banking AI. The WG-AI's inclusion of ReBIT — which helped design MRMF's audit requirements — suggests the insurance AI audit framework will align with MRMF's model validation approach: independent validation (not vendor self-assessment), periodic revalidation, and audit trail documentation.

6. Capacity Building

IRDAI will likely require insurance company boards and senior management to demonstrate AI literacy — the same capacity requirement that FREE-AI Pillar 3 imposes on banking boards. Insurance company directors who have not received AI governance training face a new credential obligation.

7. Policyholder Data Protection

DPDP Act 2023 alignment for all insurance AI. Health data used in AI underwriting and claims processing is sensitive personal data. The WG-AI's data protection mandate covers three critical intersections:

Health AI underwriting: health history, wearables data, genetic proxies — all DPDP sensitive categories. AI models using these must have explicit consent, data minimization, and DPDP-compliant security safeguards.
Motor telematics AI: behavioral driving data from connected vehicles is personal data under DPDP. The lawful basis for processing telematics data in AI pricing models must be established and documented.
Claims document processing: medical records, hospital bills, and diagnostic reports processed by AI claims tools contain sensitive health data. AI OCR and classification tools applied to these documents are processing sensitive personal data at scale — the DPDP implications extend to the technology vendor processing the data on the insurer's behalf.

Health AI Underwriting: The Sharpest Governance Challenge

Health insurance AI underwriting combines the most sensitive data category under DPDP (health records) with the highest-stakes insurance decision (coverage eligibility and premium pricing). The governance obligations compound:

IRDAI Products Regulations 2024 require that AI underwriting decisions stay within the actuarial bases filed with IRDAI. An AI model that produces risk classifications materially different from the filed actuarial assumptions — even if its aggregate prediction accuracy is high — is producing decisions that diverge from the IRDAI-approved product parameters. This is a filing violation, not just a model governance concern.

DPDP Act requires explicit consent for processing sensitive health data. An insurer that collects wearables data for AI underwriting without explicit, specific consent for that use is non-compliant with DPDP, even if the data was obtained through a wellness program or a partner's data-sharing arrangement.

Insurance Act 1938 Section 64VB prohibits insurers from charging premiums other than those filed with IRDAI for the specific product. AI-driven premium variation beyond the filed schedule — even when the AI identifies a better risk classification — requires a new product filing. Insurers that dynamically price using AI without corresponding IRDAI product filings face Insurance Act violations.

Preparing Before September 2026

☐ AI inventory: all AI systems across claims, underwriting, fraud detection, customer service, distribution — function, data used, decisions influenced, governance status
☐ DPDP data mapping: health data in underwriting AI, behavioral data in motor telematics AI, biometric data in claims verification AI — lawful basis documented for each; consent records for sensitive categories
☐ Explainability audit: which AI systems can generate per-decision explanations; remediation plan for systems that cannot
☐ Claims AI false-positive rate: claims false-positive rate (legitimate claims held by AI fraud flag) tracked as primary metric; expedited human review process in place
☐ Board AI policy: board-approved AI governance policy drafted or in progress
☐ IRDAI Products Regulations alignment: AI underwriting models validated against filed actuarial bases; divergence monitoring in place
☐ Deepfake defense: claims video verification includes AI-generated video detection; document verification includes synthetic document detection
☐ CERT-In advisory alignment: CERT-In April 2026 advisory recommendations mapped to insurer AI systems; gaps identified
☐ Insurance Ombudsman documentation: process in place to produce per-claim explanation when Ombudsman requests; explanation delivery timeline defined
☐ Vendor AI governance: InsurTech and TPA AI vendors assessed; contracts include AI governance provisions; independent validation planned

The WG-AI recommendations will not introduce entirely new principles — IRDAI's existing instruments already impose explainability, fairness, and data governance obligations. What the recommendations will do is formalize these obligations into a structured, audit-ready framework with specific requirements and compliance deadlines. Insurers that have built governance infrastructure in advance of the recommendations will move directly to verification; those that wait will build under deadline pressure.