Most insurers past the pilot stage agree on the destination for AI — faster risk decisions, lower claims expense, earlier fraud detection — but far fewer agree on where they actually stand today, and that measurement gap is where 2026 budgets will be won or lost.
Why so many underwriting and claims pilots stall
Ask five carriers how their AI programme is going and you will get the same shape of answer: a promising pilot, an enthusiastic sponsor, and no production deployment to point at. The stall rarely comes from model quality. Commercial LLMs and gradient-boosted risk models are, by 2026, more than accurate enough for triage, summarisation and risk-flagging tasks. What stalls programmes is everything around the model: underwriting guidelines locked in PDF annexes, claims files scattered across a policy admin system, a document management platform and inboxes; and no agreed way to prove to a regulator why the machine recommended what it recommended.
There is also a quieter economic reason. Pilots are staffed by the best people in the building — a senior underwriter, a data scientist, an external vendor's solution architect. Production requires the average person on the team to use the system on a rainy Tuesday with a complicated file. If the workflow does not fit how claims handlers and underwriters actually work, the pilot's impressive numbers evaporate on contact with the operations floor.
The insurers making real progress in 2026 share one habit: they talk about maturity levels, not projects. They can state, in one sentence, which of their underwriting and claims processes sit at which level, and what specifically blocks the next level. This article provides that vocabulary: a five-level maturity model, then a function-by-function check of underwriting, claims triage and fraud detection, followed by the regulatory and human-in-the-loop considerations that determine whether any of it survives an audit.
The five-level maturity model
The model below deliberately uses outcomes, not technology, as the differentiator. Buying a large language model licence does not move you up a level; changing who touches a decision, how fast, with what evidence trail, does.
| Level | Name | Underwriting signature | Claims signature | Human role | Typical share of book (industry estimates, 2025–2026) |
|---|---|---|---|---|---|
| 1 | Manual | Paper PDFs, underwriter judgement, email submission | Phone intake, paper forms, manual assessment | Does everything | Still common in commercial specialty lines |
| 2 | Assisted | Digital submission, data pulled manually, checklists | Digital FNOL, workflow queues, document scan | Does everything, faster | The modal level for mid-market carriers |
| 3 | Rule-augmented | External data feeds, rules engines flag exceptions | Rules-based triage, straight-through for simple claims | Reviews exceptions | Common target state for personal lines |
| 4 | Model-augmented | ML risk scoring on structured + unstructured data | ML triage, damage photo assessment, reserve suggestion | Overrides and approves thresholds | Leading personal and SME carriers |
| 5 | Autonomous-with-oversight | Automated quoting within appetite, AI drafts referrals | Majority straight-through, humans handle complex and suspect files | Sets policy, audits samples, handles edge cases | Small but growing minority, mostly narrow lines |
Three observations on how to read the table. First, the jump that matters commercially is level 2 to level 4, not level 4 to level 5. The expense-ratio gains McKinsey (2023) describes come overwhelmingly from automating the repetitive middle of the process, not from removing the last human. Second, most carriers are not one level across the book; a composite insurer might be level 4 in motor claims and level 1 in marine cargo. Level-by-process, not level-by-company, is the honest unit of measurement. Third, level 5 is a governance achievement as much as a technical one — no carrier reaches it before its audit trail and model validation practices can support it.
Underwriting: what automates well and what does not
Submission triage is the clearest win. Commercial underwriters spend a large share of their day — industry estimates suggest 30–40 percent — on submissions that were never going to be quoted: out of appetite, missing critical data, duplicated elsewhere. A model that reads the submission, checks it against appetite rules and returns a decline, a request-for-more-information, or a prioritised queue changes the economics of the underwriting desk without touching a single risk decision. This is why broker-facing triage is so often the first production AI deployment in commercial lines.
Risk scoring is the second win, with a caveat. Gradient-boosted models on structured data have been quietly productive for a decade — credit-style scores for renewal propensity, loss-cost models for pricing. The 2024–2026 shift is that LLMs can now ingest the unstructured 60 percent of a submission that previously never made it into a model: engineering reports, site photographs, financial statements. Insurers doing this well treat the LLM as an extraction layer — it converts documents into structured fields with confidence scores — and keep the risk decision in a conventional, explainable model on top. Insurers doing it badly let the LLM answer "what's the risk?" directly, and then discover they cannot explain the answer to an actuary or a regulator.
What does not automate well, in 2026, is anything involving genuine novelty or negotiation. Complex structured risks, programmatic business, reinsurance treaties and anything where the submission is a negotiation between broker and underwriter remain human work. Carriers that tried full auto-quoting in complex commercial lines have generally retreated to "auto-decline out of appetite, auto-quote within tight bands, human in between" — which is, on inspection, exactly the level 4 pattern.
