AIG and the Operating Cost of AI-Assisted Insurance

Summary

• AIG publicly describes a broad AI program spanning underwriting, claims, portfolio analysis, an enterprise ontology and an orchestration layer. Those disclosures establish capability and strategic direction, not a complete map of private architecture or proof of production reliability.
• Underwriting by AIG Assist and Claims by AIG Assist still depend on human authority. Underwriters and adjusters remain responsible for interpreting evidence, resolving ambiguity, applying policy language and handling consequential exceptions.
• AIG reports higher submission volume, a better submit-to-bind ratio and shorter stages in selected claims workflows. Those figures are first-party operating disclosures. They should not be treated as independent benchmarks or as proof that one model caused a customer outcome.
• The durable cost sits around the model: document ingestion, ontology maintenance, access control, workflow integration, review, auditability, cybersecurity, privacy, resilience, vendor management, release discipline and rollback.
• CyberMatics and IntelliRisk show that AIG's technology surface extends beyond generative AI. Risk scores, dashboards, partner telemetry and claims data each create separate questions about data provenance, product reliability and customer use.
• A credible operating case should separate model capability, production reliability and customer outcome; measure exception queues and correction work; retain human override; test recovery; and preserve evidence that a decision can be reconstructed.

American International Group, Inc., commonly known as AIG, is a global insurance organization whose technology decisions sit inside underwriting, claims, risk engineering, policy administration, broker distribution, cyber services and multinational operations. That scope makes AIG a useful case for a question that is often lost in discussions of artificial intelligence: what does an AI-assisted insurance service cost after the demonstration is over?

AIG's 2025 annual report gives a unusually direct public account of its direction. It describes Underwriting by AIG Assist, an extension of related capabilities into claims, an enterprise ontology, named technology partners and work on orchestration. AIG also publishes security, vulnerability, privacy and resilience disclosures, plus product pages for CyberMatics and IntelliRisk. Together, these materials support a detailed analysis of operating boundaries [S03][S04][S09][S10][S11][S12][S13][S14]. They do not expose every internal model, control, supplier, staffing level or system dependency.

The central conclusion is that model capability is only the first layer. Production reliability depends on current data, stable interfaces, controlled access, observable workflows, human review, safe failure and recoverability. Customer outcome depends on whether the insurance decision, communication and remedy were correct for the affected party. A fluent model can help organize a submission and still leave the insurer with substantial work to establish authority, accuracy, fairness, resilience and accountability.

1. Exact entity and global insurance boundary

The subject is the current BTW directory entity for American International Group, Inc. [S01]. AIG's company materials describe a global insurance organization operating through subsidiaries, affiliates, licenses, authorizations and network relationships [S02]. The Global Legal Entity Identifier Foundation record supplies an independent legal-entity reference [S17]. These sources establish the corporate boundary used here. They do not imply that every AIG-branded service shares one legal entity, one technology stack or one control environment.

That distinction matters in insurance. A global brand can sit above regulated carriers, service companies, distribution arrangements and local operations. A policy may be written by one entity while technology, data or claims support comes from another. A customer may interact with a portal that spans products but still face product-specific policy terms and jurisdictional rules. Technology analysis that treats the brand as a single database or application will miss those boundaries.

The directory summary provides useful scope, but it is not a substitute for current filings. AIG's 2025 Form 10-K is the authoritative public filing for business and risk disclosures [S05]. The investor-relations page identifies the current reporting materials [S08]. These records support an analysis of technology as part of a large insurance operating model, not as a standalone software product.

Entity precision also constrains performance claims. A statement about one underwriting program cannot automatically be extended to every line, region or subsidiary. A claims workflow in a complex commercial line may have different evidence, review and timing requirements from a simpler process. A cyber-risk service can depend on partners and telemetry that are irrelevant to another product. The article therefore treats every public result as bounded to the context AIG provides.

The practical requirement is an ownership map. For each AI-assisted workflow, operators need to know which legal and business entity owns the decision, which system holds the authoritative record, which policy language applies, where data may move, who reviews an exception and who answers the customer. That map is an operating control. Without it, a technically plausible output can travel farther than its authority.

2. Underwriting, claims and risk-service operating scope

Insurance converts incomplete evidence about uncertain events into decisions that have financial and legal consequences. Underwriting assesses a proposed risk and sets terms. Claims work interprets policy language and loss facts after an event. Risk engineering and cyber services may help a client understand or reduce exposure. Each area can benefit from faster information processing, but each also creates a different reliability burden.

