The conversations I'm having with senior people across the industry at the moment have a familiar shape. Someone describes a problem — payment delays, a reconciliation that won't close, a carrier partner asking hard questions about fund visibility — and then, almost in the same breath, they say some version of: "we've known about this for a while."

That's the part that interests me. Not the problem itself, but the fact that it's been known about. Because what that tells you is that the industry has been carrying a form of debt — not financial debt, but operational debt. Deferred investment in the infrastructure that actually moves money, reconciles accounts, and connects claims teams with treasury. It's been accumulating quietly for years, and the conditions that made it easy to ignore are changing.

The buffer is getting thinner

For most of the past decade, there was enough slack in the system to absorb a degree of operational inefficiency. When investment returns are strong and pricing cycles are favorable, slow reconciliation and fragmented fund management don't really show up as problems. They show up as mild annoyances, something for the back office to sort out eventually.

That buffer is narrowing. AM Best has flagged that margin pressure is likely to build through 2026 as rate moderation continues and loss severity persists, particularly in casualty lines. In that environment, those inefficiencies stop being invisible. Finance teams spending hours on manual reconciliation aren't doing liquidity planning. Treasury teams managing reactive funding calls aren't optimizing how capital is deployed. Those are real costs. In a tighter market, they start affecting results.

The timing matters. If you've been telling yourself that the infrastructure investment can wait, the window for waiting is getting smaller.

What the data actually shows

Earlier this year, we surveyed more than 200 senior insurance professionals across claims, finance, and treasury in the US and UK. Some of what came back was striking. Not because it surprised me, but because of how consistently people described the same problems.

Nearly eight in 10 identified internal process inefficiencies as a key barrier to timely claims payments. Two-thirds said accessing readily available funds was a genuine challenge, and that figure rose to 74% in the US. Only one-third of finance leaders said they had clear visibility into delegated claims funds. And just 1% described collaboration between their claims and finance teams as highly effective.

That last number is the one that stays with me. 1%. These are teams that are jointly responsible for payment execution, reconciliation, and financial oversight — and they're essentially operating in separate worlds. That's not a technology problem. It's a structural one, and it's been allowed to persist because the consequences haven't been visible enough to force a change.

Operational risk doesn't stop at your own front door

One thing that often gets missed in these conversations is that insurance is a network business. A carrier can have its own house in order and still be exposed through the weakest link in its chain. If a TPA, broker, or delegated authority is running on outdated processes — quarterly reconciliations, reactive cash calls, no real-time fund visibility — that's the carrier's problem too. It shows up in payment delays, reconciliation errors, and regulatory exposure.

We see this clearly in our own work. Some of the most sophisticated carriers we speak to have invested significantly in their own operations, only to find that the friction sits with a partner they didn't think to scrutinize. In a delegated model especially, you're only ever as good as the operational standards of the people you've trusted to act on your behalf.

The compliance dimension is hardening

There's also a regulatory dimension to this that I think gets underweighted, and the signals from both sides of the Atlantic are worth paying attention to.

In the UK, following a super complaint in late 2025, the FCA announced it will conduct formal reviews of claims handling, servicing and consumer understanding across the general insurance market in 2026. That's not a consultation paper or a future proposal. This is active scrutiny, already underway, focused specifically on how claims are managed and paid.

In the US, California's new claims laws that came into effect on Jan. 1 this year require insurers to accelerate payouts to wildfire survivors, part of a broader legislative package designed to make payment timeliness a hard obligation rather than a best-practice aspiration. These aren't isolated developments. They reflect a direction of travel that is consistent across markets: regulators are increasingly treating payment operations as a conduct and governance issue, not just an efficiency one.

The practical consequence for insurers is that the back-office processes which were once invisible to regulators are becoming visible compliance signals. Carriers that lack real-time visibility into claims funds, or that rely on manual reconciliation across distributed structures, are carrying more regulatory exposure than they may realize. Fixing the operational gap and fixing the compliance gap are, increasingly, the same exercise.

The investment logic has changed

For a long time, the case for investing in operational infrastructure was framed around efficiency, doing things faster and cheaper. That case was always true, but it wasn't always urgent enough to compete with other priorities.

The framing has shifted. Real-time fund visibility, accurate reconciliation, and controlled disbursement aren't just operational improvements anymore. They're signals to your carrier partners, your regulators, and your claimants that you are a capable and trustworthy counterparty. In a market where margins are compressing and scrutiny is increasing, that signal is worth more than it used to be.

The industry has the tools to make this shift. What it needs now is the recognition that the good years, which helped absorb the cost of operational inertia, may not be coming back in quite the same form. The debt is coming due. The question is whether you address it on your own terms, or wait for the market to force your hand.

How many of you are Amazon Prime members? Amazon launched Prime in 2005—over two decades ago. And for those who are members, when was the last time you actually spoke with a human being at Amazon? My answers: 14 years and never. (Consumer Prime Visa inquiries don't count; those belong to Chase and Visa.)

That's not an accident. From day one, Amazon viewed the call center as a symptom of operational failure. Every inbound customer service call represented something that had already gone wrong—a lost package, a complicated return, a process that should have been invisible or idiot-proof but wasn't. The goal was never to answer calls faster. The goal was to build a business so well-engineered that you didn't have to call at all.

Jeff Bezos understood something most executives still haven't internalized: operational excellence is marketing excellence. The way you run your business—its mechanics, speed, and reliability—is what brings customers back. And repeat customers are the whole game.

Yet many organizations still treat customer service as a cost center to be minimized, not a growth engine to be optimized.

Most service operations run on an open loop. A complaint comes in, a reply goes out, a ticket closes, a metric turns green. Nobody learns anything, and nothing changes. Three months later, the same failure repeats—different customer, same root cause, another quiet erosion of loyalty. That's not a service operation. That's a very expensive complaint acknowledgment system.

Closing the Loop

A closed loop works differently. A complaint doesn't just get answered—it triggers investigation, learning, and change. Feedback drives action, action drives improvement, and improvement becomes permanent. Six Sigma's DMAIC model—Define, Measure, Analyze, Improve, Control—maps to this perfectly.

