Skip to content
InfraLab Technology Co., Ltd.

Article

The OIC AI Governance Guideline: What Thai Insurers Need to Put in Place

A practical summary of the OIC's AI Governance Guideline for insurers, covering its four parts: governance, robustness and security, transparency, and consumer protection.

← All insights

In November 2025 (B.E. 2568), Thailand's Office of Insurance Commission (OIC) published its "Guideline on the Governance of Artificial Intelligence for Insurance Companies (AI Governance Guideline)". It sets out how to manage the new risks AI brings, on top of existing OIC notifications and guidelines. Its aim is for insurers to use AI responsibly and fairly, without creating barriers to the public's access to insurance.

The OIC supports innovation, balanced with consumer protection and the prudential soundness of insurers.

Who it applies to, and how

The guideline applies to insurance companies. It covers all forms of AI, including machine learning, deep learning and generative AI, whether built in-house or obtained from IT service providers.

It follows risk-based proportionality: requirements scale with the nature of the business and the complexity of the technology, with a focus on customer-facing and high-risk uses. High-risk AI use means AI in processes significant to the company's IT and cyber security, including use with personal data and customer interactions such as underwriting, premium setting, and claims and benefits management.

The guideline defines AI ethics as accountability, fairness, and transparency and explainability.

Four parts

  1. 01AI Governance
  2. 02Robustness and AI Security
  3. 03Transparency and Explainability
  4. 04Fairness and Consumer Protection

Part 1: Governance structure and risk management

The board of directors must oversee AI use responsibly, and may delegate this to a board sub-committee. The board must ensure there is an AI governance and risk management policy aligned with the Enterprise Risk Management (ERM) framework. It must also ensure responsibilities are assigned across the AI life cycle under the three lines of defense model.

Senior management must set internal processes or practices covering every form of AI use: design and development, choosing service providers, testing, data management, risk assessment, approval, and monitoring of outcomes. Management must also build awareness of AI ethics and risk among staff at every level. Control functions (risk management, compliance, actuarial and internal audit) should be trained for their roles.

Risk management means assessing risk by type of AI use, especially market conduct and prudential risk. Example risks named in the guideline:

  • Data protection and security, when AI processes personal or financial data.
  • Biased outcomes, and model risk and explainability.
  • Uninsurability, and personalised profit margins.
  • Intellectual property infringement, cybersecurity, and concentration risk in service providers.

For high-risk uses, insurers should keep a human in the loop or human over the loop. Management should report AI risk to the risk management committee and the board at least once a year.

Third-party AI, such as generative AI services: insurers should define the scope of internal use, including dos and don'ts. They should regularly assess how dependent they are on providers, and consider controls such as backup systems, a kill switch to stop an AI system immediately, a contingency plan, and an exit plan.

Part 2: Robustness and AI security

  • Regularly evaluate AI performance, for example with sensitivity analysis, adversarial testing and concept-drift detection.
  • Build security in from the start (secure by design) and fix vulnerabilities before going live.
  • Test security and manage vulnerabilities against international references such as the OWASP Top 10 for LLM Applications and the OWASP Machine Learning Security Top 10, including attacks such as data poisoning.
  • Keep logs for after-the-fact investigation. For high-risk systems, record user activity, model activity, and cybersecurity and personal-data events.
  • Maintain backup and recovery, and extend the cyber incident response plan (CIRP) to cover AI incidents.
  • Segregate AI environments by risk level.
  • Put measures in place against hallucination in generative AI.

InfraLab recommends: the guideline does not name prompt injection explicitly. We recommend that security testing of every LLM system include prompt-injection testing and controls against personal data leaking through prompts.

Part 3: Transparency and explainability

Insurers must be able to explain AI decisions and outputs, especially where they affect consumers, financial soundness or legal requirements. For complex systems that are hard to explain, insurers should consider extra controls, such as showing the AI's step-by-step reasoning (chain of thought), adding human oversight, or choosing a simpler model.

Insurers should record conclusions, causal relationships and system limitations, and write explanations in plain language. A fail-safe, or human intervention, should be available when data is abnormal.

Part 4: Fairness and consumer protection

  • Data management: set quality requirements for training, validation and testing datasets, and use reliable sources. Classify data by importance, separate company data from public data with a data boundary, keep a repository of the models used in the company, and document data sources.
  • Model bias: control and evaluate model performance both before and after deployment.
  • Outcome monitoring: use a feedback loop for continual improvement, and consider retiring or replacing models that miss their objectives.
  • Disclosing AI use: when AI interacts directly with customers, tell them in clear, unambiguous language, and offer the option to switch to a human staff member.
  • Customer rights: provide channels to report errors and let customers correct their data. For high-risk uses and complaints handling, explain the determinative factors behind AI decisions.
  • Granular risk-based pricing: this must rest on fairness, for example fairness by design, with channels for customers to request an explanation or human review.

From guideline to practice: InfraLab's recommendations

  • AI awareness: the guideline requires building ethics and risk awareness at all levels. We recommend an annual, measurable programme.
  • AI inventory: the guideline calls for a repository of models in use and reporting on significant AI use. We recommend extending this to a full AI inventory: who uses which AI, with what data, including the generative AI tools staff use.
  • Clear policies: the AI governance policy and its dos and don'ts should be communicated so every employee understands them the same way.
  • Labeling AI-generated content: the guideline requires disclosure when AI interacts with customers. We also recommend clearly labeling AI-generated content, internally and externally.

The guideline itself states no effective date and no penalties. Insurers should read it alongside the related OIC notifications and guidelines.

InfraLab and AI governance for insurers

InfraLab brings expertise in both applying AI in organizations and AI governance. We provide consulting and system design across the journey: a gap assessment against the OIC guideline, building an AI inventory, policy and risk framework, and designing AI infrastructure with environment segregation, logging, monitoring and kill-switch controls. The result is AI that is secure, transparent and audit-ready.

Download the full guideline using the form, or contact our team to discuss your organization's approach.