AIG's annual report presents AI as part of an end-to-end effort across underwriting and claims [S03][S04]. Its product pages add other digital surfaces. CyberMatics is described as a process that uses partner-supplied information to update a cyber maturity profile and provide scores and recommendations [S13]. IntelliRisk is presented as a risk-management information system with claims data, dashboards, searches and reporting [S14]. The company therefore has several technology relationships with users: internal assistance, client-facing information, partner data exchange and regulated insurance decisions.

Those surfaces should not be collapsed into one adoption number. An underwriter may use extracted submission fields as an aid. An adjuster may receive help locating policy documents. A risk manager may view a dashboard. A cyber partner may translate client telemetry into answers to defined questions. Each workflow has a distinct source of truth, consequence, timing requirement and exception route.

The operating cost follows those differences. Underwriting needs document classification, field provenance, appetite rules and referral routes. Claims needs policy version control, coverage interpretation, loss documentation and escalation. Risk dashboards need data refresh, permissions, reconciliation and explanation. Partner-fed cyber services need interface governance, consent boundaries, quality checks and dispute handling. A common model or platform may reduce duplicated infrastructure, but it does not remove domain-specific control.

This is why an insurance AI program cannot be judged only by how many documents it reads. The system must fit a business process whose authority remains distributed across policy language, regulated entities, professional judgment and customer communication. AIG's public materials support the existence of a broad program. They do not show a universal architecture or a single reliability score across that program.

3. What AIG publicly says about its AI strategy

AIG's 2025 annual report says the company is applying AI to underwriting and claims, building an ontology and developing orchestration capabilities [S03][S04]. It names relationships with Palantir, Anthropic, AWS and Google. It also describes a deliberate concern with underwriting discipline, auditability, regulatory clarity and human oversight. These statements make the operating ambition unusually visible.

The ontology is especially important. AIG describes it as a shared framework for concepts, processes, data elements and workflows. In practical terms, that means the AI layer cannot be separated from the meaning of insurance data. A policy limit, attachment point, endorsement, insured location, claim notice or broker submission is not merely a string. It has a definition, provenance, effective date, relationship to other records and consequence in a particular workflow.

Orchestration adds another layer. AIG says the work will define when automated capabilities are activated, what information they can access, how tasks are sequenced and where human oversight is required. That is not just a model feature. It is an authority and control problem. An orchestration layer can make a workflow more coherent, but it also becomes a place where access, ordering, retries, timeouts and escalation must be governed.

Named partners are evidence of dependency, not a complete architecture diagram. Public disclosures do not specify every service boundary, model version, contract, data path or fallback. It would be wrong to infer that each partner participates in every AIG workflow. It would also be wrong to assume that a disclosed model capability determines the reliability of AIG's end-to-end product.

The relevant cost categories are therefore clear even when private details are unavailable. AIG must maintain shared definitions, control access, connect authoritative systems, observe behavior, review outputs, manage changes and preserve evidence. Partner services need vendor oversight and exit planning. Human users need training and a route to challenge output. Compliance and audit teams need records that distinguish what the system suggested from what an authorized person decided.

A strategy can be coherent without every element being mature. The public evidence supports direction and selected deployed capabilities. It does not establish that orchestration is complete across all products, that every ontology concept is stable or that every AI-assisted workflow has the same quality. A sound assessment should preserve that uncertainty.

4. Underwriting assistance and unstructured submissions

AIG describes its underwriting assistance program as using large language models to process hundreds of documents arriving in different unstructured forms, extract key fields and prepare information for underwriters [S15]. The annual report says Underwriting by AIG Assist has been scaled and provides first-party figures for submission volume and a submit-to-bind ratio in a stated context [S03][S04]. The useful technical question is what must work around that extraction.

Submission documents can contain conflicting dates, duplicated schedules, scanned pages, tables, handwritten notes, endorsements and references to prior correspondence. The first failure mode is not necessarily a wrong final decision. It may be a missed page, a field attached to the wrong insured, an old value treated as current or an uncertainty presented as a fact. Good extraction therefore needs provenance. The underwriter should be able to see where a value came from and whether the system transformed it.

The second requirement is reconciliation. A submission may disagree with a policy-administration record, broker data or an external source. Automation can highlight the difference, but it should not silently choose authority. Some conflicts require clarification from the broker. Others reveal an intake defect. A structured exception queue is part of the product, not an admission that the product failed.

The third requirement is workflow fit. Underwriters need information at the right time and level of detail. Too many alerts can recreate the burden the system was intended to reduce. A compressed summary can hide a material exclusion. A generated explanation can sound certain even when the source is ambiguous. Review controls should therefore be proportionate to consequence and allow a user to move from summary to evidence.

