AI in insurance underwriting: how to implement it in practice

AI in insurance underwriting means building AI into the underwriting workflow so it reads submissions, pulls in data and checks cases against your underwriting rules, and underwriters start each case with a prepared file. For example, an AI model extracts risk details from a broker's emailed PDFs, checks them against appetite, flags what's missing and routes the case. The underwriter still prices and decides.

Most of the work worth automating sits before that decision. This article follows one submission through the underwriting workflow and covers what you need to build, control and measure to run it in production.

Where underwriting time goes

Ask an underwriting manager where the week goes and you'll hear about re-keying data from broker emails into the policy system, chasing a missing loss run, and checking whether a submission fits appetite before anyone reads it properly.

That preparation work has three traits. It's repetitive, it follows rules your team already knows, and it moves information between systems that don't talk to each other. Those are the parts AI handles well.

The judgement work is different. Pricing a complex risk, negotiating terms with a broker and deciding on a referral need experience and accountability. Good AI projects in underwriting are designed around that line from the start.

How AI is used in insurance underwriting, stage by stage

AI is used in insurance underwriting to prepare cases. It reads incoming submissions, extracts and checks the data, enriches it from other sources, tests it against appetite and guidelines, and drafts a risk summary for the underwriter. Each stage has a clear point where a person reviews or decides, and that point should be designed up front.

Here's how that looks for a single commercial submission.

An illustrative example. A broker emails a commercial property submission with a schedule, a proposal form and last year's policy. The AI extracts the insured's name, the total sum insured and the property locations. It finds no five-year loss history and asks the broker for it. One location sits outside appetite, so the case goes to a senior underwriter as a referral, with the reason attached. The underwriter opens a case that's already been read, checked and summarised.

For a wider view of AI across claims, fraud and customer service, see How AI Can Help Insurance Companies: 7 Use Cases.

Machine learning, generative AI and agentic AI in underwriting

Three kinds of AI show up in underwriting projects, and they do different jobs.

• Machine learning finds patterns in structured data. In underwriting it's used for risk scoring, propensity models and spotting unusual submissions. It needs clean historical data and careful validation.

• Generative AI reads and writes language. It's what makes broker emails, PDFs and loss runs usable, and it drafts the risk summary.

• Agentic AI chains several steps towards a goal, such as reading a submission, asking the broker for a missing document and routing the case once it's complete. We explain how it works in What Is Agentic AI in Insurance?

Production underwriting systems often combine these where they add value, with business rules and controls governing the workflow.

What you need to build

The AI model is the smallest part of an underwriting project. Most of the work is the system around it: where submissions arrive, where data comes from, where the rules live and where the underwriter works.

The pieces, in the order a submission meets them:

• Intake. One entry point for broker email, portals and APIs, so every submission becomes a case with an ID from the start.

• Document AI. Models that classify documents and extract fields, each with a confidence score. Low-confidence fields go to a person before they reach a decision.

• Data and enrichment. Connections to your policy history and to the external data sources you approve, through secure APIs. This is usually where insurance systems integration takes the most effort.

• Rules and appetite engine. Your guidelines as versioned logic, with automatic approval, referral and decline paths. Keeping the rules outside the model means you can change them without retraining anything.

• Underwriter workbench. The screen where the underwriter reviews the prepared case, sees what the AI extracted and why a case was referred, and makes the call.

• Policy admin and rating. Your existing core systems. The AI layer sends prepared, checked cases into them.

What this foundation looks like in a live insurance platform

We built Numerisk's Granite platform, a cloud-native insurance distribution and quoting platform. Granite wasn't built as an AI platform, but it has the foundation an AI underwriting layer needs. It includes an underwriting rules engine that supports automatic approval, flagged referral and room to expand risk scoring logic. Underwriting logic is version-controlled. Every action, such as a quote being referred or a policy being bound, is logged with identity, timestamp and system context in an immutable audit trail.

That gives an AI underwriting layer a foundation of traceability and accountability. When a model starts preparing cases, you can trace every recommendation, see which rule version applied and show who made the final decision. Read the Numerisk Granite case study.

