If you spent most of last year feeling like you were being pulled in two different directions, let me just say: get used to it. All the signs are pointing to 2026 being even more of a scramble.
It’s a classic squeeze play. On one side, you have the relentless pressure to innovate, move faster, and get smarter with technology. On the other, you’ve got this massive wave of regulatory, economic, and geopolitical pressure telling you to tighten the hatches, double-check everything, and cut costs.
As my colleague Paige Waters often says, risk and compliance teams are no longer just the "no" department. They're expected to be strategic partners, helping the business grow and innovate while somehow keeping everyone out of trouble. It's a heck of a balancing act.
So, let's grab a coffee and talk about the big rocks you’ll need to navigate in the year ahead.
The AI Revolution is Here, and Regulators are Watching
Remember when AI was just a cool pilot project? Well, that ship has sailed. By mid-2025, AI moved right into the core of our operations. We've shifted from clunky annual pricing to dynamic, real-time risk selection, with AI making or assisting with decisions at a massive scale.
This is fantastic for efficiency and accuracy, but it’s also opened up a whole new can of worms that regulators are just starting to pry open.
Here’s what’s on their minds:
- Is your model going rogue? An underwriting model is only as good as the data it was trained on. But the world changes. What happens when your AI starts making bizarre decisions because its view of the world is outdated? This "model drift" is a huge exposure, and you have to prove you’re monitoring it constantly.
- Is it fair? This is the big one. Regulators, consumer advocates, and plaintiff’s attorneys are scrutinizing every AI-driven decision for bias. They want to make sure our shiny new algorithms aren't just high-tech redlining. Explainability isn't a buzzword anymore; it's a requirement.
- Who’s actually in charge here? As we hand over more authority to AI, boards and senior leaders can't just throw their hands up and say, "The algorithm did it!" Regulators expect them to show active, hands-on oversight of the models, the data they use, and the results they produce.
And woven through all of this is cyber risk. Regulators now see cyber resilience as fundamental to an insurer's financial stability. The message is clear: You need to embed cyber risk into everything, from your enterprise risk management to your capital planning.
The tension is obvious, right? Digital transformation demands speed. Good governance demands discipline. The insurers who figure out how to do both at the same time are the ones who are going to win.
The Party’s Over for “Outsourcing the Risk”
For years, we’ve relied on a massive network of third-party vendors for everything from data and models to pharmacy benefits and claims administration. And for a long time, the attitude was, "We hired a reputable firm, it's their problem."
Well, those days are officially over. Regulators now view your vendors as a direct extension of your own company's risk profile. The defense that "we outsourced it" will get you laughed out of the room.
The National Association of Insurance Commissioners (NAIC) got serious about this in 2025, and they're doubling down in 2026.
The PBM Spotlight
Pharmacy Benefit Managers (PBMs) are under an especially bright microscope. The NAIC isn't just "studying" them anymore; they're actively building a whole new regulatory framework. They’ve even set up two different working groups to tackle it from all angles, looking at everything from licensing and the drug supply chain to creating new examination protocols for the Market Regulation Handbook. For any health and life insurers using PBMs, this means your contracts, rebate deals, and oversight processes are about to get a lot more scrutiny.
It’s Not Just PBMs
The focus extends to any third party that touches a core insurance function. The NAIC has working groups zeroed in on:
- Third-Party Data and Models: They're creating rules to oversee how we use outside data, analytics, and predictive models, making sure we're complying with consumer protection laws.
- Annuity Suitability: New guidance makes it clear that insurers have to actively monitor their partners (like broker-dealers) to ensure they’re complying with suitability rules. You are on the hook for their behavior.
- Third-Party Administrators (TPAs): The work continues to standardize licensing and oversight for the contractors who support our core functions.
The bottom line is this: You need to start treating your vendor governance with the same seriousness as your capital management. It has to be structured, based on evidence, and constantly updated.
Brace for Impact: Markets, Money, and Global Mayhem
If you were hoping for calm seas in 2026, I’ve got bad news. The volatility we saw in interest rates and markets in 2025 isn't going away, and it’s hitting us from all sides.
We’re seeing it impact our solvency and hedging strategies, and it’s even changing how our policyholders behave—spurring lapses and surrenders we didn't plan for.
Even reinsurance is getting a closer look. Using offshore or alternative reinsurance for capital relief is facing tougher questions from regulators. They want to know if the risk transfer is real and substantive, and they're looking hard at counterparty risk.
But it’s bigger than just market swings. We’re now expected to manage risk that goes far beyond traditional underwriting. Think "geopolitical, economic, and societal uncertainty."
For example, catastrophic losses remained painfully high in 2025, with insured nat-cat losses hitting around $107 billion, partly driven by events like the California Palisades Fire. This keeps the pressure on P&C insurers’ pricing, reinsurance costs, and aggregate limits.
Meanwhile, Medicare Advantage insurers are grappling with a tough reality where premiums just aren't keeping up with rising medical costs. This is forcing a complete rethink of product design and network strategies, all while federal scrutiny gets more intense.
It's not all bad news. For life insurers, attractive spreads on long-duration assets are helping profitability. But those legacy guarantees from old variable annuities and long-term care policies can still be a ticking time bomb depending on when they were priced.
Where Did All the Experts Go?
On top of everything else, we have a serious people problem. We're facing a massive talent and expertise shortfall.
Projections show hundreds of thousands of positions are being vacated by retirees, especially in those highly technical, judgment-heavy roles like underwriting and claims. And frankly, we’re not doing a great job of attracting younger talent to fill the gap. Let’s be honest, insurance still has an image problem—it’s seen as a bit boring and slow-moving compared to other areas of finance.
So, What's the Game Plan for 2026?
When you look at all these themes together, a few clear priorities emerge for the year ahead. This isn't just about survival; it's about setting yourself up to thrive in this new, chaotic environment.
- Stop Treating Risk Like an Afterthought. Your risk and compliance folks need a seat at the table from day one. They should be involved in product design, distribution strategy, and AI deployment—not just called in to clean up a mess after the fact.
- Get Serious About Governance. Whether it’s your PBMs or your AI vendors, your oversight can't be a check-the-box exercise. Regulators expect structured, data-driven monitoring with crystal-clear documentation. It’s time to industrialize your governance processes.
- Invest in Your People (and Their Tools). The future of this industry belongs to people who can speak both "risk" and "tech" fluently. These professionals are rare, but they are absolutely essential. Find them, train them, and give them the tools they need to succeed.
- Design for the Storm. Stop waiting for things to "get back to normal." Volatility is the new normal. The winners will be those who build flexibility directly into their pricing, capital, and product architecture from the start.
Look, 2025 was a massive stress test for the entire industry. In 2026, the real question isn't whether the challenges will keep coming. They will. The question is: can your risk and compliance capabilities keep pace with your growth and innovation?