AIG reports that its program enabled more submissions to be reviewed and describes an improved ratio in one rollout context [S03]. Those are relevant first-party operating disclosures, but they do not isolate causality. Portfolio mix, staffing, appetite, pricing and process changes can move the same measures. A higher ratio does not by itself prove better risk selection or a better customer outcome.

The recurring cost includes document pipelines, classification, optical recognition where needed, field mapping, quality sampling, correction capture, user support, model and software changes, and monitoring for drift in document types. The value case should count the time saved on routine intake and the time added for exception review, correction and governance. Only the net effect describes the operating system.

5. Claims assistance, adjuster review and hard exceptions

Claims work begins after a loss, when the customer may be under pressure and the facts may still be developing. AIG's intelligence team says Claims by AIG Assist helps identify policies and endorsements relevant to a claim and supports adjuster review under human oversight [S16]. The annual report describes first-party reductions in selected process stages where the capability has been deployed [S03][S04]. These claims support a workflow analysis, not a universal service guarantee.

Policy identification is a retrieval problem with a legal boundary. The applicable contract may include endorsements, schedules, exclusions and amendments. Versions matter. A policy document can be correctly retrieved while the relationship between its provisions and the loss remains disputed. Assistance can reduce search effort, but the adjuster still owns interpretation and communication.

Claims also contain severe exceptions. A cyber incident can involve changing facts, external specialists and urgent containment. A catastrophe can create many claims at once, damaged infrastructure and incomplete documentation. A geopolitical event can raise sanctions or jurisdictional questions. A model trained on routine patterns may be least reliable precisely when the consequence is highest.

Safe operation requires a hierarchy of authority. Authoritative policy records and verified claim facts should outrank generated summaries. The system should expose uncertainty, not resolve it through confident prose. Material coverage decisions need review and a record of the evidence used. When documents are missing or systems are degraded, the workflow needs a safe manual route.

Human oversight is not merely an approval click. An adjuster needs time, relevant expertise and the ability to disagree. Supervisors need signals about unusual volume, repeated corrections and stalled cases. Legal, compliance, fraud, cyber response or specialist teams may need escalation. Customer communication should distinguish a preliminary step from a final determination.

The cost of AI-assisted claims therefore includes exception staffing, policy-version control, source linking, access restriction, quality review, service recovery and training. Faster movement to an adjuster can be valuable, but customer outcome depends on correct coverage analysis, timely communication and appropriate remedy. A reduced internal stage time does not alone establish those outcomes.

6. Ontology, data contracts and integration cost

An ontology promises a shared language across data and workflows. In insurance, that can reduce ambiguity between business units and systems. It can also become a major maintenance obligation. Every concept needs a definition, owner, relationship and change process. If two systems use the same label for different meanings, an AI layer can scale the mismatch.

AIG's annual report links its ontology work to underwriting, claims, portfolio analysis and strategic transactions [S03][S04]. That scope makes integration central. Data from acquired or renewed portfolios may arrive under different conventions. Policy and claims records can span years. Broker submissions may use their own structures. A shared model of the business can help compare them, but only if mapping decisions are explicit and reversible.

Data contracts should define required fields, allowed values, timeliness, provenance and failure behavior. They should also describe what happens when a source is late or incomplete. A successful interface call is not proof of a complete business record. A field can be syntactically valid and semantically wrong. Reconciliation needs business-level checks.

Changes create second-order effects. Renaming a concept can alter retrieval, reporting and access rules. Adding a relationship can expose information to a workflow that did not previously need it. A new model may interpret older text differently. A partner update may change field coverage. Versioning should make it possible to reconstruct which definitions and software were active for a decision.

Integration also creates latency and availability dependencies. Underwriting may tolerate a delayed enrichment source differently from claims intake during an urgent event. A fallback may permit work to continue with reduced information, but the user needs to know the mode. Retried actions must not duplicate a record or advance a case twice. Uncertain state requires reconciliation rather than optimism.

The durable work includes schema governance, mapping review, data-quality monitoring, lineage, permissions, migration, test fixtures, release coordination and retirement of old interfaces. These costs can be justified by reuse across workflows, but they do not disappear when model prices fall. In many enterprises, the shared meaning and integration layer is the harder asset to build and the harder dependency to replace.

7. Orchestration, authority and human oversight

AIG's public description of orchestration focuses on activation, information access, task sequence and human oversight [S03][S04]. Those are the right design questions because an automated workflow can create risk even when each component performs its narrow function.

