How to Integrate Generative and Agentic AI Into Legacy Insurance Systems

Insurance carriers are exploring generative and agentic AI to improve underwriting, claims processing, and policyholder services. However, integrating these technologies into existing operations presents challenges. Many insurers still depend on legacy policy administration, claims, billing, and underwriting systems that were not designed for AI-driven workflows or real-time data exchange. 

Replacing these platforms can involve complex data migration, operational disruption, and significant costs. Meanwhile, introducing AI without reliable integration can create fragmented workflows, inconsistent information, and governance risks. Insurers need an approach that connects AI capabilities with existing systems while maintaining business controls and regulatory oversight. 

Integrating generative and agentic AI into legacy insurance systems requires secure connectivity, reliable data access, controlled workflow orchestration, and human oversight. A phased strategy allows carriers to introduce AI into existing operations while supporting long-term modernization. 

 

Why Is AI Integration Challenging for Legacy Insurance Systems? 

Legacy platforms support essential insurance functions, but their architecture may limit how easily AI applications access information and interact with business processes. 

Common integration challenges include: 

• Fragmented data: Policy information, claims histories, and customer records may exist across separate applications with inconsistent formats. 
• Limited connectivity: Older platforms may rely on batch processing, proprietary interfaces, or outdated integration methods. 
• Embedded business rules: Policy calculations, validations, and workflow dependencies may be tightly connected to legacy application logic. 
• Data quality: Incomplete records, duplicate identifiers, and outdated information can affect AI-generated outputs. 
• Regulatory oversight: AI-assisted workflows must align with applicable insurance regulations, internal policies, and decision-making authority. 

For example, an underwriting assistant may need submission documents, policy information, and approved external data before preparing a risk summary. Without reliable connectivity, accessing this information can remain a fragmented process. 

 

How Do Generative and Agentic AI Work with Legacy Insurance Systems? 

Generative AI and agentic AI support different insurance activities, although their capabilities can overlap. 

• Generative AI creates, summarizes, classifies, and interprets content. Insurers can use it for policy analysis, claims summaries, and internal knowledge retrieval. 
• Agentic AI combines AI models with planning, tool use, and workflow orchestration to complete defined tasks. Depending on its configuration, an agentic system can retrieve information, invoke authorized application services, and coordinate multiple activities. 

The following table compares the capabilities, insurance applications, and system interactions of generative AI and agentic AI in legacy insurance environments. 

Aspect	Generative AI	Agentic AI
Primary capability	Content generation and interpretation	Task coordination and execution
Insurance example	Summarizing underwriting documents	Coordinating submission validation
System interaction	May retrieve information or invoke tools	Uses tools and workflow orchestration
Key controls	Accuracy, grounding, and validation	Permissions, action boundaries, and oversight

 For example, generative AI applications can retrieve and interpret information from commercial insurance systems through approved interfaces. An agentic workflow can then verify required fields, retrieve approved supporting information, and route the submission for underwriting review. 

The final decision remains subject to the insurer’s established authority and review procedures. 

 

What Architecture Supports AI Integration with Legacy Insurance Platforms? 

Insurers can introduce AI through an integration layer that connects existing platforms with enterprise data and AI applications. 

This is one modernization approach rather than a universal requirement. Other options include progressively replacing legacy functions or redesigning core platforms. The appropriate architecture depends on existing systems, business objectives, and operational constraints. 

API and Integration Layer 

Application programming interfaces (APIs), middleware, and adapters enable communication between AI applications and legacy insurance platforms. 

An API gateway can provide controlled access to services such as policy inquiries or claims status retrieval without exposing underlying databases directly. 

The integration layer should enforce authentication, authorization, request validation, and appropriate error handling. 

Enterprise Data and Knowledge Layer 

AI applications require reliable information from policy records, claims files, underwriting guidelines, and other authorized sources. 

Retrieval-augmented generation (RAG) can connect generative AI applications to enterprise knowledge by retrieving relevant information and supplying it as context for model-generated responses. 

However, RAG does not guarantee accuracy. Insurers must validate source quality, retrieval relevance, document versions, and generated outputs. 

AI Orchestration and Control Layer 

An orchestration layer coordinates model requests, application interactions, tool execution, and workflow states. 

For agentic AI, this layer should define which systems an agent can access, which actions require approval, and how failures are handled. 

Logging, monitoring, and validated permissions help maintain control over AI-assisted activities. 

 

How to Integrate Generative and Agentic AI Into Legacy Insurance Systems: 7 Steps 

A phased implementation process helps insurers evaluate business value, reduce integration complexity, and establish governance before expanding AI capabilities. 

Step 1: Identify High-Value Insurance Workflows 

Begin with specific operational problems rather than introducing AI across several departments simultaneously. 

Potential use cases include underwriting document preparation, claims intake support, policy knowledge retrieval, and customer service request classification. 

