Artificial intelligence is moving out of the pilot phase and into production across property and casualty insurance. It promises to reshape how insurers underwrite risk, process claims, and serve customers, and the business case is compelling. McKinsey & Company estimates that AI could add up to $1.1 trillion in annual value for the global insurance industry.¹ Yet promise without governance is a liability, not an asset. Insurers underwrite risk for a living — yet AI deployed without governance is a risk most carriers have taken onto their books without ever pricing it.
P&C insurers operate in one of the most heavily regulated environments in the American economy, subject to state-by-state oversight, actuarial standards of practice, and growing regulatory scrutiny focused on algorithmic fairness, data privacy, and systemic risk. The National Association of Insurance Commissioners (NAIC) signaled the urgency of this moment when it adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023.²
This paper proposes a practical, four-pillar governance framework for AI deployment on the ServiceNow platform — designed specifically for the regulatory, operational, and architectural realities of the P&C insurance environment. It is grounded in real-world experience implementing and governing complex, multi-product ServiceNow environments in regulated, high-complexity industries.
Across P&C insurance, carriers are already experimenting on multiple fronts: large language models for claims summarization, machine learning for underwriting segmentation, computer vision for property damage assessment, and predictive analytics for fraud detection. In a competitive market of thin margins and tight combined ratios, the operational efficiency and pricing precision AI can deliver are hard to ignore.
But there is a significant gap between experimentation and enterprise-grade AI deployment. In a 2024 Deloitte survey of 200 U.S. insurance executives, 76 percent reported that their organizations had already deployed generative AI in at least one business function³ — yet adoption at that pace has outrun the governance and controls needed to deploy it safely. This is not simply a technology problem. It is an architectural problem, a process problem, and — increasingly — a regulatory problem.
There is an irony worth sitting with. No industry is better at identifying, pricing, and accepting risk than insurance — it is the business. Yet ungoverned AI is a risk many carriers have written onto their own books without underwriting it: no assessment of its likelihood, no pricing of its severity, no deliberate decision to accept it. The discipline carriers apply to every policy they issue is precisely the discipline missing from the way many of them are deploying AI.
ServiceNow has emerged as a central platform for enterprise operations at many large P&C insurers, and for good reason. Its single data model, workflow engine, and extensible application development environment make it a natural candidate for hosting AI-enabled insurance processes. But the same architectural flexibility that makes ServiceNow powerful also makes governance essential. Ungoverned AI on an enterprise platform is not just a compliance risk — it is a technical debt accelerant. In a regulated industry, it can materialize as a regulatory enforcement action, a class-action lawsuit, or a failed audit.
The question is not whether to govern AI on ServiceNow. It is how to govern it in a way that is appropriately scaled to the size of the organization, practically implementable without becoming a bureaucratic drag on innovation, and sufficiently rigorous to satisfy regulatory expectations that are still being written.
Platform governance for ServiceNow is not a new concept. I have written extensively on right-sizing governance frameworks to match the organizational footprint of the company deploying the platform.⁴ The principles that apply to demand governance, technical review boards, and executive steering boards remain sound. But AI in insurance introduces several dimensions of complexity that require governance to evolve beyond its traditional scope.
P&C insurance is regulated at the state level in the United States, meaning that an insurer operating across multiple states must satisfy the requirements of dozens of separate regulatory regimes. The NAIC's 2023 Model Bulletin establishes that AI systems used in insurance underwriting, claims handling, and policyholder servicing are subject to existing insurance laws prohibiting unfair discrimination — even when those systems were not designed with discriminatory intent.² This places new demands on governance: insurers must be able to demonstrate, on request, that their AI systems are fair, explainable, and compliant with applicable law.
Several state insurance departments — including those in Colorado and New York — have already issued guidance or proposed regulations specifically addressing the use of AI and external data in insurance decisions.⁵ Governance frameworks that do not account for the auditability and explainability requirements implied by these regulatory developments are already behind the curve.
Unlike most industries, insurance has a professional body — the Casualty Actuarial Society and the American Academy of Actuaries — that governs the standards of practice for the professionals responsible for pricing and reserving decisions. When AI systems influence or make decisions that actuaries are professionally responsible for validating, those AI systems must be governable at the level of individual model versions, training datasets, and outcome distributions. Platform governance frameworks must accommodate this requirement by design, not as an afterthought.
Claims handling is the highest-stakes operational process in P&C insurance. A claim denied or delayed due to an AI system error is not just an operational problem — it is a potential bad faith claim, a regulatory complaint, and a reputational event. The governance standards applied to AI systems operating within claims workflows must be correspondingly elevated, with explainability and override mechanisms built in from the start.
The framework presented here organizes AI governance into four interdependent pillars. Each addresses a distinct dimension of risk and responsibility. Together, they create an environment in which AI can be deployed with confidence — not because risk has been eliminated, but because it is understood, monitored, and managed.