Activation defines when assistance is appropriate. A routine commercial submission may be eligible for automated extraction, while a novel or sensitive case may need a different route. A claims workflow may use assistance to locate documents but not to determine authority. Eligibility rules need owners, versioning and monitoring. If they are too broad, the system reaches cases it was not designed to handle. If they are too narrow, users work around it.

Access defines the information boundary. The fact that a user can see a record does not mean every automated component should receive it. Least privilege must account for purpose, not only identity. Sensitive claim, health, employment or security information may require additional restriction. Access should be logged, reviewable and revoked when roles change.

Sequence defines dependency. A summary generated before all documents arrive may be stale by the time a decision is made. A downstream task can run on an unverified field. A retry can create duplicate work. Orchestration should represent prerequisites and uncertain state explicitly. It should support pause, escalation and reversal.

Human oversight defines authority. The reviewer needs sufficient context and a meaningful choice. If the interface makes acceptance easy and challenge difficult, a nominal human step may provide little control. Review quality can decline under volume pressure. Monitoring should consider overrides, corrections, escalations, time spent and repeated failure patterns, not only completion.

The operating cost includes policy design, access administration, queue management, observability, training, quality sampling and incident response. It also includes organizational negotiation over who owns a cross-functional workflow. That is not incidental overhead. It is how an insurer preserves accountability when capability crosses underwriting, claims, data, technology and risk.

8. Reported workflow outcomes versus independent proof

AIG's annual report provides several quantitative statements about its AI-assisted work [S03][S04]. It reports submission volume and year-over-year movement in a Lexington context, an improved submit-to-bind ratio following a rollout, and shorter stages in selected claims processes where the capability was deployed. These disclosures are useful because they name an operating context. They remain first-party reports.

The first discipline is to preserve the denominator. A submission count does not show document complexity, risk mix or review depth. A ratio can change because of appetite, pricing, broker behavior or portfolio composition. A cycle-time measure needs defined start and end events. A move from days to hours in a selected stage does not necessarily mean the entire claim is resolved at the same rate.

The second discipline is to separate correlation and mechanism. AI-assisted extraction may reduce manual collection. Better data, revised workflows, more staffing or policy changes may also contribute. A credible evaluation should describe concurrent changes and include a suitable baseline. This article does not assign the reported improvements solely to a model.

The third discipline is to examine quality and tails. Faster processing can be valuable while correction work rises. More reviewed submissions can improve opportunity while low-value volume consumes attention. A better average can hide a small number of severe errors. Insurance consequence is not evenly distributed, so evaluation should include high-impact exceptions.

Production reliability needs operational measures such as data freshness, retrieval completeness, correction rates, escalation rates, latency, availability and recovery. Customer outcome needs measures such as clarity, timeliness, correct application of policy and effective remedy. These are examples of the evidence needed; the public materials do not provide a complete current distribution for each AIG workflow.

AIG's disclosures are therefore stronger than a generic claim that AI creates efficiency, but they are not an independent benchmark. The responsible conclusion is bounded: AIG says selected workflows have reached meaningful scale and reports operating improvements. Further evidence would be needed to compare systems, isolate causality or establish a customer result.

9. Capability versus production reliability

Capability asks whether a system can perform a task under defined conditions. A model can extract fields, classify documents, retrieve policy language or summarize a claim. AIG's public materials support those categories of capability [S03][S15][S16]. Production reliability asks whether the entire service performs consistently with current data, correct authority and safe failure.

The difference matters because a correct model response can be embedded in an unreliable workflow. The source document may be incomplete. An interface may deliver an old version. Access rules may be wrong. The output may not reach the right reviewer. A queue may stall silently. A release may change behavior. A fallback may not preserve the evidence needed to reconstruct a decision.

Reliability is multidimensional. Availability without correctness can accelerate error. Correctness without timeliness can make information unusable. A secure system that prevents legitimate work can create operational harm. A fast summary that omits a material endorsement can be worse than a slower manual review. The right service objective depends on consequence.

Monitoring should therefore cover the task, not only the model. Operators need to know whether inputs arrived, whether expected evidence was present, whether output was reviewed, whether exceptions were resolved and whether the authoritative record was updated correctly. Model-level evaluation is still useful, but it is one component of end-to-end control.

Recovery is part of reliability. AIG's enterprise resilience disclosure describes continuity, technology recovery, event management, exercises and monitoring [S11]. An AI-assisted workflow should fit that structure. When a dependency fails, users need a known reduced mode. Work should not disappear between automated and manual queues. Recovered data should be reconciled before normal processing resumes.

