actuaries.org.uk
Your Member Portal
Virtual Learning Environment (VLE)
The Actuary
CMI
Search Log in / Join
Log in / Join
actuaries.org.uk
Your Member Portal
Virtual Learning Environment (VLE)
The Actuary
CMI

10 September 2026

Actuaries as data stewards in the AI era

It is an inevitable outcome that, as technology advances, so do the challenges and risks that are associated with it. This is particularly true for the area of data privacy in the current AI era where there has been a high adoption rate and usage of large language models (LLMs) and chatbots by organisations and people.

Authors

Antreas Tsiakkas
Antreas Tsiakkas
IFoA’s Professionalism, Regulation and Ethics Working Party
IFoA’s Professionalism, Regulation and Ethics Working Party
IFoA’s Professionalism, Regulation and Ethics Working Party

For actuaries, navigating these emerging data privacy challenges is essential as the integrity and trustworthiness of the actuarial profession rely on responsible data stewardship. AI systems are now increasingly embedded in financial modelling, insurance underwriting, and risk assessment. 

In these complex areas, actuaries are well-placed to apply their technical expertise and professional standards as a valuable complement to the data protection officers, information security professionals, and compliance teams who hold formal responsibility for data policy. 

This can bridge the gap between regulatory obligations and the model-driven realities of actuarial work. Understanding where actuarial expertise fits within this broader governance landscape is, therefore, an increasingly essential part of professional practice.

Data privacy challenges

Data privacy – sometimes referred to as AI privacy or information privacy depending on the context – is the principle that everyone should have control over their personal data. With the advent of AI and the significant increase in data collection volume and analysis, this seemingly simple and objective principle has evolved into a complex and ubiquitous concept. 

Before the current AI era, data privacy considerations revolved around the protection of sensitive information, and the trade-off between personal (non-sensitive) information sharing and personalised services or advertising.

Now, data collection consent and data usage permission considerations are sometimes an afterthought in the effort of training and improving AI models [1]. The volume of data – which include text, images and video – used for AI training is staggering and, inevitably, some sensitive information is contained within. A high proportion of this is collected without consent and, even if data is collected with consent, these can be used for purposes beyond those initially disclosed [2, 3]. Further, biases inherent in the training data and biases of the individuals and companies developing AI technologies can and do influence results and outputs [4]. 

Finally, the key notion of data privacy that humans are the primary handlers of information, has become obsolete in the context of current AI systems with their vast computational capacities, black-box architectures, and automated data scraping.

While these traditional principles of data privacy are challenged by the technological advancements in AI, data privacy considerations need not be undermined by default or become irrelevant. As actuaries, we have always been entrusted with handling vast datasets and upholding data privacy standards. What is our role now, in this amplified-risk environment? Can we uphold our roles as data stewards and set the example within our organisations? Against this backdrop, the question is not whether actuaries should engage with data privacy challenges in AI, but how they should do so.

Actuaries’ role

The qualities that set actuaries apart are our adherence to a code of conduct, rigorous standards of practice, and operation in highly regulated environments – qualities that both the IFoA and the Actuarial Association of Europe (AAE) have explicitly called upon the profession to bring to the responsible governance of AI systems [5, 6]. The impact of our work on individuals and organisations has always been central to how we operate. The data privacy challenges that the AI era brings should not be different.  

Actuaries must contend not only with the technical aspects of data management, but also with the ethical and regulatory implications of AI-driven data use. Publicised incidents, such as data breaches involving AI-powered platforms or instances where AI models have inadvertently exposed confidential personal details, serve as a stark reminder of the pitfalls at stake [7, 8]. 

Regulatory enforcement action has reinforced this: data protection authorities across Europe have issued substantial fines for mismanagement of personal data in AI contexts, and the European Data Protection Board has made clear that existing General Data Protection Regulation (GDPR) obligations apply fully to AI model development and deployment [1]. These developments have brought data privacy issues into sharp focus for professionals across industries, including actuaries [4, 5].

