Tag Archives: granularity

International Workshop on Risk and Insurance, 서울, June 2026

In three weeks, the International Workshop on Risk and Insurance will be organized in 서울 (Seoul, Korea), prior to the Insurance: Mathematics & Economics conference. We were asked to send our slides in advance, so I thought I could be nice to share them (slides are available here). I will be the very first speaker of the day, in a session “AI Revolution and Cyber Risks”.

Over the past ten years, we have heard a lot about the AI revolution in actuarial science. Very often, the narrative is by technological optimism: more data, more models, more automation, and therefore better pricing, better decisions, and better insurance. In this talk, I plan to take a step back. Not to deny the importance of AI, of course, but to return to a more fundamental actuarial question: what makes a risk insurable? I will take two perspectives: first, information granularity and mutualization; second, AI itself as an insured exposure. The first part will be about granularity and mutualization. Insurance transforms individual heterogeneity into risk classes, but as information becomes more granular, the boundary between what is pooled and what is individualized shifts. I will move from information asymmetry to information granularity, then to natural catastrophe maps, and finally to actuarial fairness. In the second part, I will turn to AI risk in insurance: not AI as a tool for insurers, but AI as a risk that insurers may have to cover.

Let me start with the first part: granularity and mutualization. Insurance relies on a form of shared ignorance. We do not know who will have an accident, who will fall ill, or which house will be flooded. This uncertainty makes pooling possible. But ignorance is never complete. Actuaries observe variables, build classes, estimate frequencies, and price risks. The history of pricing is therefore a history of compromise between measuring heterogeneity and preserving mutualization. This slide gives a very classical way of seeing the problem. If there is a latent risk factor, which I call theta, total variance can be decomposed into within-risk variance and between-risk variance. The first part is the residual uncertainty that remains pooled. The second part is systematic heterogeneity across individuals or groups. But in practice, insurers do not observe theta. They observe covariates: age, location, car type, claim history, scores, and so on. These variables move part of the uncertainty from the insurer to the policyholder. The last formula is the key one. It separates irreducible risk from epistemic uncertainty, or misclassification. More granular information reduces misclassification, but it also turns pooled uncertainty into priced heterogeneity.

The classical issue in insurance economics is information asymmetry.  In Akerlof, or in Rothschild and Stiglitz, the problem is that policyholders may know more about their risk than insurers. If high-risk individuals buy more coverage than low-risk individuals, pooling contracts may become unstable. Empirically, this leads to a simple question: after controlling for observable risk characteristics, do coverage choices still predict losses? The genetic-testing debate makes this very concrete. Individuals may know something about their future risk that insurers cannot observe, or are not allowed to use. Traditionally, the fear was that policyholders knew too much. Today, with big data, we may also ask what happens when insurers know almost too much.

With granularity, the problem changes. It is no longer only about asymmetric information between the insured and the insurer. It is about reducing epistemic uncertainty. Things that were previously hidden become partially observable: behaviour, location, telematics, digital traces, health signals, and social proxies. Statistically, this is attractive: prediction improves. But actuarially and socially, it is more ambiguous. Better prediction also redistributes premiums, makes some risks more visible, and may turn solidarity into sorting. Removing protected variables is not enough. In rich data environments, proxies can reconstruct what we claim to exclude. So the question becomes normative: what should be priced, what should be pooled, and what should be used only for prevention? Note that the same issue arises with past criminal records: even if the information is predictive, should it remain admissible forever? Inclusive insurance requires a temporal dimension of data governance. Some information may be relevant at one point, but should progressively lose its underwriting legitimacy.

Natural catastrophes make this problem very concrete. For a long time, some climate risks were pooled at a broad scale. But risk maps, climate models, and fine geographic data now identify areas that are much more exposed than others. Even when a system is formally solidaristic, access to coverage may depend on the underlying household insurance contract. If insurers withdraw locally, or impose stricter conditions, formal solidarity may remain while effective access to insurance declines. So granularity does not only produce more accurate prices. It can also produce non-insurance, selective underwriting, or local market withdrawal.

This leads naturally to actuarial fairness. We often say that equal risks should pay equal premiums. But what does “equal risks” mean? Equal given all available information? Equal within a tariff class? Equal for a score? Equal within a protected group? Actuarial fairness is always relative to an information set. More granular information gives a more individualized notion of equality. Coarser information preserves more mutualization. This creates a tension between actuarial adequacy, solidarity, and causal legitimacy. A variable may be predictive without being socially acceptable. Conversely, excluding a variable may preserve solidarity, but at the cost of cross-subsidies and possibly selection.

