The Customer an Insurer Should Never Rent

Strip an insurer down and what compounds is not a single quote, it is the relationship: who you acquire, how well you personalise the journey, and why a policyholder renews instead of shopping. That relationship is built on the most sensitive first-party data there is, health, lifestyle, claims history, and in the AI era it is a model that reads it, personalises to it, and decides the next best action. Who controls that model has become a strategic question.

This is the insurance expression of the Reset. The capability to personalise with AI is abundant and commoditising; every carrier can rent the same models. What is not commoditised, what actually decides who grows, is the governed, proprietary customer data underneath, and whether the carrier controls it or rents it from someone who can see it, change the terms, or be compelled to hand it over.

BCG's 2026 analysis argues AI is rewiring insurance growth around always-on, personalised retention rather than one-off acquisition. AXA runs more than sixty agentic use cases across the business, customer engagement among them; carriers are putting service and retention agents into production. The common thread is not a better model, every insurer rents the same ones, but a governed, integrated customer data foundation, owned and controlled, that lets agents personalise acquisition, renewal, and cross-sell with a human in the loop.

Read against the chart, the pattern is clear: the workloads that carry the most relationship value and the most personal data, retention, acquisition personalisation, cross-sell, are exactly the ones to keep under your control. The non-personal edge, broker and agent marketing content, public-data research, can use the frontier freely. Roughly seventy per cent of an insurer's customer-AI value, by our modelling, belongs on infrastructure the carrier controls.

When the models that personalise your acquisition and retention, and the customer data that trains them, run on infrastructure owned by a foreign provider, three things stop being fully yours. The provider's home jurisdiction can compel access to the data, under the US CLOUD Act, regardless of where it is stored, and no contractual clause cures it. The vendor can change the pricing, the terms, or the availability of a capability you now depend on. And the customer relationship you built sits somewhere you cannot fully see or control. Residency, keeping the data in an EU region, does not fix any of this; it answers where, not who.

Yes, regulation is also tightening around insurance AI and personalised pricing, and the specifics are in flux. But the strategic argument stands on its own without a single deadline: you do not rent out the relationship that renews your book. The figures here are Rindogatan models for a representative European insurer; the logic is the same one you already apply to everything else you cannot afford to lose.

Identify the workloads that carry real relationship value, retention, acquisition personalisation, cross-sell, quote and renewal journeys, and treat the customer data behind them as crown jewels: they belong on infrastructure and models you control, not on a foreign API you rent.

Move those workloads onto sovereign infrastructure where the customer data and the inference never leave a perimeter you own, and where you can see and audit exactly what the model did. Keep the frontier for the non-personal edge, and pilot one sovereign retention or acquisition workload to prove the model, a few points of retention move the whole P&L.

Then make control a standing question for every new use case: would this expose the customer relationship or the data that grows it? If yes, own it. The carriers that own the way they acquire and keep customers will out-grow the ones who rented it, long before any regulator gets involved.