Define the real problem, not just the symptom. Measure what's actually happening: cycle times, reopen rates, handoffs—the hard data organizations instinctively and politically avoid. Analyze where things break and why. Improve the process. And then, critically, Control to make the fixes stick rather than quietly dissolving into next quarter's backlog.

This is where AI earns its keep—without the hype. At Define, natural language processing can spot ticket patterns across thousands of tickets that no human analyst could find in time. At Measure and Analyze, real-time dashboards make the ugly numbers impossible to ignore (which is the point). At Improve, automation handles standard paths so humans can focus on exceptions. And at Control, AI monitoring keeps improvements from quietly unraveling when attention shifts elsewhere.

The Value of Exceptions

Those exceptions—the weird complaints, the one-off issues, the edge scenarios—aren't burdens. They're signals. Gifts, actually. They're the system telling you something it doesn't yet know how to say. Henry Ford put it bluntly: "Don't find fault, find a remedy; anybody can complain." Exceptions are where the remedy lives, and where the next round of improvement begins. Humans belong there not as a fallback, but as the innovation layer.

Why It Matters

None of this is busywork. You close the loop because closed loops create repeat customers, and repeat customers cost far less to keep than new ones to win. When operations reliably turn complaints into improvements, customers notice. Not always consciously—but they notice the refund that arrived fast, the problem that vanished, the experience that felt frictionless. Wow, that was easy.

Frictionless experiences build loyalty in a way no marketing campaign ever will. Bezos built one of the most valuable companies on exactly that principle. The obsession with operations wasn't separate from growth; it was the growth strategy.

Close the loop. Not because it feels good—though it does—but because it's the surest way to win customers who stay, spend more, and bring others with them.

That's not a customer service story. That's a revenue story.

Rising inflation and the cost of living, geopolitical conflicts, market fluctuations, and mounting debt have left today's consumers feeling overwhelmed by financial uncertainty. As insurance agents, it's important to help them reestablish a sense of control where they can: in their insurance policies.

Too often, people manage their insurance passively, only reaching out to their insurance agents when a claim arises. This may leave them vulnerable to coverage gaps and financially unprepared for the unexpected. As your clients' agent, it is important to encourage them to be more active by setting up regular reviews, assessments, and communication opportunities to keep insurance top of mind. The good news is that many of today's consumers recognize that insurance is essential to overall financial wellness, as it can offer needed coverage during life's most unpredictable moments. 

According to a recent survey by the Independent Insurance Agents & Brokers of America (the Big "I"), nearly nine in 10 Americans (88%) say having insurance is very or somewhat important to their financial security. However, what many insurance consumers fail to recognize is that insurance is not simply a "set-it-and-forget-it" bill they need to pay every month. Not only must they have the proper insurance in place for their assets, but they also need to understand what their policies do and do not cover, and they must be maintained and replaced when necessary to ensure they perform when it matters most. 

According to Big "I"'s survey, only about three in 10 Americans (32%) review or shop for insurance each year, with many waiting until premiums increase, major life changes occur, or coverage issues arise. Half of those surveyed reported that they only revisit their insurance after a premium increase or said they never review their policies at all.

Without a more hands-on approach to policy management, an individual's coverage can drift out of sync with their fiscal goals, assets and priorities. This oversight often goes undetected until a claim, premium increase, or coverage issue brings it to the surface. Yet by the time the policy is revisited at the moment of a triggering event, the consequences of having outdated or misaligned coverage may already be underway.

As insurance agents, it's up to you to help your clients avoid these potential pitfalls. First, it's important to position yourselves as advisors to your clients, not just brokers. The most effective agents in the industry recognize that their roles go beyond transactions, creating opportunities for frequent communication to provide insights and answer questions, thereby building trust and encouraging client retention.

As agents, it's important to move away from the "contact me anytime" advice to creating a system for regular policy reviews. This can mean setting up annual or semiannual check-ins with clients, as well as updates for any trigger-based events, such as a marriage, the purchase of a new home, a new job, or the launch of a new business. Agents can position this as part of their professional service model, creating an opportunity not only to provide advice and answer questions but also to build rapport with their client base. Depending on the preferences of the agent and client, this can be offered in the office or remotely by phone or video call.

During these check-ins, it's important that agents take the opportunity to ask about their clients' recent or coming life or financial milestones. This may uncover triggering events such as welcoming a new child, moving homes, or starting a new side business. Directly prior to or during these meetings, agents may also consider providing a gap assessment. This can help both the client and agent see where the gaps in coverage may be lurking. When laid out in a visual assessment, it is sometimes easier for clients to understand where they may be exposed, such as having an uninsured property, or where they may need additional protections, such as an umbrella policy.

Another tactic agents can use to help clients stay on track and informed is by leveraging digital touchpoints. This includes email newsletters, email blasts, short educational content shared on social media and timely automated reminders. These regular digital communications can keep insurance top of mind for clients and remind them about policy renewals and seasonal risks like hurricanes, wildfires and winter storms. Agents should focus on digital touchpoints that provide value and are timely, relevant and personalized, rather than sales messaging.

Easy-to-digest content in the form of checklists, short videos and real-world scenarios can help clients bridge the understanding of their policies and where there are potential oversights in coverage. Based on responses from a gap assessment, an agent can automate a system to send out a personalized message based on that client's milestone or life update. For example, sending a personalized card to a client congratulating them on the purchase of a new home or welcoming a new baby. Not only are agents providing needed information to clients, but they are also reinforcing a stronger professional relationship with them as their trusted advisor. These efforts in tandem can help encourage clients to be comfortable communicating more regularly with their agents and being more active in the management process.

A successful insurance agent knows that their role goes beyond just transactions. In times of financial uncertainty, today's consumers will lean on their professional network for guidance. This presents a unique opportunity for agents to further educate clients on evolving risks and get them more involved in the overall management of their insurance. By establishing regularly structured check-ins, initiating conversations around life milestones and updates, and leveraging value-driven, consistent communication, agents can build trust and create opportunities to integrate them into the process. When clients are empowered to actively engage with their insurance agents, they are likely to be better informed and protected from the unexpected.

