How should insurers prepare unstructured data before deploying GenAI and AI agents in underwriting and claims workflows?

Insurers should classify, tag, and govern unstructured files before exposing them to GenAI or AI agents. That means turning PDFs, emails, scans, and notes into certified inputs with document type, source, policyholder, dates, and embedded values attached. Without that data foundation, models cannot reliably search, compare, or act on the information that drives underwriting and claims decisions.

Why This Matters for Security Teams

Unstructured underwriting and claims content is often where insurers hold the most sensitive and decision-critical information, yet it is also the least standardized. PDFs, scanned forms, broker emails, adjuster notes, loss runs, and attachments can all contain policyholder data, coverage evidence, exclusions, and fraud signals. Before GenAI or AI agents touch that material, the organisation needs a defensible way to classify it, preserve provenance, and separate certified inputs from ambiguous or stale content. That is a data governance problem as much as an AI problem.

Current guidance from the NIST AI Risk Management Framework and related GenAI guidance is clear that trustworthy outputs depend on trustworthy inputs. In insurance, that means the model should not be asked to summarise or act on documents unless the source, date, policy context, and document type are known and traceable. It also means teams must treat ingestion quality as part of control design, not just a preprocessing task.

In practice, many insurers discover weak document governance only after an AI assistant has already surfaced the wrong clause, missed a disclosure, or acted on an outdated claim note.

How It Works in Practice

Preparing unstructured data for GenAI starts with turning content into governed records. The practical sequence is usually ingest, classify, extract, validate, and tag. Insurance teams should first identify the major document families, such as applications, policy wording, endorsements, medical attachments, photographs, adjuster narratives, and correspondence. Each class should then carry metadata that makes downstream retrieval safer: document type, source system, policyholder or claimant identifier, effective dates, jurisdiction, confidence score, and retention category.

This is where the agentic AI risk lens matters. The OWASP Top 10 for Agentic Applications 2026 highlights risks such as tool misuse, prompt injection, and untrusted input, all of which become more likely when agents can search or summarise raw files without controls. A secure pipeline should therefore separate certified content from merely discovered content, use retrieval filters, and require human review for high-impact outputs. If claims notes are being summarised, the system should be able to cite exactly which document and page informed the answer.

• Apply document classification before indexing, not after the model has already ingested the corpus.
• Use OCR and extraction only where quality thresholds are met, and keep the original file for auditability.
• Attach provenance fields so every chunk or passage can be traced back to a source record.
• Validate key values such as dates, names, and limits against authoritative policy and claims systems.
• Block agents from acting on low-confidence or unclassified material until a review step clears it.

Insurers should also align this work with the threat model. The MITRE ATLAS adversarial AI threat matrix is useful for thinking about poisoning, malformed inputs, and retrieval manipulation, while CSA MAESTRO agentic AI threat modeling framework helps teams examine autonomous workflows, control points, and escalation paths. The right operating model is not “load everything into the model,” but “curate what the model is allowed to see and do.” These controls tend to break down when legacy scan archives, shared mailboxes, and manual exception folders sit outside the governed ingestion path because their contents cannot be reliably classified or traced.

Common Variations and Edge Cases

Tighter document governance often increases intake friction, so organisations must balance decision speed against the cost of reviewing ambiguous material. That tradeoff is especially visible in claims triage, where adjusters want rapid summarisation but the business cannot tolerate unverifiable outputs.

Best practice is evolving for edge cases such as handwritten notes, low-quality scans, multilingual submissions, and third-party broker packs. There is no universal standard for confidence thresholds yet, so insurers should define risk-based rules by workflow. For example, a low-confidence extraction may be acceptable for internal search, but not for coverage decisions or payment approval. Likewise, unstructured data used for training or fine-tuning should be separated from data used only for retrieval, because the governance requirements are different.

For high-impact use cases, the operational question is not whether the model can read the file, but whether the insurer can prove why the file was trusted. That is where controls from the NIST AI Risk Management Framework and the NIST AI 600-1 GenAI Profile are most useful: they push teams toward documented governance, validation, monitoring, and accountability rather than informal trust in model output. If the workflow involves autonomous action, the OWASP Agentic AI Top 10 should be used to stress-test whether the agent can be misled by malformed documents or injected instructions.

In insurance environments with merger-driven data sprawl, third-party administrators, or paper-heavy legacy claims, these practices break down when metadata ownership is unclear because no single system of record exists to certify the input.

Related resources from NHI Mgmt Group

• What should organisations do before deploying AI agents in enterprise workflows?
• How should banks govern unstructured data before deploying AI?
• How should insurers govern AI agents that access policy and claims data?
• What governance controls should every enterprise put in place before deploying AI agents?