Part 1 covered the Canadian landscape: RIBO’s principles-based guidance, an AMF draft still taking shape, an OSFI rule with an 18-month runway to 2027, and a federal government that shelved its comprehensive AI law in favour of a slower, multi-bill approach. Widen the lens and a pattern shows up. Every major jurisdiction is running the same experiment: how much AI regulation can you write before the technology you’re regulating has already moved past it, and each is placing a different bet on the answer.
1. The EU: Maximum Ambition, Maximum Delay
The EU AI Act was supposed to be the world’s answer: a comprehensive, binding law with hard deadlines and real penalties. It’s still that, on paper. In practice, the compliance timeline has slipped twice in 2026 alone, which for a law five years in the making is either bad luck or an honest admission that AI doesn’t sit still for anyone’s legislative calendar. High-risk AI systems under Annex III, a category that explicitly names life and health insurance risk assessment and pricing, were originally due to face full obligations in August 2026. After a political agreement in May 2026 and formal approval in June, that deadline moved to December 2027. Systems embedded in already-regulated products got pushed to August 2028. The European Commission has also missed two consecutive deadlines for the guidance explaining which systems even count as high-risk in the first place, partly because member states haven’t finished appointing the national bodies meant to enforce any of this.
The lesson for a Canadian brokerage: don’t assume “the EU has a real AI law” means the EU has a working AI law yet. It has an ambitious one that’s still being built while businesses wait.
2. The UK: Betting Against a Rulebook On Principle
The UK has taken the opposite position, deliberately. The FCA has repeatedly told Parliament’s Treasury Committee it will not write AI-specific rules for insurers, reasoning that a technology changing every three to six months will outrun any rulebook before the ink dries. Instead, it’s leaning entirely on existing tools: Consumer Duty, the Senior Manager’s regime, operational resilience requirements, and reserving intervention for “egregious failures”. A parliamentary review has pushed back a little, warning that as general-purpose AI models start giving people insurance advice directly, the FCA’s activity-based perimeter may not capture who’s actually accountable when that advice is wrong. But the regulator’s bet is that a rule written today would already be outdated by the time it took effect, so the safeguard is Consumer Duty enforcement after the fact, not a rulebook in advance.
3. The United States: A Patchwork Built State by State
There is no federal AI insurance law in the US, and there isn’t likely to be one soon, which checks out for a country that still hasn’t agreed on the metric system. What exists instead is the NAIC’s Model Bulletin on the Use of AI Systems by Insurers, a principles-based template state insurance departments can adopt on their own. As of mid-2026, roughly half of US states have adopted it with little modification, requiring insurers to maintain a written AI governance program covering the full policy lifecycle: underwriting, pricing, claims, fraud detection. Colorado has gone further, with binding regulations that started with life insurers and were expanded in 2025 to cover auto and health benefit plan insurers too. The rest of the country has nothing insurance-specific at all. A US insurer’s AI obligations depend entirely on which states it’s licensed in. It’s the same fragmentation problem Canada has across its provincial regulators, just with more states involved.
4. China: The Most Prescriptive Framework in the World
China has taken the most structured approach of any major market, proving that when a government wants boards of directors to take something seriously, mandating it beats asking nicely. In June 2026, the National Financial Regulatory Administration issued a binding framework (32 principles across seven areas, including governance, data, risk management, and computing infrastructure) that applies to both banks and insurers. It requires boards of directors to personally own AI governance rather than delegating it to IT departments, and it places explicit human-review requirements on high-risk uses like underwriting and claims decisions. It’s the only major jurisdiction that has moved AI oversight to the board level by regulation rather than by best-practice recommendation.
5. Singapore, and the Middle Path
Singapore’s Monetary Authority has run one of the longest-standing AI governance frameworks in financial services: its FEAT principles (Fairness, Ethics, Accountability, Transparency), published in 2018, predate the current AI wave by several years. Rather than starting over, MAS built on top of them. A November 2025 consultation proposed comprehensive new AI Risk Management Guidelines requiring board-level oversight and a full AI inventory, explicitly designed to complement rather than replace FEAT. It’s the middle path: not comprehensive statute, not principles-only silence, but a durable, technology-neutral foundation that gets extended as the technology matures instead of torn up and rewritten.
Summary: Nobody Has Solved This, and That’s the Point
Line up the approaches and there’s no consensus to borrow from. The EU wrote comprehensive law and is still implementing it years behind schedule. The UK refuses to write insurance-specific rules on principle. The US is regulating one state at a time. China went straight to board-level mandates. Singapore has quietly run a stable framework for years without needing to overhaul it. If you were hoping one of these jurisdictions had already solved the problem so Canada could copy the answer, it hasn’t happened, and that’s a reflection of how fast the target keeps moving. That means the standard your brokerage operates by in the meantime is the one you set yourself, not one you can borrow from Brussels, London, or Washington.
