Digital Omnibus: progress in AI use – need for clarification on overlaps

The Digital Omnibus brings important progress in the use of artificial intelligence and data protection.
“The clarification creates room for responsible AI innovation without weakening data protection,” says GDV CEO Jörg Asmussen. “This is crucial for offering policyholders modern, efficient services.” At the same time, the insurance industry sees potential in making European regulations leaner and more practical, especially in the area of cybersecurity.

EU provides clarity on data processing for AI

Insurers use artificial intelligence to improve processes and handle customer requests faster. Until now, the use of personal data, such as for AI training, has often been unclear or restricted by regulation. The planned clarification by the European Commission is therefore an important step. In the future, operating and training AI systems should generally be possible on the basis of “legitimate interest,” under certain conditions even with health data.

Better alignment of cybersecurity rules

Insurance companies are already subject to extensive requirements under the Digital Operational Resilience Act (DORA), including IT testing, reporting obligations, and crisis response, regularly monitored by the Federal Financial Supervisory Authority (BaFin). In addition, they are expected to comply with the Cyber Resilience Act (CRA), even though the content and review mechanisms largely overlap.

“The additional effort brings no security benefit,” emphasizes Asmussen. “The comprehensive DORA requirements already ensure a high level of security — insurers should therefore be exempt from CRA requirements.”

With the Digital Omnibus, the European Commission is initiating a necessary review of digital regulations. In the next step, the Parliament and Council will develop their positions. The goal is a digital framework that enables innovation and avoids bureaucratic duplication. GDV will continue to support the process constructively.