What new AI rules mean for insurers selling through AI agents

Insurers are starting to ask what new rules on AI agents mean for them. If Europe limits what agents can buy, and the UK follows, can an insurer still sell through AI agents? The short answer is yes, and the rules point towards what insurers will need to show when they do.

What Europe has actually done

There is no EU rule that ranks purchases by risk and bans AI agents from the risky ones. There are two things people are usually thinking of.

The AI Act is in force, and it classifies AI systems by risk, not transactions. Insurance appears on its high-risk list only for risk assessment and pricing in life and health insurance. Car, home, travel, and most other general insurance distribution is not high-risk. The obligation the Act places on high-risk systems is human oversight: a person's ability to understand, intervene in and, where appropriate, confirm what the system does before it acts. Legal commentators reading the Act for agentic use cases translate that into "confirmation prompts before high-impact actions" and "configurable automation boundaries".

The Digital Fairness Act isn't published yet; the Commission's proposal is expected in mid-November 2026. The European Parliament's own research briefing notes the Commission found "insufficient evidence to draw firm conclusions" on automated contracting, so the first draft is unlikely to legislate for agent purchasing in detail. The policy work that has shaped the debate, from CERRE and from the leading academic work on consumer law for AI agents, points away from a ban: a consumer right to use AI agents, a "no barrier" principle that stops traders from blocking them, and human control exercised when a person hands a task to an agent. Nobody in Brussels is proposing one for insurance.

The open question for insurers

EU consumer law already requires a consumer to explicitly acknowledge that a purchase carries an obligation to pay. Whether an AI agent can give that acknowledgement on a person's behalf is, as CERRE puts it, unresolved. The same tension exists in UK rules: insurance distribution rests on the customer's informed decision and their demands and needs, and Consumer Duty expects the firm to be able to evidence that the customer understood what they bought.

Until regulators settle that question, an insurer accepting a sale that started with an agent needs one thing above all: a signed, time-stamped record that the person behind the agent saw the terms and agreed to them. That record is what lets an insurer welcome agent sales with confidence.

What about the UK?

The UK has no AI Act, and the FCA has said it isn't writing a standalone AI regime. Its Mills Review, published in July 2026, expects roughly 11 million UK adults to delegate tasks such as "arranging insurance" to AI agents, and looks at the questions that raises through Consumer Duty, the Senior Managers regime, and the regulatory perimeter: when does an agent start doing regulated distribution or advice?

For insurers, the practical point is where the evidence sits. The approval should sit with the regulated firm, not the agent platform, and the insurer should hold the record in its own region, in a form it can produce for a regulator or an ombudsman. If UK rules come to require a person to confirm before an agent buys insurance, insurers that already keep that evidence will be ready.

How the rules could develop

There are three ways things could go, and each changes what insurers need.

1. Agents restricted in insurance distribution. This runs against every current policy signal in Europe and the UK: a right to use agents, no barriers, and a regulator working on "the foundations for agentic finance". It looks unlikely.
2. Consent given up front. Regulators and payment schemes could decide that setting a budget and a list of trusted suppliers in advance is enough, with no confirmation for each purchase. For groceries and subscriptions, that's probably where things land. Insurance is less likely to go that way: each policy is a contract with its own disclosures, exclusions and price, and when it's wrong, the customer finds out when they claim.
3. Confirmation built into the checkout rails. Agentic commerce protocols may add a generic "confirm purchase" step. That helps, but it doesn't give an insurer what it needs: its own signed record, held in its own region, of what was shown, what was agreed, and by whom, with the policy documents attached. It's the insurer, not the platform, that carries the liability.

In short

Rules that require a person to confirm higher-risk purchases are something insurers can plan for now. Selling through AI agents is not being banned in the EU or the UK; the direction is a right to use agents, with the question of human consent still open. Insurers that can show the customer saw and agreed to what they bought will be in the strongest position, whichever way it's settled.

How HumanApproved helps

HumanApproved™ gives insurers that evidence today. When an AI agent reaches your payment page, the purchase pauses and the customer gets a link to review the cover, the key exclusions, and the answers their agent gave, then approves with a one-time code. You get a signed, time-stamped record tied to the quote and the page version they saw, held in your region and end-to-end encrypted, ready for a complaint, an ombudsman case, or a regulator. It means you can welcome agent sales now, and be ready for whichever way the rules settle. Book a demo to see how it works.

The Digital Fairness Act text is due within weeks. We'll update this article when it's published.

Further reading

• CERRE, Agentic AI and Consumer Protection (July 2026)
• European Parliamentary Research Service, Towards a Digital Fairness Act (October 2026)
• Busch, Consumer Law for AI Agents
• AI Agents Under EU Law (2026)
• Regulation (EU) 2024/1689, the AI Act
• Freeths on the FCA's Mills Review (2026)

This article is general commentary, not legal advice.