No public source establishes one universal reliability score for AIG's AI program. That absence should not be filled with assumptions. The analytical result is a set of requirements: observable dependencies, current data, explicit authority, safe degradation, tested recovery and evidence that survives change.

10. Production reliability versus customer outcome

Customer outcome is broader than reliable system operation. A service can be technically available and still apply a poor policy. It can retrieve the correct document and still communicate a decision badly. It can reduce internal time while leaving the affected party uncertain. Insurance adds legal, contractual and human dimensions that cannot be reduced to a model score.

For underwriting, a customer outcome might involve timely and understandable terms, appropriate treatment of information and a reliable route to correct an error. For claims, it can involve accurate coverage analysis, clear communication, payment or other remedy, and support during a difficult event. The responsible measure depends on the product and context.

AIG's current claims story emphasizes human oversight and the role of adjusters [S16]. That boundary is important. An AI-assisted step may shorten document handling, while the outcome still depends on expertise, evidence and communication. A catastrophe or cyber breach can require coordination with specialists and external parties. The system's value is partly in supporting that work, not replacing its accountability.

Outcome evidence also needs distribution. An average can hide customers with unusual policy histories, accessibility needs, disputed identity, complex multinational arrangements or severe losses. Exception routes determine whether those cases receive meaningful review. A low escalation count may indicate good operation or difficulty reaching support.

Financial performance is even farther from a single technology. AIG's investor materials provide operating context [S08], but underwriting income, ratios or returns reflect pricing, risk selection, claims experience, reinsurance, capital, market conditions and many other decisions. It would be unsound to assign a company-wide financial result to one AI workflow without a bounded evaluation.

The practical governance rule is simple: report capability, production reliability and customer outcome separately. Link them through a stated mechanism, but do not merge them into one success label. That structure allows leaders to see whether faster processing is accompanied by stable quality, manageable exceptions and appropriate customer treatment.

11. Cybersecurity, vulnerability intake and resilience

AIG publishes a cyber and information-security page, a vulnerability-disclosure program and an enterprise-resilience disclosure [S09][S10][S11]. These materials establish public control surfaces without revealing private defensive architecture. They also show why AI operating cost cannot be separated from security and continuity.

The vulnerability program provides a structured route for researchers to submit reproducible issues for review [S10]. That route creates work: intake, validation, severity assessment, ownership, remediation, communication and closure. A report can be incomplete or duplicate. A suspected issue can affect several services. Corrective action may require coordination with a supplier. The public program is a capability; its reliability depends on process performance that is not fully visible.

AI-assisted services expand the attack and error surface. Sensitive data may be included in an inappropriate context. Retrieved content may be malicious or misleading. An identity or permission defect can expose information. A dependency can change behavior. Security controls need to cover data movement, access, software supply, configuration, monitoring and response.

Resilience adds preparation for disruption. AIG says its program covers business continuity, technology disaster recovery, event management, impact assessment, testing, exercises, training and management reporting [S11]. It also describes continuous monitoring centers. These are first-party program descriptions, not proof that every scenario will recover within a particular time.

For an AI-assisted workflow, continuity should define safe degradation. Underwriters and adjusters may need an approved manual route. A system may become read-only if an action cannot be confirmed. Queues should preserve ordering and ownership. Recovery should reconcile work completed during the disruption. Critical evidence should remain available even if the assistance layer is not.

Exercises need realistic dependency and data failures, not only a total outage. A source may deliver stale information. A model service may respond while quality has changed. An identity system may be partially available. A regional event may create both technical disruption and a surge in claims. These mixed conditions test whether authority and communication remain coherent.

12. Privacy and the continuing data lifecycle

AIG's public privacy policy describes a broad information lifecycle [S12]. Insurance data can include identity, contact, policy, claims, financial, employment, health, device or security information depending on the service. The public policy does not reveal every internal data set, but it establishes that collection, use, disclosure, protection, transfer and individual rights are continuing obligations.

AI-assisted workflows can increase reuse. A document collected for underwriting may appear useful for portfolio analysis. Claims text may improve search or classification. Partner telemetry may support cyber-risk assessment. Technical feasibility does not determine whether a new use is appropriate. Purpose, notice, legal basis, contract and expectation still matter.

Data minimization is operational. The workflow should provide only the information necessary for the task. A broad document store may be convenient for retrieval but expand exposure. Redaction or field-level access can reduce risk, but those controls need accuracy and maintenance. Sensitive information should not be copied into logs or secondary systems without a defined need.

Retention and deletion are also system behaviors. Records may have legal or regulatory retention requirements, while temporary working data may not. A model interaction can create derived text that contains the same sensitive facts as the source. Deleting the source while retaining a derived copy may not satisfy the intended control. Data maps need to include caches, indexes, analytics and recovery copies.

