EU AI Act Impact on Insurance Fraud Detection Technology

The European Union’s Artificial Intelligence Act (Regulation (EU) 2024/1689) — the first comprehensive horizontal AI law — entered into force on August 1, 2024, with obligations phasing in over several years. In July 2026 the “Digital Omnibus on AI” amended that timeline, pushing the main high-risk obligations back to December 2027. For insurers operating in the EU, the Act matters for AI used across the insurance lifecycle, including fraud and deepfake detection. But the way it applies to fraud detection is often misstated.

The Act reaches beyond EU borders. Under Article 2, it applies to providers and deployers established outside the EU “where the output produced by the AI system is used in the Union.” An Australian or American detection vendor whose technology is used by a European insurer can therefore fall within scope.

How the EU AI Act Classifies AI Systems

The Act takes a risk-based approach, usually summarized in four tiers:

Unacceptable Risk (Prohibited)

Practices listed in Article 5, such as social scoring, certain manipulative techniques, and emotion recognition in workplaces and education. Insurance fraud detection is not a prohibited practice.

High Risk

AI systems that are safety components of regulated products (Annex I) or that fall within the use cases listed in Annex III. This is the category that attracts the Act’s heaviest obligations.

Transparency Obligations

Article 50 imposes disclosure duties on certain systems — for example, chatbots must disclose that users are interacting with AI, providers of generative AI must mark synthetic outputs in a machine-readable way, and deployers who publish deepfakes must disclose that the content is artificially generated or manipulated. (Emotion recognition outside the prohibited settings is high-risk under Annex III, and deployers must also inform the people exposed to it.)

Minimal Risk

Everything else, with no specific obligations beyond existing law.

Is Insurance Fraud Detection High-Risk?

This is where many summaries go wrong. Annex III, point 5, lists two insurance- and finance-related high-risk uses:

5(b) “AI systems intended to be used to evaluate the creditworthiness of natural persons or establish their credit score, with the exception of AI systems used for the purpose of detecting financial fraud”

5(c) “AI systems intended to be used for risk assessment and pricing in relation to natural persons in the case of life and health insurance”

Recital 58 adds that “AI systems provided for by Union law for the purpose of detecting fraud in the offering of financial services and for prudential purposes to calculate credit institutions’ and insurance undertakings’ capital requirements should not be considered to be high-risk under this Regulation.”

Claims fraud detection and deepfake detection are not listed in Annex III. Nor is deepfake detection “biometric” in the Annex III sense, which covers remote biometric identification, biometric categorization by sensitive attributes, and emotion recognition. On the text of the Act, a deepfake detector used to review claims evidence is therefore not automatically high-risk.

Classification still depends on how the system is used. An AI fraud tool can fall within Annex III if, for example:

Its output feeds risk assessment or pricing for life or health insurance (point 5(c))
It is used for biometric identification of claimants (point 1)
It is combined with, or acts as a component of, a system that is itself high-risk

Where a system does fall within an Annex III use case, Article 6(3) allows a narrow derogation for systems that do not materially influence decision outcomes — but a system that profiles natural persons is always treated as high-risk. Insurers should document their classification reasoning, and have it reviewed by counsel.

Even where a deepfake detector is not high-risk, the high-risk requirements are a useful governance benchmark, and GDPR applies in full.

What High-Risk Classification Requires

If a system is high-risk, Articles 8–15 set requirements for the system itself, which the provider must meet (Article 16) before placing it on the market:

Risk Management System (Article 9) A continuous, iterative risk management process across the system’s lifecycle: identifying known and foreseeable risks, evaluating risks from intended use and reasonably foreseeable misuse, adopting mitigation measures, and testing.

Data and Data Governance (Article 10) Training, validation and testing data must be relevant, sufficiently representative and, to the best extent possible, free of errors and complete in view of the intended purpose. For a detection model, “representative” means representative of the media and settings it will actually see — devices, compression, capture conditions and, where people are depicted, the populations concerned.

Technical Documentation (Article 11) Detailed documentation prepared before the system is placed on the market, describing the system, its development, its monitoring and its risk management.