Consider the moment a major commercial building changes hands. Thousands of hours of engineering work, such as structural specifications, systems commissioning data, compliance documentation, and material certifications, are packaged and transferred to the new owner. Those files land on a server, in a cabinet, or across a set of folders. One ownership cycle passes. Then another. The files are gone. Not destroyed deliberately, simply abandoned, scattered across drives of firms no longer involved, locked inside obsolete platforms, or surviving only in the memory of a facilities director who retired years ago.

The building stands. Its documented history does not. For commercial property insurers, that missing history is not an abstraction, it is a direct source of claims uncertainty, underwriting exposure, and loss adjustment cost.

A Systemic Gap with Direct Underwriting Consequences

The construction sector has invested heavily in digital modernization over the past two decades. Collaborative project platforms, cloud-hosted repositories, and real-time coordination tools have transformed how structures are built. The volume of technical data produced on a contemporary commercial project would have been unimaginable a generation ago.

Virtually none of it survives into the operational life of the asset.

The failure is not technological — it is structural. There is no durable identity layer linking digital records to the physical asset they describe. Documentation is organized by project, by vendor platform, by the organization that commissioned it. When any of those containers ceases to exist, the records disappear with them. What the industry lacks is a permanent, asset-anchored identifier that survives every platform migration, ownership transfer, and organizational change.

Where the Chain of Custody Breaks — and Why It Matters to Insurers

The project closeout package is the most complete record of a commercial building that will ever exist in one place — engineering rationale for every system, installation records, test results, and compliance evidence. From the moment it transfers to an owner, that record begins to degrade.

Maintenance logs accumulate in facility platforms that tag equipment by internal numbers with no link to original design records. Renovation files are organized around a contractor's billing structure rather than the property's longitudinal history. Alterations and remediation work exist in isolated project files, disconnected from everything that came before.

For insurers, this fragmentation has an immediate operational cost. When a claims professional investigates a roof membrane failure, a fire suppression malfunction, or a structural movement event, the material specifications, installation records, and service history that would clarify how and why the loss occurred are typically inaccessible — or no longer exist.

The Real Cost to Commercial Property Insurers

Documentation fragmentation creates measurable exposure throughout the commercial property insurance lifecycle. Underwriters pricing a risk on a building with no reliable maintenance history must load additional uncertainty into their assumptions. Loss adjusters investigating claims without installation records face extended timelines and higher settlement costs. Subrogation teams cannot build defensible chains of causation without continuous documentation.

When a disputed claim turns on whether a building system was properly maintained — and the records to establish that compliance no longer exist — carriers absorb costs that a functioning documentation infrastructure would have prevented. Commercial properties generate technically rigorous documentation. That it routinely vanishes within a decade of project completion is a structural failure with direct and quantifiable insurance consequences.

Persistent Infrastructure Identity: A Framework Insurers Should Know

Solving this requires intervention at the identity layer. The emerging approach treats identity itself as foundational infrastructure: a permanent, globally unique identifier assigned to every physical asset at creation and maintained across its complete operational life.

This concept — Persistent Infrastructure Identity (PIID) — draws on precedents that have operated reliably for generations. The automotive industry has used Vehicle Identification Numbers since the 1950s, maintaining continuous records across manufacturers, dealers, insurers, and owners. Aviation assigns registration codes that follow aircraft across operators for the life of the asset. Capital markets use standardized securities identifiers to track instruments across institutions without interruption.

A persistent infrastructure identifier gives every commercial building a stable reference point that belongs to no platform, depends on no organization, and survives every ownership transfer. Engineering documents, construction records, maintenance logs, inspection reports, and renovation filings all point to the same underlying identifier — forming an unbroken chain of custody that follows the structure itself.

What This Means Across the Policy Lifecycle

For commercial property insurers, persistent infrastructure identity offers concrete improvements at every stage.

Underwriting becomes more precise when verified construction data, material specifications, and a documented maintenance record replace self-reported property information. Properties with continuous, verifiable histories present a fundamentally different risk profile than those without.

Claims resolution is faster and less contested when the technical record connecting a loss event to the property's history is traceable. The ambiguity driving prolonged disputes is, in most cases, a direct product of documentation gaps that persistent identity would close.

Portfolio management improves when insurers can assess documentation quality across their commercial book — identifying concentrations of risk in poorly documented assets before losses occur.

The Asset History Insurers Have Always Needed

Commercial property insurers have long managed risk without the benefit of continuous, asset-anchored documentation. That constraint has been accepted as an inherent feature of the built environment. It need not be permanent.

As the national registry initiative progresses toward incorporating approximately 160 million addressable U.S. structures, commercial property insurers are well positioned to engage early — and to help define the documentation standards that will inform underwriting, claims, and portfolio management for decades to come.

Buildings carry the weight of the people who rely on them. They should also carry their own history — and that history should be available when it matters most.

Key Takeaways

• Legacy system fragmentation remains the primary barrier to ROI rather than the AI technology itself.
• Agentic systems replace rigid "if-then" logic with dynamic reasoning to navigate complex underwriting and claims.
• Poor data quality in autonomous loops creates a feedback cycle of bad decisions and financial liability.
• Scaling requires an escalation tier where humans verify AI confidence scores to maintain fiduciary responsibility.
• Insurers without real-time API connectivity risk total disintermediation as brokers and aggregators shift to AI-native ecosystems.

The insurance industry is currently captivated by the promise of agentic AI. Unlike the static "if-then" logic of traditional RPA, agentic systems reason, use tools, and pursue goals. They promise a world of touchless claims, autonomous underwriting, and a fraud defense that evolves in real-time.

For insurers operating under sustained combined ratio pressure, volatile catastrophe (CAT) exposure, and shrinking distribution margins, this shift is strategic. Agentic AI appears to offer operating leverage at scale, compressing expense ratios while improving loss performance and portfolio steering.

Yet, as pilot programs move toward production, a frustrating pattern is emerging: enterprise architecture was built for human-centered silos, not autonomous orchestration. Most global carriers still operate across regionally fragmented cores and vendor-locked policy administration systems (PAS) designed for human-mediated workflows and batch reconciliation.