Rights and correction create exceptions. A person may challenge information or request access where applicable. The organization needs to locate relevant records, understand provenance and avoid propagating a correction incompletely. An ontology can help connect records, but it can also spread an incorrect relationship if governance is weak.

Privacy cost includes classification, permissions, review, records management, transfer controls, vendor terms, request handling, incident response and change assessment. It should be included in the AI business case. A cheaper model does not reduce the obligation to know what data it receives, why it receives it and how the organization can correct or remove it.

13. CyberMatics and IntelliRisk capability boundaries

CyberMatics and IntelliRisk demonstrate that AIG's technology program includes client and partner surfaces as well as internal assistance [S13][S14]. They also show why product capability must be separated from production reliability.

AIG describes CyberMatics as using information from approved security partners to update a cyber maturity profile and provide scores, recommendations and modeling. The page says a partner translates client data before sending answers to defined application questions and states that AIG does not receive raw client data in that process [S13]. That is a meaningful public boundary.

The design still creates questions. Partner collection and translation need quality controls. A score needs a defined version and explanation. A recommendation can become stale as a client's environment changes. Dashboard availability and access must be managed. A customer may dispute the input or the inferred priority. The public page does not establish alert precision, completeness, adoption or avoided loss.

IntelliRisk is presented as a risk-management information system with dashboards, searches, reporting and access to claims data across many countries [S14]. Its value depends on data freshness, consistent definitions, permissions and reconciliation. A visual trend can be technically correct while combining incomparable categories. A search can return records while omitting a newly loaded claim. User support and data-quality correction are part of the service.

These products also illustrate vendor and jurisdictional complexity. Data may originate in several systems or countries. Roles differ among client, broker, risk manager and AIG staff. A feature that is appropriate for one role may expose too much to another. Changes to a partner interface or claims schema can affect the customer-facing result.

The operating case should measure more than logins or displayed scores. Useful evidence can include refresh timeliness, completeness, correction time, unresolved exceptions, access-review results, support demand and user decisions informed by the tool. Those are evaluation categories, not claims about AIG's private measures.

The broader lesson is that AI and analytics sit inside products with ongoing service obligations. A scoring model, dashboard or document assistant can be technically capable while the surrounding product is difficult to maintain. The cost belongs to the end-to-end service.

14. Partner dependency and vendor control

AIG's annual report names several technology relationships in connection with its AI strategy [S03][S04]. CyberMatics lists security partners in a separate product context [S13]. Public disclosure of a relationship does not reveal every contractual or technical detail, and a named partner should not be assumed to participate in every workflow.

Vendor dependency has several layers. Infrastructure may affect availability and data location. A model service may affect behavior, capacity and policy. A data partner may affect completeness and timeliness. A software platform may shape ontology, integration or observability. Each dependency needs an owner and a service boundary.

Contracting is necessary but limited public evidence. Operators need to know how a change is communicated, how access is revoked, how incidents are coordinated and how data can be recovered. A provider may satisfy its service target while the insurer's end-to-end workflow fails. Monitoring should therefore include business outcomes such as queue progression and record reconciliation, not only supplier status.

Model dependencies create change risk. A version can improve general capability while altering behavior in a specialized task. Capacity limits can appear during a surge. Safety or policy changes can affect output. Acceptance checks should be tied to AIG's controlled use case. High-consequence workflows need fallback and a clear rule for when to stop automated assistance.

Concentration can be hidden. Several products may share the same identity, cloud region, data platform or communications service. Separate dashboards can make the applications look independent while one dependency connects them. Conversely, duplicating every service can create inconsistent controls and high maintenance. Architecture should make the tradeoff visible.

Exit planning is part of cost. Data needs portable formats and retained meaning. Historical decisions need readable evidence. Alternative workflows need testing. Staff need time to migrate. A replacement may require remapping ontology concepts and retraining users. Switching is not an emergency procurement action; it is a capability that must exist before a dependency becomes urgent.

15. Maintenance, release and model lifecycle

AIG's Form 10-K identifies technology, cyber, data, models, third parties, operations and continuity as risk areas [S05]. The annual report describes rapid development in AI [S03][S04]. Together, these disclosures support a lifecycle view: the service must be maintained through changing models, software, data and business rules.

Release discipline starts with scope. A change may affect extraction, retrieval, ranking, summaries, access, routing or the user interface. Each has a different failure mode. A model update can alter output without changing an interface. An ontology update can change several workflows at once. A new data source can improve coverage while introducing inconsistent values.

