AI guardrails and conversational innovation in insurance sector: Insights by Ganessan Soundiram, CTO, ICICI Prudential

AI is increasingly finding practical applications across the life insurance value chain, from customer service and renewals to onboarding, underwriting, risk management and sales support. At the same time, insurers have to navigate challenges around scale, data privacy, governance, security and legacy technology.

In this exclusive interview, Ganessan Soundiram, Chief Technology Officer, ICICI Life Insurance, discusses the adoption of AI in life insurance, the challenges of deploying it across complex processes, the importance of guardrails and human oversight, and why conversational interfaces could become an important way for customers, agents and employees to interact with insurance systems.

AI is everywhere, but where is it delivering the biggest business impact for life insurance today?
Though, AI has been around for several years, significant adoption and its impact on business is seen now. Conversational interfaces such as chatbots and WhatsApp bots provide a 24×7 digital channel handling wide range of customer queries. We are also seeing significant adoption in renewal outreach, onboarding, underwriting, risk and fraud management. In onboarding, we process around 55% to 60% of cases through complete digital KYC process and for the remaining requirements, we leverage vision AI and LLM-assisted OCR.

In underwriting, AI supports video-based medical assessments and helps summarising customers’ profile. Machine-learning models and AI-driven solutions also help identify and flag potential risks during onboarding. AI supports sales teams by providing product information, recommendations and answers to process-related queries through conversational interfaces. Agents and employees in operations or underwriting can use these interfaces to access relevant product and process information quickly. For example, some of our bots have resolved upward of 50,000 agent/ employee queries since their launch in May 2025.

We are also seeing significant adoption across technology functions, including development, testing and IT operations. GenAI-assisted coding, testing and IT operations help generating approximately 15% to 20% of IT cost savings.

What has been the toughest technology challenge in modernising life insurance?
One of the toughest technology challenges in modernising life insurance is deploying AI across processes that involve numerous and constantly changing variables.

For instance, a call centre may handle over 300 types of service requests. Training an AI solution to understand the nuances of every process and interacting with customers appropriately across a wide range of scenarios can be complex.

AI is generally more effective when deployed for a specific, clearly defined, and high-volume use case, such as customer outreach with predetermined objection-handling scenarios. Therefore, the suitability of an AI deployment depends on its volume, scope, intent and degree of variability.

When a use case involves a limited number of clearly defined considerations, AI can deliver significant value. However, when it involves a broad and constantly changing range of considerations, AI may be more difficult to deploy effectively and may not deliver the expected results.

When you are adopting AI, how are you balancing innovation with trust and regulatory compliance?
Our AI solutions operate within the defined guardrails and do not go beyond the company’s authorised data and systems. However, when an LLM is used as the primary interface, we need to implement additional guardrails to ensure that it does not access, disclose or generate information beyond the company’s approved data boundaries.

For standardised and template-based use cases, where the expected output is clearly defined, AI can be adopted more easily. However, for ad hoc or judgement-based use cases, we follow a human-in-the-loop approach. In such cases, AI may help frame a response, summarise information or provide recommendations, but the final decision is made by an authorised individual.

For example, in AI and machine-learning-driven risk-management models, we have a regular model-governance process. We review the assumptions, actual outcomes and expected behaviour of the models at a pre-defined frequency to ensure that they continue to operate within the defined boundaries and continue to support business outcomes as intended.

AI-led implementations must also have appropriate logging, monitoring and auditing mechanisms. These controls help us balance innovation with trust, accountability and regulatory compliance.

How are you addressing data privacy and customer trust while using AI?
Data security is an extremely important area for us. As a life insurer, we work with hundreds of distributors and hence protecting customer and business data is critical. Security is of paramount importance across all our systems, processes and integrations including AI implementations.

From a data privacy perspective, we follow the applicable regulatory requirements relating to data protection, incident reporting, and the transfer and movement of data. Therefore, the fundamental security and privacy principles that apply to our general technology integrations also apply to our AI solutions. For AI implementations, we additionally ensure that appropriate controls and governance mechanisms are in place.

Customer consent and transparency are equally important. Customers should have clear visibility into what data is being collected, how it is being collected and the purpose for which it will be used.

Customers should also have appropriate choices regarding how and when they are contacted. We follow the applicable data-protection requirements for consent, purpose limitation and customer communication.

These measures help us protect customer data and maintain trust while adopting AI across the organisation.

Is there any particular strategy that you have in place as per the DPDP Act or the policy that is in place?
The DPDP Act clearly sets out requirements regarding the purpose for which personal data is collected and used. It also allows customers to review how their data is being used and withdraw their consent when required.

Another important consideration is data lifecycle management. Once the purpose for which the data was collected has been fulfilled, or the servicing of the relevant policy or contract has been completed, we follow the applicable data-retention and deletion policies. However, certain information may need to be retained with customers consent to meet legal, regulatory or contractual requirements.

From a security perspective, we follow a defence-in-depth approach, with multiple layers of security controls. Data is encrypted both at rest and in transit. This helps reduce the risk of unauthorised access, interception or misuse of data.

If you had to bet on one technology that would redefine the life insurance sector over the next few years, what would it be and why?
This is something we have also been thinking through, particularly in terms of where to place our bets and how our technology architecture should evolve. In my view, conversational interfaces are a major trend, and we need to ensure that our overall architecture supports this shift.

Today, the way people access information or request services from an organisation is changing. Earlier, we largely followed an interface-driven approach, where users navigated through applications, dashboards, reports or search engines. Now, there is a significant shift towards getting things done through conversational interfaces. For example, if I wanted information earlier, I would generally search for it on Google. Today, I can simply ask a question and get a direct response.

I see a similar trend within organisations. Whether someone wants to query a dataset, generate insights or understand what is happening across the organisation, the interaction is becoming more conversational. Earlier, a user might have requested a dashboard, a report or a specific analysis. Each of these requirements would have involved a separate development and rollout process. Now, a user can simply ask, “What are the outliers in a particular region or channel?” What was earlier predetermined and developed over time can now become a simple query on the available dataset.

Conversational interfaces can also be particularly helpful for sales teams. For example, a new salesperson could say, “I am new to the organisation, and my customer has this requirement. What should I do?” The interface could suggest three or four actions, provide links to relevant information and recommend what could be proposed to the customer.

Similarly, before meeting a customer, a salesperson could ask how best to approach the conversation. Based on the available and authorised customer data, the interface could provide relevant product information or suggest an engagement plan. We are therefore seeing a shift towards speaking to or typing into an interface and getting the required information in a simple and easily accessible manner.

However, to make conversational interfaces the primary engagement layer for customers, sales teams, operations teams and underwriters, we need a strong supporting infrastructure. This could include an agentic layer, the Model Context Protocol (MCP), APIs and retrieval-augmented generation.

What this means is that when a user asks a question, the large language model first understands the intent of the conversation. It then identifies the organisational capabilities required to address that need, connects securely to the relevant systems through APIs and retrieves the necessary information.

Therefore, the architecture must support both the conversational interface and the backend capabilities, including AI agents, MCP and Retrieval-Augmented Generation (RAG). We are investing our time, effort and resources in building these capabilities.

Finally, is there anything that you would like to address to your peers from the industry, maybe a concluding remark or something?
We do meet regularly through CIO and CTO forums, and we also engage with industry bodies. One of the areas we continue to look at is the limitations and restrictions of the core administration or policy administration systems currently used across the industry in India. There are many active efforts being made to modernise these core platforms. This is an important area that I would leave for the product players specialising in these systems to consider and think through.