From principles to practice: Tools for the modern actuary

So, what are some practical methods for addressing these data privacy challenges and considerations? The tools outlined below offer a practical starting point for embedding privacy considerations into day-to-day work, reflecting both the technical capabilities actuaries bring and the professional standards they are bound to uphold.

Data sanitisation 

Data sanitisation refers to the process of cleansing datasets to remove or obfuscate any information that could directly or indirectly identify individuals, ensuring compliance with data privacy regulations. In practice, this often involves removing names, addresses, financial identifiers, and other sensitive attributes before data is used for AI model training or actuarial analysis. While this has been a standard practice among actuarial professionals, as AI systems become increasingly capable of re-identifying individuals from seemingly innocuous data combinations traditional anonymisation approaches alone are no longer sufficient [9, 10].

Fortunately, modern privacy-enhancing technologies exist that can systematically remove all information that can be used by AI systems to identify individuals. Enhanced data anonymisation employs advanced techniques – such as differential privacy, k-anonymity, and data masking – to further minimise re-identification risks. 

In actuarial practice, this is particularly relevant when sharing datasets with third-party vendors, reinsurers, or when feeding internal data into cloud-based AI models. For example, before uploading claims experience data to a machine learning platform for mortality modelling, actuaries should ensure that policyholder identifiers, including indirect ones such as postcode combined with date of birth and occupation, are removed or generalised. 

Tools exist that can automate the detection and removal of personally identifiable information (PII) at scale (see [11] for some examples). The UK Information Commissioner's Office (ICO) anonymisation guidance remains an important reference point for what constitutes effective anonymisation in a UK and European regulatory context [9].

Prompt sanitisation

Prompt sanitisation is the process of reviewing and modifying queries or instructions submitted to AI systems to remove sensitive, confidential, or PII before they are processed. This ensures that no private data is inadvertently exposed or stored during interactions with LLMs and chatbots. For example, prompts containing customer names, policy numbers, or specific identifying details can be automatically flagged/stopped or even sanitised (see previous example) before entering these models. 

The UK ICO's guidance on AI and data protection explicitly addresses the risks of personal data being inputted into generative AI systems and sets out expectations for organisations deploying such tools [12]. Similarly, the IFoA's ethical and professional guidance on data science and AI, calls on actuaries to apply appropriate controls to data inputs and outputs when using AI systems in their work [5]. Regulators and data protection authorities are increasingly treating prompt-level data exposure as a governance failure rather than a technical oversight, reinforcing the need for prompt sanitisation as a key component of responsible AI deployment.

In practice, prompt sanitisation can ensure that only non-sensitive, generalised information is submitted to AI platforms for analysis. This can be implemented through API-layer filters before queries reach an LLM, or through organisational policies requiring staff to review prompts before submission. For example, an actuary querying a general-purpose LLM to help draft an underwriting report should ensure no real policyholder data features in the prompt. Some organisations use prompt templates with pre-defined structures that prevent free-text personal data entry. Additionally, several filtering tools exist that can automate PII detection in prompts and outputs (see [13] for some examples).

Model risk management

With LLMs now being used by most employees across organisations, it is easy to overlook that they are fundamentally models, and they should be governed as such. The 2024 complaint against OpenAI, in which ChatGPT was found to have generated false personal information about real individuals, illustrates that the risks are multidirectional: not only can sensitive data enter these systems, but inaccurate personal information can exit them [7].

Actuaries are well-placed to contribute to LLM governance frameworks, not as the sole experts on data protection, but as a critical complement to information security, data protection Officers, and compliance teams. Actuaries add distinctive value in the rigorous, model-based scrutiny they bring: validating outputs for accuracy and fairness, identifying unintended consequences, and ensuring transparent documentation of model development and deployment. This mirrors established model risk management practices already embedded in actuarial work, such as those set out in the IFoA's ethical and professional guidance on data science and AI [5] and the International Actuarial Association’s (IAA) AI Governance Framework [4].