Keeping underwriters in control

The controls are what turn a promising pilot into something your compliance team will sign off. Plan these from the first release:

• Named approval points. Decide which outcomes a person must approve: every quote, every decline, every referral above a limit. Write them into the rules engine so they hold when the team changes.

• An audit trail for every AI action. Record what the model extracted, which rule version applied, what it recommended and who made the final call. That's your answer when a broker, auditor or regulator asks why.

• Reasons behind every score. If a model influences a referral or a price, the underwriter should see the factors behind it in plain language.

• Confidence thresholds. Low-confidence extractions go to a person. Tune the threshold against real submissions before you trust it.

• Bias and drift testing. Check outcomes across customer groups before launch, then monitor them. Models drift as submission mix, products and data sources change.

• Exception handling. Unusual risks, missing data and system errors need a defined path back to an underwriter, so no case stalls silently in a queue.

AI also gets things wrong in predictable ways. Generated summaries can include details that aren't in the source documents. Extraction struggles with poor scans and handwritten forms. External data can be missing or out of date, and models trained on past decisions can carry past bias. Check summaries against their sources, test extraction on your worst documents, and monitor results by product, because accuracy varies between lines of business.

Regulation to plan for

Rules on AI in insurance differ by market, but they ask similar questions: can you explain a decision, can you show who was accountable, and are customers treated fairly? A few examples insurers and MGAs are working with:

• United States. The National Association of Insurance Commissioners adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. State insurance regulators adopt it individually, and by 8 October 2026, 29 jurisdictions had adopted it. It expects insurers to keep a written AI program with governance, risk management and controls, including for AI bought from third parties.

• European Union. Under the EU AI Act, AI systems used for risk assessment and pricing of individuals in life and health insurance are classified as high-risk. Following the AI Omnibus, those requirements apply from 2 December 2027 and cover risk management, data quality, documentation and human oversight. Other underwriting uses, such as most commercial lines, aren't automatically high-risk under this provision. It depends on the system's intended purpose.

• Australia. APRA's CPS 230 Operational Risk Management applies from 1 July 2025 and covers critical operations and material service providers. Insurers must at a minimum treat providers of underwriting, claims management, insurance brokerage and reinsurance services as material service providers unless they can justify otherwise. APRA has said CPS 230 doesn't intend to capture arm's-length transactions such as buying reinsurance, and a broker is captured only where the insurer relies on it for a critical operation or it introduces material operational risk (APRA response to submissions). Confirm how your own arrangements are classified with your compliance team. CPS 234 sets information security requirements, and the Privacy Act governs personal information. Where a customer or contract requires Australian data residency, hosting matters too. Granite, for example, is hosted in AWS Sydney.

This isn't legal advice. Check the rules in each market you write business in with your compliance team, and design the audit trail and approval points to meet the strictest of them.

Where to start: a realistic first release

Start narrow. Pick one line of business with steady submission volume and rules your underwriters already agree on. Then build the first three stages: intake, extraction and appetite checks, with triage to the right underwriter.

Leave pricing models and automatic binding for later. They need more data, more validation and more regulatory care, and they're easier to add once the case data is clean and the audit trail is running.

Before building anything, map the current workflow with the people who run it. Find where submissions wait, where data is re-keyed, and which referral paths exist only on paper. That map sets the scope better than any model choice.

How to measure results

Measure the workflow you set out to change, and record a baseline before the first release:

• Quote turnaround time, from submission received to quote issued.

• Underwriter time per submission, split into preparation and assessment.

• Submission-to-quote ratio, to see whether faster triage lets the team quote more of the business it wants.

• Data-entry corrections, how often underwriters fix extracted fields.

• Referral volume and turnaround, to check the rules route the right cases.

Loss ratio matters most in the end, but it takes far longer to move. Treat it as a long-term check.

Will AI replace underwriters?

Not in most underwriting teams. AI is taking over much of the preparation work, such as reading submissions, re-keying data and chasing missing documents. Decisions that need judgement and accountability, like pricing complex risks, setting terms and handling exceptions, stay with underwriters. How far automation goes depends on the product, the risk and the rules in each market, and simple personal lines are usually automated further than complex commercial risks.

Buy, build or both?

Some insurers buy an AI underwriting product, some build on their own systems, and many combine the two. Our upcoming guide on building versus buying AI for insurance covers how to choose.