However, these environments were never built for autonomous orchestration across underwriting, claims, and reinsurance. Without architectural modernization, deploying agentic AI onto these brittle foundations does more than just stall ROI. It introduces new forms of operational and regulatory fragility.

We are moving beyond digital transformation. The real inflection point for insurers is agentic readiness.

The Shift from Rules to Reasoning

Traditional insurance automation is deterministic. A rule engine flags claims above a monetary threshold. A rating engine recalculates the premium based on predefined variables. A referral workflow escalates risks outside delegated authority. These systems are efficient within narrow guardrails, but brittle when context shifts.

Agentic AI changes the operating model. Consider a complex auto claim following a severe weather event. An agentic system can validate storm intensity data, correlate telematics feeds, benchmark repair estimates against regional inflation trends, evaluate prior FNOL behavior, and dynamically recommend reserve adjustments aligned to actuarial development patterns.

In commercial lines, it can ingest broker submissions, extract exposure data from the schedule of values, analyze five-year loss runs, interpret manuscript endorsements, and draft underwriting rationale aligned to delegated authority and treaty structures. The misconception is that these capabilities can be layered onto legacy cores.

In reality, most multinational insurers operate across heterogeneous policy administration systems spanning geographies, lines of business, and regulatory regimes. Human underwriters, adjusters, and operations analysts still bridge gaps between claims, billing, reinsurance, and finance. When an autonomous agent attempts cross-system orchestration, it encounters API limitations, latency constraints, inconsistent data lineage, and fragmented identity management.

Data Quality Debt is the Silent Destabilizer

In the context of agentic AI, data quality is a solvency risk. When an agentic system is given the autonomy to adjust reserves or initiate endorsements, "dirty" data, such as inconsistent loss history or fragmented policy records, becomes a feedback loop of bad decisions.

An agentic-ready carrier requires modular, API first architectures where rating events, reserve movements, underwriting referrals, catastrophe exposure updates, and reinsurance recoverables are observable within unified event streams. Agents must learn against actual loss emergence and settlement outcomes — not synthetic feedback loops detached from financial reality.

The Necessity of Human-in-the-Loop Governance

A frequent concern among regulators and C-suite executives is the loss of control. How do we ensure that a non-human identity doesn't errantly deny a valid claim or misprice a catastrophic risk? The answer lies in replacing vague oversight with structured role-based governance.

The architecture must support both Underwriter-in-the-loop (UITL) and Adjuster-in-the-loop (AITL) controls. These are integrated UI/UX components where the AI presents its reasoning, its confidence score, and the specific data points it used to reach a conclusion.

This is particularly vital in specialized lines like Directors and Officers or Cyber insurance, where the risk landscape shifts faster than any model can retrain. By designing architecture that treats the human as an escalation tier rather than a manual processor, insurers can scale without abandoning fiduciary responsibility.

Defensibility in the Age of Autonomy

When an AI agent takes an action such as denying a claim or adjusting a premium, insurers must provide a defensible audit trail that stands up to regulators and reinsurers. Traditional logs that show updated system records are no longer sufficient. We need immutable agent action logs.

This technical requirement involves documenting what tools were queried, what version of the model was used, and what specific data inputs were retrieved at that exact millisecond. In healthcare and life insurance, where compliance is non-negotiable, this level of transparency is the difference between a successful deployment and a multimillion-dollar fine. If you cannot reconstruct the logic of an autonomous decision six months after the fact, that decision is a liability.

Distribution Disruption: Agentic AI Beyond the Core

The disruption is not confined to internal operations. AI-native insurance apps embedded within conversational platforms are reshaping distribution economics. When quoting, comparison and policy binding move into AI ecosystems, insurers with brittle core systems will struggle to expose pricing, underwriting rules, and policy data through secure, real-time APIs. Agentic readiness is both an operational capability and a distribution survival requirement.

In personal lines, AI-enabled aggregators can dynamically compare pricing and coverage language across carriers in seconds. In commercial lines, digital brokers are beginning to pre-qualify submissions using AI copilots before they ever reach an underwriter. Insurers that cannot expose pricing, appetite, capacity constraints, and policy data through secure, scalable APIs risk being disintermediated.

Agentic readiness is therefore not just an operational capability. It is a distribution survival requirement. Architectural modernization determines whether an insurer participates in AI native ecosystems or becomes invisible within them.

Rethinking Accountability and Compliance

The biggest compliance risks emerge when accountability for AI-led decisions is poorly defined. If an agentic system in a personal risk management workflow makes a discriminatory pricing error, who is responsible? The data provider? The model developer? The enterprise architect who enabled the integration?

To mitigate this, we must shift our view of enterprise risk management (ERM). We are entering an era where agent identities must be managed with the same rigor as human employees. This means assigning specific permissions, spending limits, and kill switches to autonomous agents. In areas like disaster recovery and planning, agentic AI can be a massive asset, but only if the guardrails are hardcoded into the architecture, not just the policy manual.

The Path Forward from Silos to Orchestration

The payoff for solving these architectural challenges is measurable and profound. Insurers who move beyond the pilot purgatory of agentic AI see higher straight-through processing (STP) rates, lower leakage, and significantly faster cycle times. But more importantly, they build a resilient foundation that is ready for whatever the next generation of intelligence brings.

The transition from a process-centric organization to an agentic-ready one is a necessity for survival in a high-frequency, high-data-volume environment. We must stop asking if the AI is ready for insurance and start asking if our insurance architecture is ready for AI. The future of the industry belongs to those who treat their enterprise architecture not as a collection of legacy systems, but as a living, breathing nervous system capable of supporting autonomous thought.

The market is rapidly moving from generative AI to agentic AI. That shift is often described as a simple upgrade: smarter models, better automation, more efficient workflows. But that description is too shallow.

Generative AI mainly answers questions. Agentic AI does something more consequential: It can interpret instructions, call tools, trigger workflows, access files, and execute tasks on behalf of a user. In other words, the issue is no longer only whether AI can generate better text. The issue is whether we are allowing AI to participate in action. That is a structural shift, not a feature upgrade.