Testing should reflect actual tasks and consequences. General language quality is not enough for policy retrieval or claim review. Evaluation needs representative documents, rare but severe cases, changed formats and known ambiguities. It should assess unsupported assertions, omissions, provenance and escalation behavior. Results should be compared with a defined prior version.

Deployment needs observability and reversal. Teams should know which version handled a case and which data definitions were active. A release should have stop conditions. If a correction or escalation rate rises, the operator needs to narrow or reverse the change. A fallback should not silently discard work or produce an untraceable decision.

Maintenance includes the human environment. Users need updated guidance when a capability changes. Reviewers can become overconfident as outputs improve. New employees need training in authority and escalation. Support teams need known ownership. Policy and compliance review must keep pace with product evolution.

Retirement is often neglected. Old interfaces and models can remain because a downstream user still depends on them. Duplicate paths create inconsistent behavior and security exposure. Retirement requires dependency discovery, record preservation, migration and communication. The saved license or compute cost may be smaller than the work of removing the old path safely.

The relevant economic unit is therefore the lifecycle, not a request to a model. Acquisition, integration, evaluation, supervision, incident response, change and retirement all belong in the cost. AIG's disclosed scale can make reuse valuable, but scale also raises the consequence of a weak common dependency.

16. Failure modes, escalation and exception handling

Failure mode analysis turns a broad technology strategy into an operating plan. AIG's filings, security pages, vulnerability route, resilience disclosure and claims account support several public categories [S05][S09][S10][S11][S16]. They do not reveal private incident history or exact control performance.

Input failure includes missing, duplicated, stale or contradictory documents. Extraction failure includes a missed field, wrong relationship or unsupported inference. Retrieval failure includes the wrong policy version or incomplete endorsement set. Workflow failure includes misrouting, duplicate action, stalled queue or uncertain state. Access failure includes overexposure or a legitimate user being blocked.

Human failure remains possible. A reviewer can accept a plausible summary too quickly. An overloaded queue can delay escalation. Expertise may be unavailable during a surge. A policy can be interpreted inconsistently. Training can lag a release. Automation may make the process faster without making accountability clearer.

Dependency failure includes outage, latency, capacity, behavior change, corrupt data or incomplete notification. Security failure includes unauthorized access, malicious content, vulnerable software or leaked sensitive information. Resilience failure includes an untested fallback, lost work during recovery or a manual process that cannot handle volume.

Outcome failure can occur even when technology behaves as designed. A rule may be inappropriate. Communication may be unclear. A customer may not reach an effective correction route. A technically correct decision may create severe downstream consequences. Monitoring should include complaints, corrections and remediation, not only system health.

Exception handling requires explicit queues, ownership, priority and aging. Cases need enough context to review. Escalation should be possible without losing the original evidence. Repeated exceptions should feed product improvement rather than remain isolated support events. Severe cases need cross-functional coordination.

The cost is not a defect in the business case. It is the price of operating safely under uncertainty. A useful automation program can reduce routine effort while increasing the importance of specialized review. Leaders should compare the total queue before and after deployment: routine work removed, new monitoring added, corrections created and high-consequence exceptions handled.

17. Decision framework for technical buyers and operators

AIG's public record supports a structured decision framework. The first question is capability: what exact task does the system perform, on which sources, with what authority? Underwriting extraction, claims retrieval, cyber scoring and risk dashboards should each have their own answer.

The second question is production reliability: what must remain true for the end-to-end service to work? Identify authoritative systems, data freshness, access, interfaces, queue behavior, latency, monitoring, recovery and fallback. Define how the service exposes uncertainty and how a user reaches evidence.

The third question is customer outcome: what changes for the insured, broker or claimant, and how is that measured? Preserve the baseline and context. Separate internal stage time from complete resolution. Examine severe exceptions as well as averages. Do not infer customer benefit from adoption or financial performance alone.

The fourth question is supervision. Name the authorized reviewer, the cases that require review, the evidence available and the route to disagree. Measure correction and escalation. Ensure that volume does not turn a meaningful decision into a ceremonial click.

The fifth question is integration and maintenance. List data contracts, ontology concepts, dependencies, versions and owners. Budget for mapping, testing, monitoring, support, release, rollback and retirement. Include privacy, cybersecurity, resilience and vendor control.

The sixth question is failure and recovery. Enumerate input, model, workflow, human, dependency, security and outcome failure modes. Give each a detection signal, owner and safe action. Test mixed conditions such as partial availability and volume surge. Reconcile work after recovery.

