How Insurance CIOs Can Develop a Successful Generative AI Strategy

Building a GenAI strategy and implementation approach is tricky, requiring insurance CIOs to make determinations based on wide-ranging criteria. This research identifies the key considerations to selecting the best approaches for GenAI to ensure project success.

Overview

Key Findings

• The top factor among insurers in selecting generative AI (GenAI) use cases is business outcomes; however, Gartner research has found that this is often difficult to quantify.
• GenAI is pushing beyond experimentation, adding pressure on insurance CIOs to formalize their validation and selection processes to target those that can deliver measurable business results.
• To be effective, while adhering to compliance and regulation, insurers must consider four key dimensions to GenAI use case selection: risk appetite, organizational readiness focused on process and employees, business value and metrics, and vendor/solution approach options.

Recommendations

• Begin by selecting GenAI use cases that pose minimal risk and offer clear value. Collaborate with compliance and legal teams to evaluate each use case, focusing initially on processes with low regulatory impact, and prioritize them for early implementation to facilitate experimentation and learning as the technology matures.
• Build organizational readiness for GenAI by ensuring business user support, assessing user acceptance, checking AI data readiness, implementing change management and mapping internal processes to understand process changes needed to support business outcomes.
• Ensure each use case is quantifiable by aligning each with a projected business value and determining key KPIs that will be measurable to showcase this value. Consider investments as either “everyday” for hygiene or “game-changing” for strategic value.
• Assess implementation approach options by evaluating buying embedded solutions versus developing using large language models (LLMs) based on skill requirements, value, speed to market and risk management around intellectual property. Build literacy with procurement, risk and IT teams about steps needed to test AI in embedded technology, and assign roles/responsibilities for this task.

Strategic Planning Assumption

While focus on GenAI today aims at productivity enhancements, leveraging GenAI to improve customer satisfaction and experiences in insurance will receive almost equal focus by 2026.

Introduction

The 2025 Gartner CIO and Technology Executive Survey found 30% of insurance respondents reporting that their enterprise has already deployed GenAI, and an additional 38% will deploy by the end of 2025. Not only is adoption increasing, but the survey found that 89% of insurance respondents were planning to increase their spend on GenAI in 2025. ¹

However, although investments are rising, the number of use cases and live production examples remain limited. The recent 2024 Gartner Financial Services Business Priority Tracker Survey, 3Q, showed that insurers are slowly maturing their GenAI initiatives. They do, however, continue to focus on horizontal tasks such as IT code development or call center summarization rather than utilizing GenAI for high-value, domain-specific tasks such as underwriting. ²

Gartner clients continue to report issues with GenAI strategy development, specifically the inability to scale these investments, concerns about regulations and compliance, and lack of business leadership, especially for small to midsize organizations. To help guide use case selection, determine implementation approach and optimize their GenAI investments, insurance CIOs should focus on four key categories, according to Gartner’s findings (see Figure 1):

• Risk assessment
• Organizational approach
• Business value assessment
• Vendor/solution approach

Figure 1: Key Considerations for Generative AI Decisions in Insurance

Today, insurers often limit the criteria they could be using to develop GenAI strategy. The 2024 Gartner Financial Services Business Priority Tracker Survey, 3Q, indicated that outcomes like expected ROI are by far the top factor companies applied to select use cases (see Figure 2). ² However, Gartner’s client interactions repeatedly reveal that this approach is often difficult for most companies because of their inability to quantify GenAI’s value.

Figure 2: Most Important Factors for Insurers Selecting Generative AI Use Cases

The survey also found that 42% of respondents rated experimentation and learning as one of the top two factors in GenAI use case selection.² Although experimentation is good, especially when just beginning a GenAI implementation plan, CIOs need to learn to effectively measure GenAI’s contribution to business outcomes. Additionally, CIOs should look at factors that today may be unrecognized or undervalued but could play a critical future role. These include organizational readiness, risk avoidance and vendor/solution options.

Analysis

Assess Compliance and Corporate Risk Appetite

Many risks surround GenAI that insurers need to assess, including input and output risks, data leakage and AI application vulnerabilities. However, these are not all the risks insurers must assess. Two additional factors are understanding the corporate risk perspective and how investments support or compromise compliance and regulations.