Deloitte's recent enterprise reporting reflects this transition, noting growing expectations that agentic AI will affect customer support, knowledge management, cybersecurity, and other operational functions. This matters because the real shift is not from weak intelligence to strong intelligence. It is from advisory systems to delegated systems.

A chatbot may suggest. An agent may act.

That single difference changes the risk model entirely.

From Answering to Acting

For most users, systems such as ChatGPT or DeepSeek still operate within a conversational boundary. A user submits information, the model returns text, and a human remains the final executor. Even if the answer is flawed, biased, or manipulative, there is still a layer of human interruption between output and action.

Agentic systems reduce that gap.

Once an AI system can browse, retrieve, write, send, purchase, schedule, or invoke external tools, the human is no longer necessarily the last checkpoint in the chain.

The architecture changes from:

human judgment → human action

to something closer to:

human intent → AI interpretation → AI execution

This is why the current excitement around agents should not be discussed only as a productivity story. It is also a governance story.

The Real Issue Is Authority

Most public discussions still frame agents as a question of capability: how autonomous they are, how many tools they can call, and how many tasks they can complete. But for enterprises, especially in regulated sectors such as insurance and financial services, the deeper issue is not capability. It is authority.

An agent is powerful not because it knows more, but because it is allowed to do more.

OWASP has already treated prompt injection as a leading LLM risk, and its newer work on agentic applications makes clear that the execution layer is where connected systems gain real-world impact, precisely because it determines what resources an agent can access and how far its actions can propagate.

In a conversational setting, a malicious instruction may only distort an answer. In an agentic setting, the same logic can distort behavior. It can trigger unauthorized execution, expose sensitive data, or redirect workflows in ways that are difficult to detect before harm occurs.

This is the real turning point. The threat is no longer limited to toxic content, hallucinated responses, or compliance violations. It now includes unauthorized execution, data leakage, workflow deviation, and invisible action taken under delegated authority.

Microsoft's recent security guidance on agentic AI similarly emphasizes that insufficiently governed agents can expose sensitive data, act on malicious prompts, and create hard-to-detect execution risks across connected systems.

Insurance Is About Responsibility

This matters especially in industries where trust, explainability, and accountability are not optional.

Insurance has always relied on decision chains: underwriting, pricing, claims handling, customer communication, policy servicing, fraud review, and compliance oversight. The traditional assumption is that even if digital tools assist the process, a human remains accountable at the point of interpretation or intervention.

Agentic AI weakens that assumption.

A well-designed agent may summarize customer intent, recommend next-best actions, draft service responses, trigger follow-up tasks, or coordinate actions across systems. These capabilities can create real gains in speed and scale. But they also shift the operational perimeter. The risk no longer sits only in the model's answer quality. It sits in what the system is authorized to touch, trigger, approve, or disclose before a human notices.

This is where a deeper distinction becomes important.

In insurance, contractual meaning can often be processed by a system. Policy language can be summarized. Claims data can be classified. Customer signals can be scored. But responsibility cannot be delegated in the same way. The institution must still stand behind the consequences of decisions, exceptions, disclosures, and commitments.

AI may support interpretation. It cannot occupy the position of accountable judgment.

That is why the central question is not whether agentic AI can become more useful. It is whether firms remain clear about which forms of authority should never be fully delegated.

Why the Market Still Misunderstands the Shift

Much of today's agent conversation remains trapped in a tool mindset. The underlying assumption is that AI is simply becoming a more capable assistant. But that framing understates what is happening.

When a system moves from generating text to taking action, we are no longer discussing a tool in the narrow sense. We are discussing a participant in the decision chain. That creates at least three conceptual mistakes.

The first is mistaking execution for intelligence. Many agent demos look impressive because they complete workflows, but workflow completion is not the same as reliable judgment.

The second is mistaking convenience for safety. A smoother interface often hides a deeper expansion of permissions.

The third is mistaking automation for accountability. Just because an action is automated does not mean responsibility has disappeared. In regulated sectors, it usually means the opposite: the need for traceability becomes even greater.

NIST's Generative AI Profile reinforces this broader point: AI systems do not reduce the need for governance; they increase the need to map, measure, and manage risk across the full lifecycle, especially once models are embedded in systems that can act.^4

This is why the most important boundary remains a human one. The practical lesson is not that organizations should reject agents. It is that they should stop treating deployment as a binary choice between "manual" and "fully autonomous."

Where the Boundary Should Be Drawn

In most enterprise settings, especially where customer trust, financial outcomes, or regulatory obligations are involved, the right architecture is not total automation. It is bounded agency.

That means at least three things.

First, authority should be segmented. An agent may retrieve, draft, classify, or recommend, but it should not automatically approve, transfer, commit, or disclose without explicit control points.

Second, permissions should be narrowly scoped. The problem is rarely that the model is too clever. The problem is that the connected system is too open.

Third, decision logs must be visible. Once AI participates in action, observability is no longer a technical luxury. It becomes a governance requirement.

These are not merely technical safeguards. They are ways of preserving the line between delegated analysis and non-delegable responsibility.

The next phase of AI competition will not be about who has the smartest model. It will be about who builds the most trustworthy decision architecture.

That is particularly relevant for insurance.

The sector does not need agents that merely act faster. It needs systems that can support complex judgment while preserving accountability, auditability, and customer trust. In this sense, the core issue is not whether agentic AI will enter insurance. It already is. The real issue is whether firms will adopt it as a layer of uncontrolled execution, or design it as a disciplined form of human-machine collaboration.

The market often celebrates the moment when AI can do more. But for leaders in insurance, the more important question is different:

When AI can do more, what should it still not be allowed to do?

In insurance, the challenge is not only what a system can interpret. It is what an institution is willing to stand behind.

That is where the future of agentic AI will really be decided.