I now move to the second part: AI risk in insurance. The link with the first part is this: so far, I have discussed AI and data as instruments of classification. But AI is also becoming a source of risk. Firms use models to code, advise, filter, recommend, automate, and decide. So the question is no longer only: how do insurers use AI? It is also: how do we insure organizations that use AI?

There is already a large discussion about AI for insurance: pricing, fraud detection, claims management, customer service. I want to reverse the perspective. AI is becoming an insured exposure. AI-related losses may not appear in a new line called “AI insurance.” They will appear through existing lines: cyber, technology E&O, professional liability, product liability, D&O, and regulatory risk. What is new is the combination of opacity, speed, scale, version changes, dependence on external providers, and difficult ex-post attribution. The actuarial question is not simply: what is the historical frequency of AI failures? The question is whether the risk can be bounded, observed, priced, monitored, and evidenced.

The first insurance problem is accumulation. A portfolio may look diversified: different firms, sectors, and countries. But they may all rely on the same models, APIs, cloud providers, datasets, retrieval systems, or agent frameworks. A model bug, a bad update, a prompt-injection vulnerability, a compromised API, or a provider failure can generate correlated losses across many insureds. This weakens the usual law-of-large-numbers intuition. Risks are not independent if they share the same technological infrastructure. Underwriting AI therefore requires mapping the AI supply chain: provider, model version, API, data, RAG system, agents, tools, and update process.

This slide introduces a recent report on AI risk prioritization. I would not take the probabilities literally; it is a study based on expert judgment. But it is useful because it frames AI risks as systemic, cross-sectoral, and unevenly distributed. The key point for insurance is the mismatch between vulnerability and control. The actors most exposed to harm are not necessarily those who control the models. Users, clients, and affected third parties may bear the consequences, while mitigation often depends on developers, providers, regulators, governments, or standards bodies. This raises a classical insurance question: who bears the risk, who controls the risk, and who can produce evidence after a loss?

Large language models (LLMs) are a particularly interesting case. The issue is not only hallucination. It also includes retrieval errors, prompt injection, privacy leakage, biased outputs, insecure code, incorrect tool use, and automation of decisions that should remain supervised. Benchmarks are not enough. They evaluate controlled tasks. Insurance deals with deployed systems, real users, real incentives, changing environments, and downstream losses. LLMs shift the cost of reliability. Producing an answer becomes cheap; verifying it may become expensive. And “human-in-the-loop” is not a magic control. A human can only control the system if they have time, competence, authority, and incentives to challenge the machine.

This brings me to a central point: insurability depends on proof. An insurance policy cannot simply say: “we cover AI risk.” It must define the insured system: the use case, model, version, provider, data source, retrieval layer, tools, agents, and update regime. It must also define evidence obligations: logs, audits, monitoring, incident reporting, version retention, red teaming, escalation procedures, and human review. Insurance can play a disciplinary role here. If nobody pays for proof before the loss, everybody pays for uncertainty after the loss. Conversely, if coverage depends on traceability, insurance creates an economic incentive to document and control AI systems.

I will end with vibe coding. Lawrence Lessig famously said that “code is law”, twenty five years ago: code does not only execute rules; it structures what is possible, impossible, easy, costly, visible, or invisible. But if code is generated by AI from prompts, modified quickly, integrated by agents, and sometimes deployed without serious human review, a new question appears: who can reconstruct the history of the code after a loss? The risk is not only that AI-generated code may be wrong. The risk is that nobody can say exactly what was asked, what was generated, which model version was used, which dependencies were added, which tests were run, and how the code reached production. For insurers, the right question is not: “Do you use AI to code?” Almost everyone will. The real question is: “Through which process can AI-generated code enter a critical system?” And this brings us back to very concrete underwriting tools: prompt logs, model versions, human review, tests, vulnerability scanners, SBOMs, deployment rules, and exclusions for unverified autonomous deployment. The broader conclusion is that AI does not eliminate classical actuarial questions. It makes them more visible: mutualization, accumulation, information asymmetry, evidence, moral hazard, control, and responsibility.