Evaluate each use case against: 

• Expected business value and measurable outcomes. 
• Availability and quality of required data. 
• Complexity of integration with existing platforms. 
• Regulatory and policyholder impact. 
• Required human review and authorization. 

Read-only or recommendation-based applications can provide manageable starting points because they do not directly modify core business records. 

Step 2: Assess Legacy Systems and Data Readiness 

Map the applications, databases, and information sources involved in the selected workflow. 

Identify where authoritative records reside, how information moves between applications, and which systems support APIs or other integration methods. 

The assessment should cover data formats, access permissions, update frequency, processing delays, and integration dependencies. 

Data preparation may involve resolving duplicate identifiers, standardizing terminology, and improving document metadata. Reliable information is essential when AI applications combine records from multiple insurance systems. 

Step 3: Establish Secure System Connectivity 

Connect AI applications through approved enterprise interfaces rather than unrestricted database access. 

Depending on the existing architecture, insurers may use API gateways, middleware, event-driven messaging, or controlled file exchanges. 

Apply least-privilege access controls so AI services can perform only authorized operations. 

Where workflows update business records, use validated application services, transaction controls, and safeguards against duplicate actions. 

Step 4: Implement Grounded Generative AI 

Introduce generative AI for activities requiring enterprise knowledge retrieval and content interpretation. 

For example, a claims assistant could retrieve policy provisions and approved procedures before preparing a summary for an adjuster. 

RAG can help incorporate relevant business information into generated responses. 

Implementation should include source attribution, permission-aware retrieval, document updates, and output evaluation. 

Test AI responses against incomplete records, conflicting documents, outdated policies, and questions outside the application’s intended scope. 

Step 5: Introduce Controlled Agentic Workflows 

Once foundational capabilities are validated, insurers can introduce agentic AI for defined administrative tasks. 

An underwriting support agent might retrieve submission information, verify mandatory fields, request approved reference data, and create a review task. 

Each tool interaction should have explicit permissions and validated inputs. 

Agentic workflows should also handle failed requests, unexpected responses, and repeated operations. Begin with supervised execution and expand permitted actions only after demonstrating acceptable reliability. 

Step 6: Establish Governance and Human Oversight 

Assign responsibilities for AI application ownership, security, model evaluation, incident management, and operational outcomes. 

Approval checkpoints may be necessary before AI-assisted processes change coverage information, authorize payments, or generate consequential customer communications. 

Governance procedures should address activity logging, model updates, exception handling, and documentation. 

Insurance professionals should retain appropriate authority over decisions requiring professional judgment or regulatory oversight. 

Step 7: Pilot, Measure, and Expand 

Deploy the initial workflow in a controlled environment using representative insurance scenarios. 

Where appropriate, shadow testing can compare AI recommendations with existing processes without changing production records. 

Measure accuracy, processing time, exception rates, human corrections, and integration reliability. 

After deployment, establish ongoing monitoring, incident response, and rollback procedures. Expand AI capabilities when operational results support broader implementation. 

 

 

Where Can Generative and Agentic AI Support Insurance Operations? 

Generative and agentic AI can support insurance workflows involving information retrieval, document interpretation, and coordination across applications. 

Underwriting and Submission Processing 

Generative AI can summarize applications, organize supporting documents, and identify missing submission information. 

Agentic workflows can coordinate approved data retrieval and administrative validation before routing cases to underwriters. 

These capabilities support underwriting preparation while preserving established decision-making authority. 

Claims Intake and Management 

Claims teams process incident descriptions, photographs, policy records, and correspondence. 

AI can classify incoming documents, extract relevant information, and prepare claim summaries. Agentic systems can coordinate administrative tasks such as checking document completeness or creating follow-up requests. 

Coverage determinations, settlement decisions, and payment approvals remain subject to appropriate business controls. 

Policy Servicing and Customer Support 

Generative AI can help service representatives retrieve approved policy information and prepare responses. 

Agentic workflows can coordinate request classification, document collection, and task routing. 

Activities affecting coverage, billing, or customer rights require additional validation and authorization. 

 

How Can Insurers Address AI Governance and Regulatory Requirements? 

AI integration must account for applicable insurance regulations and the potential consequences of automated decisions. 

The National Association of Insurance Commissioners (NAIC) adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. 

The bulletin outlines supervisory expectations for AI governance, risk management, and documentation. It is not itself a federal law or nationwide binding regulation. Insurers should review applicable state requirements and guidance issued or adopted by relevant jurisdictions. 

In October 2026, the NAIC’s Big Data and Artificial Intelligence Working Group released version 6.0 of the AI Risk Evaluation Supplement for public comment, continuing its work to support regulatory evaluation of insurers’ AI systems. 

Applying the NIST AI Risk Management Framework 

The National Institute of Standards and Technology (NIST) AI Risk Management Framework provides a voluntary structure for managing AI risks. 