Notes:

1. Deloitte, State of Generative AI in the Enterprise (reporting on the shift toward agentic AI and the role of governance, risk management, and organizational readiness).
2. OWASP GenAI Security Project, "LLM01: Prompt Injection"; see also OWASP, Top 10 for Agentic Applications (2026).
3. Microsoft Security, New tools and guidance: announcing Zero Trust for AI.
4. National Institute of Standards and Technology (NIST), Artificial Intelligence Risk Management Framework: Generative AI Profile (NIST AI 600-1).

There's an uncomfortable conversation happening across the industry. Independent agents are spending real time helping clients understand cyber liability exposure – walking them through what underwriters want to see, what gaps create problems at renewal, and what a breach actually costs. And many of those same agents are running their own operations on shared passwords, informal access arrangements, and a working assumption that nothing bad will happen to them.

That assumption is getting harder to justify. Cyber underwriters are applying the same scrutiny to agencies that agencies apply to their clients. The questions at renewal are getting more specific. And agents who can't demonstrate basic credential discipline may find themselves in an awkward position, struggling to answer questions they've been asking their clients for years.

The access problem nobody sits down to create

Credential sprawl doesn't happen because anyone made a bad decision. It happens because agencies grow.

A new carrier portal gets added. A staff member needs access to a client management system, so someone shares their login to get things moving. Another person leaves, but their credentials aren't fully revoked. They just stop being used, as far as anyone knows. Over time, no single person has a complete picture of who can reach what.

This is the normal pattern in small agencies, and the problem isn't negligence; it's the absence of governance. When the priority is always the client in front of you, internal operations fill in around the edges however they can. Spreadsheets become the credential store. Memory becomes the access policy.

That works until it doesn't.

The bar has moved – and MFA alone won't clear it

A few years ago, having multi-factor authentication (MFA) in place was enough to satisfy most cyber underwriters. That's no longer true.

MFA is now a baseline requirement. What underwriters are looking for beyond that is privileged access controls, documented audit trails, zero-trust principles, and evidence that offboarding is immediate and verifiable when someone leaves. The reason for this tighter scrutiny is that social engineering and credential compromise now account for the majority of breach incidents. Underwriters have adjusted their models accordingly.

The harder issue is proof. Saying the right things on an application isn't the same as being able to demonstrate that controls are in place and actively used. Cyber underwriters increasingly want to see evidence of continuing compliance. A clean snapshot taken at the moment of the audit won't meet the bar.

The risk isn't only higher premiums. An agency that suffers a breach and can't demonstrate it was operating as it claimed may find its coverage denied. That's a different kind of problem entirely.

What a practical audit actually looks like

Agencies don't need a dedicated IT team to close the most important gaps. They need a clear-eyed look at what they actually have.

Start by mapping access: every carrier portal, every client management system, every shared tool, and who currently holds credentials for each. Most agencies find this exercise surfaces access that should have been revoked months ago.

From there, apply a simple principle: access should match role and need. Not everyone requires access to everything, and treating it as though they do creates exposure for no good reason. This is what's meant by least-privilege access, and it's one of the controls underwriters are now specifically looking for.

Build an offboarding checklist and use it without exception. When someone leaves, credential revocation should be immediate and documented. The audit trail matters.

Finally, move credential storage out of spreadsheets and shared documents and into a structured system that logs activity. Who accessed what, when, and what changed. That record is what turns good intentions into demonstrable practice.

The credibility case

The agencies that get this right aren't just better protected. They're better positioned.

When a client asks hard questions about cyber risk, the advisor who manages their own exposure rigorously is speaking from experience, not theory. That's a different kind of credibility, and clients can tell the difference.

The underwriting environment will keep tightening. The agencies that build these habits now – before the renewal conversation forces the issue – will find they've solved two problems at once: their own security posture, and their standing as a trusted voice on everyone else's.

The requirement to demonstrate what you preach isn't new to this industry. It's just arrived in cyber.

My favorite anecdote from last week's ClimateTech Connect was a little gem of high tech meeting low tech: a sophisticated network of sensors and a woman with a rake that, together, are protecting hundreds of homes from flooding.

A panelist at the conference on mitigating the risks from climate change said flash flooding had washed away some 300 homes in a small town in the U.K. As the insurance industry helped it rebuild, the town took advantage of improvements in technology and installed sensors that monitor upstream water levels. When they reach potentially dangerous levels, an alarm sounds in the mayor's office. A clerk then grabs her rake and walks down the street, where she clears the debris that collects in a culvert, ensuring that any flood waters will quickly run off.

Few problems have such simple, happy solutions, of course, but the conference still offered some hopeful signs in a world seemingly buried under warnings of impending doom. The mere fact that hundreds of senior people from a whole variety of vantage points — big banks, home builders, municipalities, etc., as well as insurance companies — spent two days in Washington, D.C., strikes me as a good sign.

I'll share a few highlights, in the hope they provide food for thought.

A former fire chief said my second-favorite thing at the conference. I almost hesitate to share, because, in retrospect, what he said is obvious. But it had never occurred to me, and, in my defense, I hadn't heard anyone else say it despite having spent years wrestling with how to get people to understand that everyone  in a community is in the fight together when it comes to wildfire risk.

I knew that reducing the risk to my house reduced the risk to yours, and vice versa, but I didn't think strategically enough — and the former fire fighter helped me out. He said it doesn't help a community much to have a scattershot approach to hardening homes against fire. He said communities have to be systematic. That means focusing on the homes at the edge of the community closest to the wildlands that might catch fire, while worrying far less about the homes that are well inside the boundary. 

That sort of approach not only makes sense but seems more manageable. It reduces the amount of money that is needed to protect a community and takes some of the onus off individual homeowners to alter their landscaping, put mesh over vents to keep embers from getting into a home, etc. A homeowners association could undertake the hardening work on the key homes on behalf of the whole community. 

Or a community could follow the lead of Amy Berry, CEO of the nonprofit Tahoe Fund. She has raised $30 million of private capital to leverage $200 million of public funds for more than 220 projects, including five in the Tahoe area that take the sort of approach advocated by the ex-fire chief. The fund uses public resources to identify homes that could be "superspreaders," then knocks on their doors and offers to help harden their homes. (These projects are near and dear to my heart, given that I used to live just down the road from three of these projects. When I mentioned the name of the town that had our favorite pizza place, she said its name instantly.)

