Compliance: The Last Outpost of Digitalisation

1. The last outpost of digitalisation

Over the past two decades, digitalisation has reshaped almost every part of an insurance company. Pricing runs on models and data. Claims are reported online, triaged and increasingly settled automatically. Customers buy and change cover through digital channels. Finance and solvency reporting are produced from structured data, and the quantitative reports insurers send to their supervisors are submitted in a standardised, machine-readable format.

Compliance and governance stand out against this picture. The policy documents that set how the company is run, and that show how it meets its regulatory obligations, are still mainly written, reviewed, approved and stored as documents for people to read. Much of the work around them is manual: finding the right version, checking what applies, tracing how one document relates to another. The numbers an insurer reports are digital; the governance that explains how it is run largely is not.

This is not because compliance functions have been slow or unwilling. It is because the information is of a different kind. Pricing, claims and reporting deal largely with quantitative information, which lends itself to databases and calculation. Compliance deals with qualitative information: principles, interpretations, obligations and the reasoning behind them. Much European insurance regulation is principles-based by design, so applying it calls for judgement, proportionality and context rather than fixed values. That kind of information has never been structured with digitalisation in mind, and until recently there were few practical tools for turning it into something digital processes could use.

That is now changing. And as compliance information meets the same digital demands as the rest of the business, it runs into the problems every digitalisation effort has met before.

2. Three familiar problems

Every digitalisation effort, in any industry, has stumbled on information that comes in many shapes and was never structured for machines. Compliance information is no exception. Three problems stand out.

Structure: how the documents are built. Policy documents are written for human readers, and each is built in its own way. Where a requirement sits, what it applies to, who it concerns and how it relates to other documents is expressed in prose, headings and cross-references, if at all. Documents refer to one another by title rather than by any stable identity, so a reference quietly stops pointing anywhere when a title changes. A person with experience can find their way. A digital process cannot, because nothing tells it where the information is or what it means.

Format: what the documents are made of. The same framework can contain Word files, PDFs, intranet pages, spreadsheets and scanned annexes, each with its own layout. Tables appear as images, numbering differs from document to document, and versions exist side by side. Part of the meaning often sits in the formatting itself, in a table or diagram that is an image or in a colour that marks what has changed, and that is exactly what is lost when the text is simply lifted out of the document. This is the classic problem of unstructured data that other functions have had to solve before they could digitalise.

Storage: where the documents live and who holds them. We might expect this to be solved by now, with GRC systems and document management in place at most insurers. Yet governance documents are often spread across different systems and folders and held by different owners. It is not always obvious what the full set of documents is, how they fit together, or what governance structure surrounds them. The information exists, but the overall picture is held by people rather than recorded anywhere.

None of these problems are new. What is new is that they now stand between compliance and the digital processes being built around it. There is also more at stake than efficiency. When every requirement in a regulation can be traced to the passages in the policy documents that address it, two kinds of problem come into view that reading one document at a time does not reveal: requirements that no document addresses at all, and requirements that two documents address in ways that do not agree, for instance by giving the same responsibility to different roles.

3. What happens if compliance stays on the side

The rest of the business is not waiting. Processes are being automated, decisions are increasingly supported by data and AI, and systems exchange information without a person in between. If governance information remains in documents only people can use, a gap opens between how the company says it works and how its digital processes actually work.

Consider a situation most insurers will meet within the next year. An amended article of the revised Solvency II framework changes what a key function is expected to do. Someone must establish which of the company's policy documents are affected, who owns each of them, and which other documents refer to the ones that change. When governance lives in documents only people can read, that work starts with a search, and its completeness rests on memory; the digital processes built on those documents then inherit whatever is missed. Insurers put the same question to us in practice: if we change this policy, what else must change?

Three consequences follow. Compliance becomes a bottleneck, checked manually after the fact rather than built into the processes it is meant to govern. Governance is bypassed, not deliberately, but because digital processes cannot see it. And explaining decisions gets harder, at a time when supervisors increasingly expect insurers to show how decisions, including AI-supported ones, follow from their governance.

The risk is not that compliance falls behind technically. It is that governance ends up beside the business instead of inside it.

4. Why it belongs higher on the agenda

Insurers have learned, function by function, that digitalisation starts with data: structured, findable and owned. Compliance and governance deserve the same treatment. Three developments make the timing concrete.

There is a natural occasion. The revised Solvency II framework applies from 30 January 2027, and most insurers will review a large part of their policy documents against it; structuring the information as part of that work costs less than doing it later as a separate project. Expectations are rising. Supervisors increasingly ask insurers to explain how decisions are made and governed, including where AI is involved, as EIOPA's opinion on AI governance and risk management makes clear. And the tools have arrived. Working with qualitative information at scale was long impractical; advances in AI now make it realistic to analyse, structure and connect large volumes of text, with people reviewing and approving the result.

That last condition matters. A structured result is only worth trusting if every link it makes can be traced back to the text it came from, so that a person can check the reasoning rather than simply accept the conclusion.

For boards and executive teams, a few questions are a useful start:

• Do we know the full set of our policy documents, where they are kept and who owns them?
• Could we show, without a lengthy search, how a given regulatory requirement is reflected in our governance?
• When we digitalise a process, is our governance part of the design, or added afterwards?
• Who owns the structure of our compliance information: compliance, IT, or no one?

Digitalising compliance is not a technology project for its own sake. It is about making sure that, as the rest of the insurance company becomes digital, its governance comes along.