The data foundation question
Every underwriting automation case ultimately lands on the same bottleneck: the risk data is not in a queryable state. Submissions live in email; loss runs arrive as scanned PDFs from brokers; the policy admin system holds administration data, not risk data. Carriers that skip the semantic layer — a governed set of canonical definitions for exposure, premium, loss ratio, per line of business — end up rebuilding the same data plumbing for every AI use case, and their AI programme becomes an ETL programme with a marketing budget. This is precisely the problem a conversational, MCP-driven analytics layer addresses: the semantic definitions are built once, and both the underwriting dashboards and the AI agents answering "what was our loss ratio on mid-market property in the GBA last quarter?" draw from the same governed source.
Claims triage: the straight-through processing frontier
Straight-through processing — a claim settles with no human touching it — is the most measured metric in claims transformation, and the most misleading when quoted without context. A motor glass claim and a fatal workplace injury both enter the same FNOL funnel; quoting an aggregate STP rate tells you almost nothing. What matters is the STP rate within a defined claim segment, and the leakage rate of the humans supervising that segment.
The 2026 pattern that works is segment-first triage. On first notification of loss, a model classifies the claim along three axes: complexity (simple, standard, complex), suspicion (clean, review, investigate) and severity (reserve band). Simple-plus-clean claims below a reserve threshold flow straight through with automatic payment. Everything else is routed to the right handler skill the first time — because the second-largest cost in claims after leakage is the cost of a file being touched by the wrong team twice. Carriers that implemented this pattern report, in vendor and consultancy case studies from 2024–2025, cycle-time reductions in the 30–50 percent range for the automated segment, with modest further gains as the models learn from overrides.
Generative AI has added a genuinely new capability to triage: summarisation of the file itself. A claims handler opening a three-year-old file with forty documents, adjuster notes and two recorded calls is the classic reassignment scenario, and LLM summaries measurably cut the orientation time. The governance note is equally clear: the summary is a convenience, never the record of decision. Carriers that let summaries substitute for reading the underlying file have created exactly the "the AI said so" liability that regulators are now probing.
Fraud detection: precision is the whole game
Fraud detection is the oldest AI application in insurance and the one with the widest gap between marketing and practice. The technology works; the economics are unforgiving. Every fraud model produces two error types, and carriers consistently underprice one of them: the false positive. Investigating a legitimate claim costs handler time, delays payment, damages the customer relationship and, at the margin, generates complaints to the regulator. Industry discussions throughout 2024–2025 converge on the same lesson: a fraud model with 90 percent precision on paper can still be operationally unviable if the flagged volume exceeds investigative capacity, because the queue, not the model, becomes the control.
The mature 2026 operating pattern treats fraud scoring as a routing input, not a verdict. Every claim gets a fraud propensity score that adjusts its triage path — high scores route to the special investigations unit with the specific signals attached, low scores flow normally. Humans close the loop: every investigation outcome (confirmed fraud, ruled out, inconclusive) is fed back as a labelled example. The signals themselves have shifted with available data — network analytics linking claims by adjuster, clinic, repair shop and phone number now routinely surface organised fraud rings that rule-based systems never caught, a pattern documented across consultancy and vendor research since 2023.
Two fraud-adjacent cautions for 2026. First, deepfake and synthetic-document fraud is now an operational reality in remote claims — voice cloning on phone claims and AI-generated damage photos are no longer theoretical, and carriers are responding with liveness checks and metadata forensics as standard intake controls. Second, fraud models are the single most explainability-sensitive model in the portfolio. A fraud score that correlates with postcode, occupation or claimant language is not just a fairness problem; it is a foreseeable regulatory finding.
What regulators actually expect in 2026
Regulatory direction on AI in insurance hardened measurably between 2023 and 2026, and the direction is consistent across jurisdictions even where the instruments differ. The NAIC model bulletin on the use of AI systems by insurers (2023), adopted in some form by a majority of US states, frames expectations around a written AI governance programme, documented model validation and third-party vendor oversight. The EU AI Act (2024), phasing in through 2026–2027, treats underwriting and pricing uses as high-risk where they have legal or similarly significant effects, attaching documentation, human-oversight and accuracy obligations. In Asia, regulators including the Monetary Authority of Singapore and the Hong Kong Insurance Authority have published guidance emphasising management accountability, model inventory and fair outcomes rather than prescriptive technical standards.
Read across the instruments and the expectation set is remarkably uniform:
- A documented inventory of AI models in use, including vendor models, with an owner named for each.
- Evidence that a human meaningfully oversees consequential decisions — not a rubber stamp, but review of samples, override tracking and challenge rights.
- Explainability proportionate to impact: for adverse underwriting decisions, the ability to state the material reasons, in customer-legible terms.
- Bias testing on protected attributes, with documented results and remediation.
- Vendor accountability: the carrier, not the model provider, answers to the regulator.