Its four functions can support insurance AI governance: 

NIST function	Insurance AI application
Govern	Establish accountability, policies, and oversight
Map	Identify use cases, data dependencies, and potential impacts
Measure	Evaluate accuracy, reliability, security, and risks
Manage	Implement controls, address risks, and monitor performance

 NIST’s Generative AI Profile provides additional guidance on risks associated with generative AI systems. 

Managing Agentic AI Security Risks 

Agentic systems introduce security concerns because they interact with enterprise tools and applications. 

The OWASP GenAI Security Project identifies risks such as prompt injection and excessive agency. 

Insurers should use tool-level authorization, input validation, restricted execution permissions, and activity monitoring. 

Security controls should be enforced through trusted application mechanisms rather than relying solely on model instructions. 

 

How Can GenAI Foundry Support Governed AI Integration? 

As insurers move from isolated AI pilots toward production deployment, consistent model evaluation, enterprise knowledge access, deployment controls, and monitoring become increasingly important. Managing these capabilities through separate tools can complicate governance across multiple AI applications. 

Enkefalos positions GenAI Foundry as a private enterprise AI control plane for building, evaluating, governing, and deploying AI applications. Its published product information describes capabilities including model evaluation, version-controlled deployment, runtime guardrails, and retrieval-based enterprise knowledge access. These functions are relevant to insurers seeking consistent AI lifecycle controls. Integration with specific legacy insurance platforms and deployment environments requires separate technical assessment. 

 

 

How Should Insurers Measure AI Integration Success? 

Successful integration depends on measurable operational improvements supported by reliable technical controls. 

Insurers can evaluate: 

• Processing time: Duration of underwriting preparation, claims intake, or service requests. 
• Output accuracy: Correctness and completeness of AI-generated information. 
• Human correction rate: Frequency of employee revisions. 
• Exception rate: Cases requiring escalation or manual intervention. 
• Integration reliability: Availability, response time, and failures of connected services. 
• Governance performance: Policy exceptions, access violations, and audit record completeness. 
• Operational value: Workflow improvements relative to implementation and ongoing costs. 

Measurements should use representative business cases and appropriate baselines. 

Performance demonstrated during a pilot should also be evaluated under production workloads before expanding deployment. 

 

What Should Insurers Prioritize Before Scaling Agentic AI? 

Scaling agentic AI requires coordinated technical architecture, governance, and operational ownership. 

Three priorities are particularly important: 

• Reusable integration services: Standardized APIs, data definitions, and access controls can reduce duplicated development. 
• Operational governance: Model policies should translate into enforceable permissions, evaluation requirements, approval workflows, and monitoring. 
• Clear ownership: Teams need defined responsibilities for system incidents, model updates, data quality, vendor dependencies, and performance reviews. 

These foundations help insurers manage increasing complexity as AI applications become more closely connected to core operations. 

 

Conclusion 

Integrating generative and agentic AI into legacy insurance systems can support modernization without requiring immediate replacement of existing core platforms. Insurers can begin with targeted use cases, connect AI capabilities through controlled integration layers, and strengthen data access, security, and governance as deployment progresses. 

Before scaling AI across operations, insurers should demonstrate integration reliability, effective governance, and measurable business value. This phased approach supports long-term modernization while preserving established business controls and human decision-making authority. 

 

Frequently Asked Questions 

Can generative AI integrate with legacy insurance systems? 

Generative AI can connect to legacy insurance applications through APIs, middleware, and controlled data services. These integrations support document analysis, knowledge retrieval, and employee assistance without immediately replacing core platforms. 

What is the difference between generative AI and agentic AI in insurance? 

Generative AI creates and interprets content, while agentic AI combines models, tools, and orchestration to coordinate defined tasks. Both can support insurance workflows under appropriate controls. 

Do insurers need to replace legacy systems to use agentic AI? 

Agentic AI can work with existing platforms through approved integration services. Some legacy systems may require adapters, improved interfaces, or selective modernization. 

How can insurers securely connect AI agents to legacy platforms? 

Insurers can use API gateways, least-privilege permissions, encrypted connections, validated requests, activity logging, and human approval checkpoints. 

What role does RAG play in insurance AI integration? 

Retrieval-augmented generation supplies AI models with relevant information from authorized enterprise sources. It supports grounded responses, but source quality and generated outputs still require validation. 

Can agentic AI automate insurance claims processing? 

Agentic AI can coordinate selected administrative claims activities, including document checks and workflow routing. Decisions involving coverage, settlements, or payments require appropriate authorization and oversight. 

What are the main risks of agentic AI integration? 

Key risks include inaccurate outputs, unauthorized system actions, sensitive information exposure, prompt injection, inconsistent data, and inadequate auditability. 

How can insurers measure AI integration success? 

Insurers can measure processing time, output accuracy, human corrections, exception rates, system reliability, governance performance, and operational costs.