In practice, actuaries can advocate for LLMs to be subject to the same model inventory, validation, and monitoring controls applied to traditional actuarial models. This includes defining acceptable use policies, establishing output-testing protocols – particularly where LLM outputs inform decisions affecting individuals – and flagging where model behaviour in production deviates from expected performance [5, 6]. The IFoA has also issued a specific risk alert to members on the development and use of AI techniques and outputs, emphasising the profession's expectation that actuaries apply the same critical scrutiny to AI-generated outputs as to any other model [14]. Proactive model risk management in this context not only safeguards data privacy, but also reinforces the profession's broader commitment to ethical, evidence-based practice in an AI-driven environment.

Synthetic data

Synthetic data is artificially generated information designed to mirror the statistical properties of real datasets without containing actual personal data, for example, Mr Vader, Darth, 45 years, male. By decoupling analytical utility from privacy risk, it enables actuaries to develop, test, and validate models without exposing sensitive policyholder or customer information.

In actuarial practice, applications are broad and growing. Synthetic claims datasets can be used to train fraud detection algorithms, stress-test reserving models, or benchmark new machine learning techniques, all without the regulatory and ethical complications of using live personal data. Synthetic data also offers a practical solution when real data is scarce, for example in emerging risk categories or low-frequency, high-severity event modelling.

Regulatory and supervisory attention to synthetic data is increasing as organisations look to use it as a privacy‑enhancing technology that can expand and support data sharing while enabling beneficial innovation. The UK Financial Conduct Authority’s (FCA) report on the use of synthetic data in financial services highlights both the significant potential and the governance considerations that firms must address when adopting this approach [15]. 

The report identifies key risks – including the possibility that synthetic data may not adequately represent the real-world distribution of outcomes, potentially introducing model bias – and recommends that firms maintain robust validation processes when using synthetic data in consequential decisions. In practice, implementation can be supported by a range of open-source and commercial synthetic-data tooling and should be selected based on use case and governance needs rather than vendor preference (see [16] for some examples).

Data protection impact assessment (DPIA)

A Data Protection Impact Assessment (DPIA), as it is termed under GDPR, is a structured process for identifying, assessing, and mitigating the privacy risks of a new system or process before it is deployed. For AI systems, DPIAs are not merely regulatory formalities. Given the complexity and opacity of many AI models, they are essential tools for surfacing risks that may not be immediately apparent to those building or commissioning the system.

Under both the UK and EU GDPR, DPIAs are mandatory in “situations where data processing is likely to result in a high risk to individuals' rights and freedoms” [17, 18]. This will frequently be the case for AI models used in insurance underwriting, pricing, or claims decisions, given their potential for automated profiling and significant impact on individuals. Actuaries are well-placed to contribute to this process by providing the technical input needed to assess how a model processes personal data, what its failure modes are, and how its outputs might affect individuals.

In practice, this might involve an actuary documenting the data inputs, model logic, and intended use case of a new pricing algorithm as part of a DPIA, or stress-testing a model's outputs across demographic subgroups to identify potential discriminatory effects. Tools such as the ICO's DPIA screening and template resources can support structured and auditable DPIA workflows [19].

Looking forward

The tools and frameworks enabling actuaries to address the modern data privacy challenges in this AI era exist. What remains is for the profession to embrace them not as a compliance exercise, but as a natural extension of the professional standards actuaries have always upheld.

Done well, responsible data stewardship is not just a professional obligation – it is an opportunity to strengthen the trust that society places in the actuarial profession. Actuaries have a real opportunity to demonstrate that technical excellence and ethical responsibility are not mutually exclusive but are, in fact, inseparable.

References

Authors

  • Antreas Tsiakkas
    Antreas Tsiakkas
    IFoA’s Professionalism, Regulation and Ethics Working Party
  • IFoA’s Professionalism, Regulation and Ethics Working Party
    IFoA’s Professionalism, Regulation and Ethics Working Party

Popular topics