More broadly, the conference embodied the sort of broad conversation, reaching well beyond the insurance industry, that needs to happen. Francis Bouchard, a managing director at Marsh, has hit that theme hard at ITL, including in an interview I did with him last fall and in a webinar I conducted with him and Nancy Watkins, a principal at Milliman, in December. At ClimateTech Connect, Francis continued the theme with a fireside chat with Illya Azaroff, president of the American Institute of Architects. He represents 110,000 architects and described all he's doing to try to get them to design for resilience from the get-go. JP Morgan, which has announced a massive financing initiative related to climate change, was represented by Sarah Kapnick, its global head of climate advisory. The climate chief for Massachusetts was there, too. 

So, there was a broad array of important, interested parties even before you got to the insurance ecosystem, well represented by Nationwide, Travelers, Munich Re, etc., including a host of intriguing technology startups. There were lots of foreign accents, too, which suggests that we're getting the sort of cross-fertilization of ideas that really hard problems require. 

The only real disappointment was that the federal government didn't show, other than to describe what data sets might be available and useful, but that lack of presence was hardly a surprise, given the current administration's stance on climate change and promotion of fossil fuels.

Denise Garth, chief strategy officer at Majesco, told a story that epitomized for me just how hard we're going to have to keep pushing. A storm with huge hail hit her home in Omaha, doing $140,000 of damage, including requiring a new roof. Her insurer, a top-five carrier, promptly cut her a check, but its agent missed an opportunity of the sort we just can't miss if we're going to make the world more resilient. 

It was only when Denise started dealing with a roofing contractor that she learned that rubber roofs were available that looked like tile, shake or whatever she wanted. In the future, hail would just bounce off. She had a rubber roof installed and actually got a 20% discount from her carrier as a result. But somebody — actually, lots of somebodies — needs to do a much better job of educating agents and encouraging them to counsel customers. 

After attending last week's conference, I'm encouraged about the progress we're making on resilience, but we have a long way to go.

Cheers,

Paul

The insurance sector has a well-documented mismatch between its AI ambition and operational readiness. While 82% of insurance companies believe AI will define the industry's future, only 14% have fully integrated it into their financial operations, and 52% describe their data governance frameworks as early-stage or still developing. The distance between those numbers reflects how most firms are approaching AI as a strategy to announce rather than an operational capability to build.

All data cited in this article is from AutoRek's 2026 Insurance Operations and Financial Transformation Report, based on 250 interviews with insurance and healthcare insurance managers across the U.S. and U.K. The three most commonly cited barriers were legacy system integration challenges (42%), fragmented data environments (39%) and a shortage of in-house AI expertise (40%). None of these are new problems, but the cost of carrying them forward has grown significantly.

Data fragmentation is the core problem

The average insurer managed 17 data sources feeding premium processes alone. Each source represents a different format, a separate update frequency and another potential point of failure in the reconciliation chain. AI deployed across such an environment does not streamline operations; instead, it amplifies the inconsistencies already embedded within those systems.

This is why firms that have made measurable progress on AI integration share a starting point. They first standardized their data architecture before layering on automation capabilities. They also built workflow and governance frameworks that are auditable and measurable rather than theoretical. Reconciliation was typically automated first, creating a reliable and consistent data environment that makes AI-driven workflows viable later in the process.

M&As create back-office operational complexities

Industry consolidation is accelerating, and the operational burden is falling on already strained infrastructure. 54% of insurers said incompatible systems and data architectures were their biggest post-merger integration challenge. For firms managing over a dozen data sources before a deal closes, an acquisition means introducing additional complexity before the existing complexity is resolved.

The carriers who are able to realize sustainable value from the merger treat data harmonization as pre-merger work. Integration planning begins at the architecture level rather than after the deal closes, ensuring that new systems are absorbed into a standardized environment instead of being added to an already fragmented one.

Settlement cycles measure operational health

44% of insurers faced settlement periods exceeding 60 days. Transaction volumes are projected to grow 28.7% over the next two years.

Settlement cycle length is the clearest indicator of how well data moves between systems and how much manual intervention is required to close transactions. Firms with shorter settlement cycles have typically completed foundational infrastructure work, including implementing automated reconciliation, reducing the number of data sources and establishing governance frameworks. The correlation between operational discipline and AI readiness was consistent across the research.

The data show a clear path forward

Despite the persistent barriers, the research shows clear intent to act with 50% of firms prioritizing AI and machine learning, 42% focusing on automation of back- and middle-office functions and 51% citing regulatory requirements were the primary driver of modernization decisions.

Insurance firms seeing results from those investments have sequenced them deliberately. They have taken a structured approach, starting with governance frameworks, followed by data standardization, then building automation on top before introducing AI. That sequencing matters because AI running on fragmented, manually managed data will produce similarly fragmented and manually intensive results, only at greater speed and cost.

The operational reality from inside the carrier

I spent 12 years within the carriers including MetLife, HSBC Life, Aviva, AIG and Generali before moving into insurtech. The constraints highlighted in this research were recognizable from the inside. The organizations that made the most progress treated back-office infrastructure as a strategic investment rather than an operational cost and made data quality an asset and a prerequisite for adopting new technology.

With 6% of insurers reporting no AI usage in financial operations at all, the performance gap between firms that have modernized and those that have not is widening. As transaction volumes grow and consolidation continues, that gap will complicate the path forward for firms that have deferred the infrastructure work. The decisions insurers make about data infrastructure in 2026 will determine how much value they ultimately capture from their AI investments.

For decades, commercial insurance has operated on a largely reactive model. Insurers assess risk using historical data, price policies at the start of the cycle, and respond financially after losses occur. While this approach has ensured stability, it is increasingly misaligned with today's dynamic risk environment.

Industries such as logistics, transportation, and construction now operate under continuously evolving conditions, where risk exposure changes in real time. In this context, static underwriting and retrospective claims management create critical blind spots, limiting both visibility and control. The widening gap between how risk is priced and how it behaves is placing growing pressure on traditional insurance models.