To begin, understand how your company views risk. For example, ask:

• What level of risk is acceptable to the enterprise?
• Does the organization want to be bleeding edge with its technology investments or prefer safe bets?

Some insurers will want to be early adopters, seeking technology that carries some level of risk but offers a strategic business advantage that comes with being the first mover in a market. Examples include implementing a new technology for revenue improvements or launching a new insurance product. With GenAI, this approach may mean launching a not-yet-proven solution or technology or employing a highly customized option because embedded technology is not yet available to support your use case. Choosing a bleeding edge approach may include facing risks associated with hallucinations or user acceptance from employees who fear that AI will replace their jobs. You need to balance the value of first-mover advantage in a market against any present technology risks and possible future changes that may be required. For example, a solution may be immature when it is adopted and require changes for compliance as the new technology is built out afterward.

You will need to answer the questions of how to quantify first-mover advantage, as well as how long the advantage will last as other organizations catch up. Part of your consideration will be the implications of investing resources to custom-develop or fine-tune an LLM that a follower may later have the option to buy as a GenAI solution built for industry consumption with industry-specific LLMs incorporated. How long will the GenAI be advantageous to your company, and when will the solution and technology possibly become obsolete or available to the mass market?

Gartner research has found that 80% of insurers select GenAI use cases that do not pose regulatory or ethical risks.²

Twenty percent of insurers, however, focus on use cases that potentially compromise highly regulated tasks.² These percentages reveal that, in many cases, insurers prefer applying solutions to more proven uses, starting safe and then expanding into those tasks that are more risky, such as underwriting or claims handling.

For more companies, a greater understanding of emerging regulations around GenAI’s use in insurance must be the baseline. Working with compliance and legal, document regulations, such as the European Union Artificial Intelligence Act, the National Association of Insurance Commissioners’ Model Bulletin on the Use of Artificial Intelligence Systems by Insurers, and U.S. state guidelines targeting AI. Then rank use cases by comparing how much each particular process corresponds to regulated actions. This would include tasks where biases may be introduced that might harm policyholders, such as pricing, claims handling or risk selection. In all these tasks, wrong decisions or outcomes would put the company in jeopardy of compliance failures and possible fines or brand injury. Insurers must apply more caution to executing these use cases compared to executing use cases with lower levels of compliance and regulation.

Recommendation: Begin with low-risk use cases. Employ the Gartner Use-Case Comparison to shortlist possible use cases that fit your business model, AI ambition and risk tolerance.

• For less technologically mature insurers, “likely wins” are a great starting point as they represent use cases that have good business value plus high feasibility. Examples include use cases like policy summarization for servicing or data ingestion.
• From this list, assess compliance and regulatory risks for each selected use case. Ones that are lower risk are best for beginners in GenAI and for experimentation. Those that fall under heightened regulatory scrutiny are not only risky, they often require change management as they impact knowledge workers who may resist change.

This approach provides a platform for learning and experimentation around GenAI implementation and allows companies to support human-in-the-loop processing. During this time, insurers should build out literacy programs and provide education on prompt engineering for humans involved in GenAI use.

Additionally, the solutions for these cases are typically horizontal in nature, applicable to multiple industries and offered by vendors that target cross-industry markets such as call centers or document generation. Selecting those that are “likely wins” helps minimize adoption risks because they often reflect more mature vendor offerings that are easier to implement than those that require calculated risks.

Targeting human-in-the-loop tasks should be the main focus for GenAI today. Because of high risks, insurers should not try to remove the “human” but leverage GenAI to empower employees — starting with those roles that are open to process change and new technology, such as marketing or claims.

Work with compliance and legal to evaluate the risk of each use case. Lean especially for early implementations toward those use cases that are not processes heavily impacted by regulation.

Ensure Organizational Readiness for GenAI

Finding the right operating model and driving organizational preparedness are key to GenAI initiative success. To achieve these, multiple steps are required. They range from ensuring business user support in implementing use cases to ensure projects are adopted and can scale, to implementing change management to prevent employee rejection or fears about the impact of technology on jobs.