The seventh question is reversibility. Can AIG narrow a capability, stop it, return to a controlled manual route and preserve evidence? Can it replace a dependency without losing record meaning? Can it explain which version contributed to a decision? Reversibility is an operating asset.

This framework does not reject AIG's reported progress. It places that progress in the context required for a global insurer. The public materials show a serious effort to connect AI with data, workflows and human oversight. The remaining burden is continuous: demonstrate that capability becomes a reliable product and that the product contributes to appropriate customer outcomes without hiding the cost of supervision and exceptions.

Verdict

AIG's public disclosures provide credible evidence of deployed AI-assisted underwriting, expanding claims use, ontology investment and a developing orchestration layer. They also provide unusually useful first-party operating figures. The record is strong enough to conclude that AIG has moved beyond an isolated demonstration.

It is not strong enough to assign one reliability score, independent benchmark or causal customer result to the program. AIG's reported improvements remain bounded by product, workflow and measurement context. CyberMatics, IntelliRisk, security, privacy and resilience materials show that the full operating surface is wider than the model.

For technical buyers and operators, the decisive work is around the capability: current data, policy and claim provenance, ontology maintenance, access, partner control, human authority, exception queues, release discipline, recovery and auditability. Those controls create recurrent cost, but they are also what can turn an impressive model function into a durable insurance service.

The correct evaluation is therefore neither that AI automatically transforms insurance nor that human oversight cancels the value of automation. The stronger conclusion is conditional. AI-assisted underwriting and claims can reduce routine handling and improve access to information when the organization measures end-to-end reliability, preserves professional judgment, funds exception handling and tests whether customer outcomes improve. AIG's public strategy points in that direction; ongoing operating evidence must establish how consistently it gets there.

Sources

1. [S01] BTW directory, American International Group, Inc.: https://btw.media/en/directory/american-international-group-inc
2. [S02] AIG, About AIG: https://www.aig.com/home/about
3. [S03] AIG, 2025 Annual Report page: https://www.aig.com/home/investor-relations/aig-2025-annual-report
4. [S04] AIG, 2025 Annual Report PDF: https://www.aig.com/content/dam/aig/america-canada/us/documents/investor-relations/annual-report/aig-2025-annual-report.pdf
5. [S05] US SEC, AIG 2025 Form 10-K: https://www.sec.gov/Archives/edgar/data/5272/000000527226000023/aig-20251231.htm
6. [S06] AIG, 2026 Proxy Statement PDF: https://www.aig.com/content/dam/aig/america-canada/us/documents/investor-relations/notice-of-annual-meeting-and-proxy-statement/aig-2026-notice-of-annual-meeting-and-proxy-statement.pdf
7. [S07] US SEC, AIG 2026 Proxy Statement: https://www.sec.gov/Archives/edgar/data/5272/000000527226000039/aig-20260331.htm
8. [S08] AIG Investor Relations: https://www.aig.com/home/investor-relations
9. [S09] AIG, Cyber and Information Security: https://www.aig.com/home/about/cyber-and-information-security
10. [S10] AIG, Vulnerability Disclosure: https://www.aig.com/home/about/cyber-and-information-security/vulnerability-disclosure
11. [S11] AIG, Enterprise Resilience Disclosure: https://www.aig.com/enterprise-resilience-disclosure
12. [S12] AIG Privacy Policy: https://www.aig.com/privacy-policy
13. [S13] AIG, CyberMatics: https://www.aig.com/home/risk-solutions/business/cyber/cybermatics
14. [S14] AIG, IntelliRisk: https://www.aig.com/intellirisk
15. [S15] AIG, AIG Leaders Discuss GenAI and the Atlanta Innovation Hub: https://www.aig.com/home/intelligence team/stories/aig-leaders-discuss-gen-ai-and-atlanta-innovation-hub
16. [S16] AIG, Delivering for Our Clients When They Need Us Most: https://www.aig.com/home/intelligence team/stories/delivering-for-our-clients-when-they-need-us-most
17. [S17] GLEIF, American International Group, Inc. LEI record: https://api.gleif.org/api/v1/lei-records/ODVCVCQG2BP6VHV36M30
18. [S18] Wikimedia Commons, AIG Headquarters photograph: https://commons.wikimedia.org/wiki/File:AIG_Headquarters.jpg

Image credit: "AIG Headquarters" by Marc Bryan-Brown, photographed at 175 Water Street in New York in 2016, CC BY-SA 4.0, via Wikimedia Commons, with permission recorded through Wikimedia VRT. The photograph provides historical corporate architecture context only and does not establish AIG's current headquarters, technology, AI deployment, security, staffing, production reliability or customer outcome.