At the same time, advances in telematics and connected technologies are redefining what insurers can observe and influence. Real-time behavioral and operational data is enabling a shift toward continuous, intervention-driven risk management.

Understanding the Emergence of Continuous Insurance

Continuous insurance represents a structural shift in how risk is assessed and managed. Instead of periodic evaluations, insurers can now maintain a real-time view of exposure through continuous data streams.

Telematics plays a central role in this transformation. By capturing detailed data on asset usage, environmental conditions, and human behavior, telematics systems provide a level of insight that was previously unattainable. This allows insurers to move beyond static assumptions toward dynamic, evidence-based risk assessment.

As a result, insurance is evolving from a transactional model into a continuing process—where risk is continuously monitored, interpreted, and influenced. Intervention is no longer reactive; it is increasingly preventive.

Telematics as the Backbone of Real-Time Risk Visibility

The growing adoption of telematics insurance is not simply enhancing existing models but redefining their foundation. What makes telematics transformative is its ability to convert operational activity into measurable and actionable risk signals.

In commercial auto insurance, for instance, telematics systems capture driving patterns such as acceleration, braking behavior, route selection, and exposure to high-risk environments. This creates a continuous feedback loop where risk is not inferred from past incidents but observed directly as it unfolds.

More importantly, this data does not remain static. Through advanced analytics, it is translated into risk intelligence that can inform immediate decision-making. Insurers can identify emerging patterns, anticipate potential incidents, and enable timely interventions that reduce the likelihood of loss.

This shift from data collection to real-time intelligence marks a critical step in the evolution toward continuous insurance.

The Transition from Periodic Underwriting to Continuing Risk Evaluation

Traditional underwriting operates within defined timeframes, often relying on annual policy cycles. While effective in stable environments, this approach struggles to capture the variability of modern risk landscapes.

Continuous insurance introduces a more adaptive model where underwriting becomes a continuing process. Real-time inputs from telematics systems allow insurers to reassess exposure continuously rather than at fixed intervals.

This has several implications. Risk pricing becomes more closely aligned with actual behavior and conditions, reducing the gap between expected and realized outcomes. Emerging risks can be identified earlier, enabling corrective actions before they escalate into claims. Over time, this leads to more accurate underwriting and improved portfolio performance.

The shift is not merely operational but conceptual. Risk is no longer treated as a fixed attribute but as a dynamic variable that requires constant evaluation.

Redefining the Role of the Insurer in a Continuous Model

As insurance becomes more data-driven and continuous, the role of the insurer is undergoing a fundamental transformation. The traditional function of compensating losses after they occur is being complemented by a more proactive role in preventing those losses altogether.

Telematics insurance enables insurers to engage directly with policyholders in managing risk. By providing real-time insights and behavioral feedback, insurers can influence decision-making at the point where risk is created. This represents a shift from financial protection to operational partnership.

In this emerging model, insurers are not external entities responding to events but integrated participants in their clients' risk environments. Their value lies increasingly in their ability to reduce uncertainty rather than simply absorb it.

Operational Impact of Telematics in Commercial Fleet Environments

The operational impact of telematics insurance is most clearly visible in commercial fleet environments, where real-time data has become integral to both risk management and performance optimization. By continuously capturing and analyzing driver behavior and vehicle usage, telematics enables insurers and fleet operators to move beyond retrospective assessments and actively manage risk as it develops.

This shift introduces a dynamic feedback loop in which data-driven insights inform immediate actions, improving both safety outcomes and operational efficiency. Over time, this not only reduces claims but also enhances overall fleet performance, creating a more aligned and resilient risk ecosystem.

Key operational outcomes include:

• Continuous visibility into driver behavior, including speeding, harsh braking, and route risk exposure
• Early identification of high-risk patterns, enabling timely corrective interventions
• Improved driver accountability through continuing monitoring and performance feedback
• Reduction in accident frequency, supporting better loss ratios and underwriting performance
• Enhanced fleet efficiency through optimized routing, fuel management, and predictive maintenance

Strategic Realignment in a Telematics-Driven Insurance Landscape

The rise of telematics insurance is not only transforming operations but also driving a broader strategic realignment within the insurance industry. As real-time data becomes central to risk assessment, insurers are being compelled to rethink how they compete, collaborate, and create value.

In this evolving landscape, the ability to access, interpret, and act on data is emerging as a critical differentiator. At the same time, insurers must navigate increasingly complex ecosystems where data flows across multiple stakeholders, raising important questions about ownership, control, and long-term positioning.

This transformation is both technological and organizational, requiring insurers to build new capabilities while shifting toward a more proactive and partnership-oriented model.

Key strategic implications include:

• Real-time data emerging as a core driver of underwriting accuracy and competitive differentiation
• Increased importance of data ownership and control in shaping long-term market positioning
• Greater reliance on partnerships with telematics providers, platform operators, and OEMs
• Expansion of insurer capabilities in advanced analytics, real-time processing, and digital infrastructure
• Evolution of business models toward continuous engagement rather than periodic interaction
• Cultural shift from reactive claims management to proactive risk prevention and client collaboration

A Structural Shift Toward Embedded and Preventive Insurance

The movement toward continuous insurance reflects a broader transformation in how risk is conceptualized. Insurance is gradually becoming embedded within the operational fabric of businesses, supported by real-time data and continuous feedback loops.

Telematics insurance will remain central to this evolution, enabling insurers to maintain visibility and influence at every stage of the risk lifecycle. As adoption increases, the distinction between risk assessment and risk management will continue to blur.

Over time, this will lead to a model where prevention becomes the primary objective and claims become less frequent by design.

Conclusion

The transition from risk transfer to risk intervention represents a defining shift in commercial insurance. Telematics insurance is at the core of this transformation, enabling continuous visibility, predictive insight, and proactive engagement.

Insurers that successfully adapt to this model will move beyond their traditional role and become integral partners in managing and reducing risk. In an increasingly complex and fast-moving environment, the ability to intervene before loss occurs will determine long-term relevance and competitive advantage.