The demand governance process — the mechanism by which the business requests and prioritizes new capabilities on the ServiceNow platform — must be extended to account for the unique characteristics of AI initiatives. Every proposed AI initiative should address the following questions before receiving approval to proceed:
These questions are not optional extras for regulated industries. They are the foundation of defensible AI deployment, and they must be embedded in the demand intake process rather than treated as afterthoughts.
Technical governance must establish and enforce architecture standards specific to AI system development and deployment on ServiceNow. These include standards for how AI models are integrated into workflows, how model versions are tracked and promoted across environments, how inference calls are logged for audit purposes, and how human-in-the-loop checkpoints are designed into high-stakes decision workflows.
A critical architectural guardrail concerns the separation of AI model training and inference from core transactional workflows. AI models should be deployed as discrete, independently versionable components — whether as ServiceNow AI Skills, external model integrations via Integration Hub, or custom scoped application components — rather than embedded directly in business rules or flow logic. This separation preserves the ability to update, retrain, or replace AI models without triggering cascading changes to core platform configurations.
Auditability is not a feature to be added after deployment. It is an architectural characteristic that must be designed into AI-enabled workflows from the outset. For P&C insurance deployments on ServiceNow, every AI-influenced decision must generate a durable, queryable log record capturing: the inputs provided to the AI system; the output or recommendation produced; the model version that produced it; and the identity of any human who acted on or overrode the recommendation.
Explainability requirements will vary by use case. A fraud referral score presented to a claims adjuster requires a different level of explainability than a first-notice-of-loss email draft. Governance frameworks should define explainability tiers — matched to the regulatory risk and operational consequence of each AI application — and enforce those tiers through technical review board standards.
The fourth pillar requires that AI governance not operate as a silo separate from the insurer's existing compliance and regulatory affairs functions. Legal, compliance, and actuarial stakeholders should have defined roles in the governance process for AI initiatives — not as veto holders, but as early-stage participants who can identify regulatory exposure before it becomes an implementation problem.
Every AI initiative that influences underwriting, rating, claims payment, or policyholder communication should receive a regulatory impact assessment at intake. This assessment should identify applicable state regulations and NAIC guidance, document the compliance positions taken, and establish the monitoring cadence for detecting compliance drift as regulatory requirements evolve.
A governance framework is only as effective as the organizational structure that enforces it. The three-committee model — Demand Governance, Technical Review Board, and Executive Steering Board — that forms the foundation of sound ServiceNow platform governance must be explicitly extended to cover AI initiatives.⁴
The Technical Review Board (TRB) should establish and maintain an AI Architecture Standards document defining approved patterns for AI integration, logging, explainability, and override design. Any AI initiative that deviates from these standards requires explicit TRB approval before proceeding to development.
The Executive Steering Board (ESB) should receive a quarterly AI Risk Report summarizing the inventory of AI systems in production, their performance against defined KPIs, any regulatory developments affecting deployed systems, and any incidents or near-misses involving AI outputs. This report elevates AI governance from an IT concern to a business leadership responsibility — which, in an era of increasing regulatory scrutiny, is precisely where it belongs.
P&C insurers that deploy AI without a formal governance framework are not moving faster than their competitors. They are accumulating regulatory, operational, and reputational risk that will slow them down — or stop them entirely — when it materializes. The framework presented in this paper is practical, scalable, and designed for the regulated environment of the P&C insurance industry.
Governance is not the enemy of innovation. Done well, it is the condition that makes sustainable innovation possible. Insurers that build governance into their AI programs from the start will be better positioned to move quickly, explain confidently, and scale responsibly — which is the only kind of AI adoption that serves carriers, policyholders, and regulators well.
Insurers don't accept risks they haven't underwritten. Governance is how you underwrite this one — how you assess it, price it, and decide, deliberately, how much of it to keep. That is not a brake on AI ambition. It is the only responsible way to act on it.
[1] McKinsey & Company. “Insurance 2030 — The impact of AI on the future of insurance.” 2021. McKinsey estimates AI could add up to $1.1 trillion in annual value across the global insurance industry. mckinsey.com
[2] National Association of Insurance Commissioners (NAIC). “Model Bulletin on the Use of Artificial Intelligence Systems by Insurers.” December 2023. content.naic.org
[3] Deloitte. “Scaling gen AI in insurance.” Deloitte Insights, 2024. Based on a June 2024 survey of 200 U.S. insurance executives (split evenly across L&A and P&C); 76 percent reported deploying generative AI in at least one business function. deloitte.com
[4] Pearson, C. “Right Sizing ServiceNow Governance.” ServiceNow Community, Developer Blog, February 2025.
[5] Colorado Division of Insurance. Regulation 10-1-1, “Use of External Consumer Data and Information Sources, Algorithms, and Predictive Models,” 3 CCR 702-1, effective November 2023. See also New York Department of Financial Services, Circular Letter No. 1 (2019) on algorithmic decision-making in insurance.
.svg){kind=icon}