Record-Keeping (Article 12) Automatic logging capabilities so that the system’s operation can be traced.

Transparency and Instructions for Use (Article 13) Systems must be sufficiently transparent for deployers to interpret their output and use it appropriately, and must come with instructions describing capabilities and limitations.

Human Oversight (Article 14) Systems must be designed so that people can understand their capabilities and limitations, interpret outputs correctly, decide not to use or to override an output, and intervene or stop the system.

Accuracy, Robustness and Cybersecurity (Article 15) Appropriate levels of accuracy, resilience to errors and faults, and resistance to attempts to manipulate the system — for a detector, that includes adversarial content designed to evade it.

Providers must also carry out a conformity assessment (Article 43), register the system in the EU database, and run post-market monitoring.

What Deployers (Insurers) Must Do

Insurers using a high-risk system are deployers. Their core obligations under Article 26 include:

Using the system in line with the provider’s instructions
Assigning human oversight to people with the necessary competence, training and authority
Ensuring input data under their control is relevant and sufficiently representative
Monitoring operation and informing the provider and authorities of serious incidents
Keeping the automatically generated logs for at least six months
Informing individuals that they are subject to a high-risk AI system used to make or assist decisions about them

Deployers of Annex III 5(b) and 5(c) systems — which includes life and health insurers using AI for risk assessment and pricing — must also carry out a fundamental rights impact assessment under Article 27. And under Article 86, people affected by decisions based on most Annex III systems have a right to clear and meaningful explanations of the AI system’s role in the decision.

The AI Act does not replace the General Data Protection Regulation — it operates alongside it. For deepfake detection in claims, GDPR is often the more immediately relevant regime.

Lawful Basis for Processing

Deepfake detection involves processing personal data. Insurers need a lawful basis under Article 6:

Legitimate interests (Article 6(1)(f)) is the most common basis for fraud prevention, subject to a balancing test against the data subject’s rights
Contractual necessity (Article 6(1)(b)) may apply where assessing the claim is part of performing the insurance contract
Legal obligation (Article 6(1)(c)) applies where fraud controls are required by law

Is It Biometric Data?

Images and recordings of faces and voices are not automatically “special category” data. Under Article 9(1), biometric data is special category only when processed “for the purpose of uniquely identifying a natural person.” A detector that assesses whether a photo or recording was synthesized or manipulated — without identifying who is depicted — is generally not processing biometric data in that sense. If a workflow does perform biometric identification (for example, face matching against an ID document), an Article 9(2) condition is needed; the substantial public interest condition in Article 9(2)(g) requires a basis in EU or member state law.

Automated Decision-Making (Article 22)

Article 22 gives individuals the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. The Court of Justice’s SCHUFA judgment (C-634/21, December 2023) held that an automatically generated score can itself be such a decision where it plays a determining role in the final outcome. Deepfake detection that effectively decides a claim without meaningful human review risks falling within Article 22.

The practical requirement: detection should feed into a human-reviewed decision process, not replace it. This aligns with responsible deployment practices.

Data Protection Impact Assessment

Under Article 35, processing likely to result in a high risk to individuals requires a Data Protection Impact Assessment (DPIA). Systematic, large-scale AI screening of claims evidence — especially where it can lead to a claim being delayed or refused — will often meet that threshold. The DPIA must assess necessity and proportionality, the risks to individuals and the mitigating measures.

Data Subject Rights

Individuals keep their GDPR rights when their evidence is analyzed:

Right to information — claimants should be told that automated tools are used in claims assessment
Right of access — claimants can request their personal data, including analysis results about them
Right to rectification — inaccurate personal data can be corrected
Meaningful information about the logic involved — for Article 22 decisions (Articles 13–15). In Dun & Bradstreet Austria (C-203/22, February 2025), the Court held that this means explaining the procedure and principles actually applied, so the person can understand and contest the decision

Compliance Timeline (as Amended by the Digital Omnibus)

The Digital Omnibus on AI was proposed in November 2025, agreed in May 2026, adopted in June 2026 and published as Regulation (EU) 2026/1744, entering into force on July 27, 2026. The key dates now are:

