As AI agents start working both for customers and inside insurers, the industry needs a reliable way to know who, and what, it is dealing with.
Insurance has always been a business built on trust. An insurer needs to know who a customer is, that a loss really happened, and that a claim is genuine. Traditionally, that meant checking documents, studying photographs and, when in doubt, speaking to someone directly.
Generative AI has quietly undermined all of those checks. A repair invoice, a set of damage photos and even a face on a video call can now be produced convincingly in minutes, while synthetic identities and cloned voices can slip through standard security checks. The question insurers have always asked, “does this look real?”, is getting much harder to answer.
At the same time, insurers are bringing AI into their own operations. When Europe’s insurance regulator, EIOPA surveyed 347 insurers, 65 per cent were already using generative AI and a further 23 per cent planned to. Most of that activity sits behind the scenes, in claims, underwriting and back-office work.
So the industry faces a trust question from two directions. Outside the business, it needs to know that the people, documents and, increasingly, AI agents it deals with are genuine. Inside, it needs to know that its own AI tools are doing only what they have been authorised to do.
A better way of proving who’s who
Decentralised identity offers a practical answer to both. A trusted organisation issues a digital credential, such as proof of identity, a signed repair estimate or confirmation of a medical treatment, and signs it cryptographically. The holder keeps that credential and shares only what is needed. Anyone checking it can see who issued it, confirm it hasn’t been altered, and check it hasn’t been revoked.
For fraud, the question shifts from whether something looks genuine to whether it can be verified. A doctored invoice simply fails the check, however convincing it appears.
The benefits go well beyond fraud. A customer who has been verified once can prove who they are again without starting from scratch, which makes onboarding quicker. For health or life cover, an insurer can confirm a treatment took place without ever seeing the whole medical file.
The same applies to connected devices. A telematics box or a smart leak detector can carry its own verifiable identity, so insurers can trust that the data really came from that device.
Knowing your agents
Insurers already know their customers. The next step is knowing their agents. Customers will soon use AI agents to gather documents, book inspections and submit claims on their behalf, while insurers deploy their own agents to triage claims, update records and handle routine queries.
Each of those agents needs something like a digital passport: a verifiable identity stating who it belongs to, what it is allowed to do, which systems and data it can reach, and when that permission expires. If an agent tries to go beyond those limits, the request is refused. And because every action is tied to a verified identity, there is a clear record of which agent did what, and on whose authority. For a regulated industry, that audit trail matters as much as the fraud protection.
Identity and authority should still be kept separate. Proving an agent belongs to someone doesn’t mean it can settle a claim or change bank details, so higher-risk actions should still need a human to sign them off.
This isn’t about putting data on a blockchain
Decentralised identity doesn’t mean putting personal data on a public ledger. Personal information stays with whoever holds the credential. Where a ledger is used, it records only what’s needed to check a credential, such as whether it is still valid. Think of it as a directory of trusted signatures, not a database of customer files.
Why the timing matters
Regulation is moving the same way. EU member states are due to offer European Digital Identity Wallets by the end of 2026, giving insurers a ready-made route to verified customer credentials. DORA already requires insurers to manage digital risk and system access far more rigorously.
Insurers don’t need to rebuild everything at once. The sensible starting point is the evidence most often faked or most costly to check, such as identity, bank details, repair invoices and medical records. Alongside that, they need a clear identity and permissions framework for every AI agent working inside the business.
None of this replaces human judgement. But it gives insurers a firm foundation for knowing who, and what, they are dealing with. AI agents are coming to insurance from both sides, and the firms that put verifiable identity in place first will be best placed to welcome them safely.