Take some of these example steps to help drive GenAI success in your organization:

• Involve business users in use case ideation and rationalization exercises. This includes finding business sponsors to outline key deliverables and measures of business value. GenAI use case selection should not be strictly an IT exercise. Rather, business should be responsible for helping to identify use cases that are core to the enterprise, which will help promote scale and user adoption of GenAI investments.
• Ensure that scalability takes priority over experimentation. The 2024 Gartner Financial Services Business Priority Tracker Survey, 3Q, found that only 39% of insurers focus on use cases with proven outcomes such as ability to scale or produce quantifiable ROI. ² This is an industrywide problem and contributes to lack of value realized from large IT investments such as those targeted at GenAI.
• Continue to focus on human-in-the-loop use cases over those that are direct-to-consumers. GenAI continues to have hallucinations that require validation. GenAI today is best-suited to processes that support human decision makers or employees and should be the top focus. However, employees using the technology must be trained, including building AI literacy, prompt-writing best practices and usability controls, to generate the best business outcomes.
• Ensure data is AI-ready. Implementing a data management program with proper data governance is essential to GenAI success
• Develop expertise in process mapping and change. Effective GenAI implementation is not just about applying the technology but changing the process that uses the GenAI to match user and business demands. It also involves knowing what role GenAI plays versus other additional technologies that will be needed in combination with the GenAI. Understand how the user will experience the technology, how the technology can support automation and how process reengineering can optimize outcomes, such as fulfilling the speed needed for transaction processing. Implement change management to gain user support and to smooth execution of process changes that may be unfamiliar or uncomfortable to users. Direct attention to determining how employees will respond to these changes — will they feel threatened by the change, for example, fearing that technology will replace their jobs? Prioritize projects that result in less employee fear or require less change management. Projects that include massive process changes, require large-scale change management and result in employee resistance should be approached cautiously and only when maturity has been developed in lower risk areas.

Recommendation: Build organizational readiness for GenAI by creating a multistep process that includes:

• Building business user support throughout the process by pairing business leaders with use cases during business case development.
• Ensuring user acceptance by working with business leaders to build literacy and change management programs to ensure processes fit user needs and prompt writing skills are developed.
• Ensure AI data readiness by assessing accessibility, cleanliness and building out proper data governance.

Match Use Cases With Quantifiable Business Value and KPIs

Today, the highest-ranked business impacts for GenAI use cases are productivity enhancements, at 68%, and faster processing or speed, at 60% (see Figure 3). ² This, however, is expected to change over time. By 2025, focus on leveraging GenAI for customer satisfaction and experience impacts is expected to increase significantly. In contrast, expected business impacts such as revenue or financial growth, loss prevention and risk management are growing but at a much slower rate.

Figure 3: Top Business Impact Insurers Expect From Generative AI Use Cases

Knowing the realistic business value of GenAI implementations is a long-term essential. First, the value will differ based upon the projected impact of AI — Is it “game-changing” or “everyday” AI? Game-changing GenAI implementations are ones that support strategic value and competitive differentiation. Everyday AI use cases are ones that are common across many insurers and that contribute to good business value but not competitive advantage.

Early use cases focus primarily on everyday AI, for example enabling faster processing cycles with little to no process change or speeding underwriting with the same risk classification procedures. While providing productivity enhancements, this type of AI does not support revenue or profitability growth. To be game-changing, GenAI must be used with other technologies such as machine learning (ML) or with transformational initiatives such as new product launches. Deployments would likely be larger in scope, with multiple technologies used and massive process change, than what Gartner is seeing today in industry GenAI case studies. These types of use cases offer higher rewards but also pose greater risks.

Of the GenAI use cases insurers are implementing today, 83% are everyday AI, compared to 17% that are considered game-changing. By the end of 2025, the number of game-changing GenAI implementations is expected to rise to 26% of the use cases the industry deploys. ²

Everyday AI projects are much easier to quantify. Many Gartner clients are implementing KPIs focused on speed, cost or user productivity, for example. These factors include time to complete a task, number of tasks done in a day/week, number of calls with first-call resolution, or the time it costs to complete a task. Game-changing KPIs are much more challenging, especially with GenAI technologies that are often combined with other technologies or embedded into a business solution. For example, an underwriting assistant (often referred to in the industry as a copilot) might support not just policy summarization but also risk decisioning using ML and advanced workflow/automation tools. Common KPIs that insurers are trying to track here are more complex, such as underwriting profitability, customer satisfaction and customer retention.