The practical reading is that no regulator in 2026 requires insurers to explain every model output, but all of them require insurers to explain the ones that hurt someone. Design your audit trail around adverse actions — declinatures, fraud referrals, reserve escalations — and you have built the 80 percent of compliance that gets examined.
If your AI programme cannot produce, within one business day, the reason codes and data inputs behind any adverse decision it made last month, it is not a compliance gap — it is a missing system capability, and it should be budgeted as one.
Human-in-the-loop patterns that survive audit
"Human-in-the-loop" is quoted in every AI governance document in the industry and operationalised in fewer than most would admit. The failure mode is well understood: a human is placed in the workflow, the AI recommendation is presented alongside a pre-checked box, and approval rates converge to near-100 percent within weeks. Regulators have noticed this phenomenon; the EU AI Act's oversight language (2024) explicitly contemplates automation bias, and auditors increasingly ask for approval-rate drift curves as evidence of genuine review.
Four patterns hold up in practice:
- Threshold-plus-sample: the AI auto-decides below a materiality threshold; above it, a human decides with AI input; and a random sample of even the auto-decisions is reviewed monthly by a senior underwriter or claims manager. The sample is what converts the control from decorative to evidential.
- Blind-first review: for high-impact decisions, the reviewer records their judgement before the AI's recommendation is displayed. Expensive, but it is the only pattern that measurably defeats anchoring, and some carriers reserve it for fraud referrals and large reserves.
- Override-with-reason: every override of an AI recommendation captures a structured reason code. This does two jobs at once — it creates the explanation record regulators want, and it is the highest-value training data the model will ever receive.
- Quarterly challenge review: a standing forum where underwriting and claims leadership review model performance drift, override patterns and complaint data, with minutes kept. When a regulator asks "how does management oversee this?", the minutes are the answer.
The pattern to avoid is the post-hoc review board that re-litigates decisions after payment — it catches nothing in time and produces paper, not control.
Measuring the programme: KPIs that prove movement
Maturity models are useless if the only evidence of progress is a slide. Each level should be tied to metrics a CFO would accept, baselined before the work starts and reported quarterly without narrative softening. The measurement discipline also protects against the most common programme pathology: teams optimising a metric that looks like progress but is not, such as "AI features shipped" or "models trained", neither of which appears on an income statement.
| KPI | What it proves | Where it moves | Healthy direction |
|---|---|---|---|
| Submission handling time (commercial) | Triage automation is real | Levels 2→4 | 30–50% reduction on automated segment |
| Quote turnaround time | Appetite screening works | Levels 2→4 | Measurable cut, no loss-ratio drift |
| Cycle time by claim segment | Triage, not average, is improving | Levels 2→4 | Segment-level, not blended |
| STP rate within segment | Automation depth is defensible | Level 3→4 | Rising without leakage rise |
| Claim leakage rate | Automation is not cutting corners | All levels | Flat or falling as STP rises |
| Override rate and drift | Human oversight is genuine | Level 4→5 | Stable, not converging to zero |
| Adverse-decision reason coverage | Audit trail is complete | All levels | 100% recoverable within 1 day |
| Complaints per 1,000 decisions | Speed is not eroding fairness | All levels | Flat or falling |
Two of these deserve emphasis because they are routinely missing. Override rate drift is the canary for automation bias: if the human approval rate of AI recommendations climbs smoothly toward 100 percent within a quarter of go-live, your human-in-the-loop has decayed into a signature step, and the oversight claims in your governance document are no longer supportable. Adverse-decision reason coverage is the audit-trail completeness check: for every declinature, fraud referral and reserve escalation, the system must be able to reproduce the reason codes and input data within one business day. Carriers that measure both from day one find their first regulatory examination dramatically less expensive; carriers that bolt them on after the fact discover that historical decisions cannot be reconstructed, and the gap becomes a finding.
A final measurement note: resist blended averages. A programme that improves cycle time 40 percent on the simplest 20 percent of claims while the complex 80 percent stagnates will show a blended 8 percent improvement that flatters nothing. Segment-level reporting is slower to read and more honest, and it is what an actuarial or finance function will eventually demand anyway.
A 12-month plan by maturity level
For a carrier at level 2 today, the realistic 12-month sequence that reaches level 3–4 in one or two functions looks like this. Quarters one and two: build the semantic layer and model inventory — unglamorous, and the prerequisite for everything else; deploy submission triage in one commercial line with a documented override loop. Quarter three: extend to claims triage in the highest-volume, lowest-severity segment, with STP enabled only below a conservative reserve threshold. Quarter four: add fraud scoring as a routing signal, stand up the quarterly challenge review, and commission an independent model validation so the governance story is audited before the regulator asks. Carriers that attempt the sequence in a different order — models first, data and governance later — are the ones whose pilots stall, and the maturity model exists precisely to prevent that spending pattern.
