The Sovereign AI Balance Report: Insurance Edition

Insurance runs on exactly the data and exactly the decisions the regulator watches most closely: health, lifestyle, and the models that now personalise acquisition, quote journeys, and retention around them. After the Reset, the capability to do this with AI is abundant; the question is where it may run. For an insurer, that question is answered as much by GDPR Article 9 and the AI Act as by economics.

The pre-Reset posture, keep AI at arm's length from the customer, or pilot it cautiously on a US cloud, is now both unnecessary and exposed. Sovereign, auditable AI over policyholder data is procurable, and it is the only posture that lets you personalise acquisition and retention on the most sensitive data there is without a transfer problem.

GDPR treats the health and lifestyle data behind acquisition and retention as special-category, raising the bar on consent, transfer, and minimisation. The AI Act names insurance risk-and-pricing personalisation as high-risk, pulling in documentation, human oversight, and data governance, and it reaches personalised acquisition wherever it profiles. Distribution and conduct rules add suitability and non-discrimination duties to any targeting or personalisation.

Every one of those obligations is easier to meet on infrastructure you control. A retention or acquisition model whose data, logs, and decisions live inside your perimeter is one you can explain to a regulator, a policyholder, and an ombudsman. The same model behind a third-country API is a compliance argument you do not want to have.

At the sovereign end: retention and churn models, acquisition personalisation, cross-sell and next-best-action, and analytics over policyholder data, high-value, high-sensitivity, and best run on self-hosted, governed models. At the frontier edge: broker and agent marketing content, research synthesis, and internal drafting against non-personal material, where capability earns its place. The recommended split tilts roughly seventy per cent sovereign, close to banking, for the same fundamental reason: the customer data is the asset.

Claude is the preferred frontier model where the data is non-personal; sovereign local inference on European soil is the default the moment a real policyholder is involved. The US data platforms are the EU-resident data layer and cited evidence, never the home of personal data or the inference itself.

Inventory and classify every customer-AI use against GDPR Article 9 and the AI Act, flagging retention, acquisition personalisation, and cross-sell on policyholder data as sovereign-by-default. Move them to sovereign infrastructure where their consent basis, documentation, and explainability can actually be delivered.

Pilot one sovereign retention or acquisition workload to prove the model, then make placement a standing governance decision so every new customer model is born compliant rather than retrofitted under audit.