For everyday GenAI use cases — which by definition are more foundational and less strategic — buyers should look for off-the-shelf solutions that are prebuilt and require less customization. These solutions are more like industry utilities, used by many insurers to support back-office tasks or core processes that are not differentiating. Game-changing AIs are the application of AI to tasks that support competitive differentiation, such as customer experience or tasks associated with risk selection. In many cases, game-changing AI solutions appropriately require co-development with partners, fine-tuning or extensive configuration.

Lastly, assess the time element that relates to value. This means not just how fast you can implement the solution to get to market, but how long the advantage will last if you are the first mover in a market.

Recommendation: Align each use case with a projected business value and determine key KPIs that will be measurable to showcase this value.

• Consider investments as either everyday for hygiene or game-changing for strategic value.
• Think long term rather than for today’s business value. While today’s KPI focuses on employee productivity and operational efficiencies such as transaction processing speed, insurers plan to use GenAI more strategically in the future to impact revenue and customer experience outcomes.

Identify the Right Vendor/Solution Approach to Match Your IT Strategy and Capabilities

Not all insurers take the same approach to GenAI implementation, and their approach varies significantly by individual use case. Most companies find it impossible to lock into a single vendor or approach. In fact, most midsize to large insurers will need a mix of GenAI technical options to match their use cases, including working with hyperscalers, existing insurance technology providers, insurtechs and system integrators/IT services providers.

Insurers must first determine the right approach: buying, building or renting for GenAI — or taking a blended approach where they leverage an LLM and build around it, for example. As embedded solutions become the norm, this decision is critical. Already, Gartner is seeing GenAI embedded into a range of solutions such as underwriting assistants, call center platforms and even policy administration systems. Determine the internal capabilities you have to manage GenAI implementations, what data/modeling skills you have, and the integration capabilities needed to embed the GenAI into your sourcing workflow and transactional systems. Different capabilities lead to different approaches, for example:

• Companies with large IT departments and extensive AI skills will use a variety of approaches simultaneously. They may develop solutions, or co-develop them with partners, leveraging a vendor-supplied LLM, and also utilize embedded GenAI within the business solutions they are implementing (e.g., intelligent document processing or policy administration systems). They may also leverage GenAI in solutions such as low-/no-code solutions that have workflow for a task plus GenAI capabilities for summarization. Taking an approach where internal teams do the bulk of integration, development and prompt engineering work, which is riskier and more complex, may be appropriate for large organizations with the needed internal skills. Also, large insurers may choose to undertake game-changing projects for which outcomes justify the time and investment needed to take a customized approach to GenAI.
• Small to midsize insurers will likely prefer buying or renting business solutions that contain GenAI instead of embarking on a development initiative. This is the case for core systems or underwriting modernization using agent-based solutions. For example, assessing the GenAI capabilities that your core system provider offers or builds into its policy administration or claims management system roadmap would be preferred for you.

Gartner has found that today the most popular approach to GenAI is working with hyperscalers, followed by leveraging embedded capabilities from existing system providers such as core system vendors (see Figure 4). ²

Figure 4: Insurers’ Approach to Selecting the Right Generative AI Vendors

These approaches are highly rated over alternative options such as looking for solutions from IT services providers or automation vendors.

Approach has a significant impact on risk and accountability and requires stringent evaluation. More so than ever, GenAI is being embedded into solutions, making it difficult to determine what is being done by GenAI — or AI — and what is being done by other technologies. Most companies are now implementing two core actions:

• Implementing new testing procedures for solution upgrades and enhancements to test all AI and GenAI before implementing it
• Improving ethical oversight to ensure responsible AI

To manage risk, companies should focus on ensuring that GenAI is not put into production without proper testing.

Recommendation: To guide the company through vendor and solution assessment, CIOs should:

• Document a vendor/solution approach that considers preferences for embedded solutions or development using LLMs, for example, based on skills, value, speed to market and risk management around IP.
• Build literacy with procurement, risk and IT teams around steps needed to test AI in embedded technology, and assign roles/responsibilities for this task.