Date	Requirement
February 2, 2025	Prohibited practices and AI literacy provisions apply
August 2, 2025	Obligations for general-purpose AI models; governance and penalties
August 2, 2026	Article 50 transparency obligations apply (with a grace period to December 2, 2026 for marking by generative systems already on the market)
December 2, 2027	High-risk obligations for Annex III systems (previously August 2, 2026)
August 2, 2028	High-risk obligations for AI in products covered by Annex I (previously August 2, 2027)

For insurers, the date that matters for any system that is high-risk — such as life and health pricing models — is now December 2, 2027. GDPR obligations already apply today.

Penalties

Under Article 99, the maximum fines are:

Prohibited AI practices: up to €35 million or 7% of worldwide annual turnover, whichever is higher
Most other obligations, including high-risk requirements: up to €15 million or 3%
Supplying incorrect, incomplete or misleading information to authorities: up to €7.5 million or 1%

For SMEs, the lower of the two amounts applies. Market surveillance authorities can also require non-compliant systems to be withdrawn or recalled.

Practical Steps for Compliance

For Insurers (Deployers)

Inventory and classify your AI systems. Document, for each system, whether and why it falls within Annex III — including why a fraud or deepfake detector does or does not.
Gap-analyze high-risk systems against Article 26 deployer duties, and plan fundamental rights impact assessments for life and health pricing models ahead of December 2027.
Confirm provider conformity. For high-risk systems, check that the provider has completed conformity assessment and registration, and that you have the instructions for use.
Align GDPR and AI Act compliance. Build AI Act work into existing GDPR programs — DPIAs, Article 22 safeguards and transparency notices — rather than running it separately.
Engage your deepfake detection vendor. Ask what technical documentation and evaluation evidence they can supply, then have qualified advisers decide what further material your processes require. deetech™ reports support review but do not establish regulatory conformity.
Train claims staff. Human oversight is only meaningful if the people involved understand AI outputs and are empowered to override them.

For AI Providers of High-Risk Systems

Establish a quality management system
Complete conformity assessment and CE marking
Register the system in the EU database
Provide deployers with instructions for use and technical information
Implement post-market monitoring and serious-incident reporting

Cross-Border Considerations

The AI Act is directly applicable in every member state, but supervision is national:

National market surveillance authorities will differ in their supervisory approach
National insurance supervisors apply sectoral rules alongside the Act
Member state laws implementing GDPR (for example, on fraud-prevention data sharing) differ

EIOPA published an Opinion on AI Governance and Risk Management in August 2025, setting out supervisory expectations for insurers’ AI systems that are not high-risk under the Act. Insurers are also subject to the Digital Operational Resilience Act (DORA), which has applied since January 17, 2025 and covers ICT third-party risk — including AI vendors.

The Strategic Opportunity

The EU AI Act is often framed as a compliance burden. It is also an opportunity. Insurers that apply sound governance to fraud detection — transparent processes, human oversight and demonstrable fairness — build trust in a market where consumer confidence matters, whether or not a given tool is formally high-risk.

European consumers increasingly expect ethical AI practices from their insurers, and the Act and EIOPA’s expectations give a framework for meeting that expectation.

Conclusion

The EU AI Act does not automatically make insurance fraud or deepfake detection high-risk: Annex III targets life and health risk assessment and pricing, and the creditworthiness category expressly excludes fraud detection. But classification turns on actual use, GDPR’s rules on automated decisions and transparency apply now, and EIOPA and DORA add sector expectations. With the Digital Omnibus moving Annex III obligations to December 2, 2027, insurers have time to classify their systems carefully and build governance that will stand up to scrutiny.

For insurers evaluating deepfake detection in the EU, deetech™‘s platform provides analysis outputs, forensic reports and audit records as inputs to human review. Customers remain responsible for legal classification, any conformity steps and regulatory outcomes. Request a demo to discuss your claims workflow.

This article is for informational purposes only and does not constitute legal, regulatory, or compliance advice. Insurers should consult qualified legal and compliance professionals for guidance specific to their circumstances and jurisdiction.