Most insurance organizations approach AI governance the same way they approach regulatory compliance: reactively. They wait for guidance from state insurance departments or federal bodies, stay cautious in the interim, and treat governance as a constraint on moving forward. This posture is understandable, but it has a real cost. In the absence of external frameworks, the organizations building internal ones are pulling ahead.
Key takeaways for insurance leaders
- The governance advantage: Internal AI guardrails allow organizations to move forward confidently instead of waiting for external regulation.
- The vendor blind spot: Effective governance must account for how third-party vendors use AI, client data, and automated decision-making.
- The ReSource Pro view: Process discipline, data governance, and vendor oversight are preconditions for scaling AI responsibly.
Shannon Woods, Chief Legal and Compliance Officer at The Mutual Group, has made a different choice. Rather than waiting for regulators to define what responsible AI adoption looks like, she has built internal governance structures that create certainty where it does not yet exist externally [2]. The result is an organization that can say yes to AI use cases that others are still debating whether to touch.
Who carries this problem
Legal, compliance, and risk officers in insurance carriers and MGAs are the primary audience for this conversation, but it extends to CIOs and COOs who are trying to move AI initiatives from pilot to production. The common friction point is not a lack of technology or even a lack of leadership support. It is the absence of a decision framework that allows innovation teams to proceed confidently and compliance teams to do their job without becoming a bottleneck.
The reflex to say no when governance is unclear is rational at the individual level and destructive at the organizational level. Woods articulates this directly: “Say, ‘Yes, and here’s how’ beats reflexively saying a No” [2]. That orientation requires structure to sustain. Without a committee empowered to evaluate use cases and assign risk levels, individual compliance officers are left making judgment calls that should be institutional decisions.
What a functioning governance structure actually looks like
The Mutual Group’s approach centers on a cross-functional AI governance committee with three standing responsibilities: continuous visibility into all AI use cases and risk levels across the organization and with third-party vendors; ongoing monitoring and response planning for risks including model hallucinations, security vulnerabilities, and bias; and an annual tabletop exercise designed to stress-test governance against realistic failure scenarios [2].
That last element is worth isolating. The tabletop exercise is not a check-the-box activity. It functions like a claims drill, walking cross-functional teams through scenarios where something goes wrong, a vendor’s AI model produces outputs that harm policyholders, or a third-party security incident exposes data. Organizations that have never run this exercise will discover their gaps in response rather than in preparation.
Vendor exposure is the governance blind spot
The dimension most organizations underestimate is vendor risk. Insurance organizations use dozens of technology vendors, many of which have embedded AI into products that were sold before AI governance was a serious question. The risk is not just what is happening internally. It is what vendors are doing with client data and on the organization’s behalf [2].
Woods addresses this through contractual requirements that mandate vendors to notify The Mutual Group of changes in their AI usage. This is not a standard vendor management practice in insurance. It should be. Governance that covers internal use cases but creates a blind spot around third-party AI is not governance. It is selective visibility, and the gaps tend to surface at the worst possible moment.
A ReSource Pro perspective
Insurance organizations investing in AI capabilities often treat governance as a downstream concern, something to formalize once use cases are proven. That sequencing is backwards. The organizations that scale AI responsibly are those that built governance before they needed it urgently. Process discipline, data governance, and vendor oversight are not overhead. They are the structural conditions that allow AI adoption to accelerate without the kind of incident that triggers regulatory scrutiny or policyholder harm.
Source
AI governance in insurance: Building AI guardrails without slowing the business down
Author: Shannon Woods, Chief Legal and Compliance Officer, The Mutual Group
Publication: The Insurance Lead
Original Publication Date: March 6, 2026
