AI Cyber Readiness Mandate Issued

India's insurance regulator, IRDAI, has issued a directive requiring insurers to submit a report on their AI cyber readiness by May 22, 2026. This move, responding to growing AI-driven cyber threats, exposes a significant problem: the widespread use of legacy IT systems. Insurers must now evaluate how their cybersecurity measures stack up against advanced AI systems, revealing that current systems are often not sufficient. The regulation pushes the industry to address the operational and financial costs linked to its outdated technology.

Assessing AI Threats and Legacy System Weaknesses

IRDAI's AI Cyber Mandate

The regulator's call for a report by May 22, 2026, highlights a vulnerability across the insurance sector. IRDAI has specifically pointed out the increasing risks from advanced AI-powered cyber threats, which are more complex and harder to detect than traditional attacks. Insurers must outline their defenses, detection, and response plans, assessing their exposure. This aligns with government concerns, as Finance Minister Nirmala Sitharaman has warned that AI could amplify cyber risks and disrupt markets. Recent cyber incidents at Star Health and Allied Insurance and HDFC Life Insurance in 2024-2025 further emphasize these ongoing challenges.

Legacy Systems: A Major Hurdle

The core problem is the reliance on outdated legacy IT systems. These systems consume about 41% of an insurer's IT budget just for maintenance. They slow down new product launches, lead to an estimated $15.5 million in annual customer churn due to poor user experience, and lack the flexibility needed for today's digital world. Integrating advanced technologies like AI into these rigid systems is difficult and expensive, often needing extra software or major overhauls. IRDAI's focus on AI readiness forces insurers to face these fundamental weaknesses, as legacy systems are poorly equipped for fast, sophisticated AI-driven attacks.

Cybersecurity Norms and Industry Context

India's BFSI sector, including insurance, faces high cyberattack risks, with over 1.5 million incidents reported in 2023. The average cost of a data breach in India is about ₹19.5 crore. IRDAI has been strengthening its cybersecurity rules, with existing guidelines (updated in 2025/2026) requiring strong security, including reporting incidents within six hours and retaining logs for 180 days. This new directive intensifies these efforts, pushing insurers to address AI-specific threats and keep up with global standards like those from the EU. Some insurers are now asking about AI usage on cyber insurance applications, signaling a change in how risks are evaluated.

Challenges and Potential Risks

Compliance Burden and Market Impact

Although IRDAI's directive addresses a real concern, it creates a major compliance burden for an industry already dealing with high operational costs and outdated technology. Insurers with legacy systems will need significant spending to upgrade for AI readiness and meet current cybersecurity rules. This could split the market between well-funded, tech-savvy firms and smaller players struggling to adapt, potentially threatening their survival. Focusing on AI readiness might also divert attention from other immediate risks posed by legacy systems. The NIFTY Insurance index average P/E is about 20.66, but valuations vary greatly. SBI Life trades at a P/E of 75.57, suggesting high growth expectations, while LIC's P/E is around 8.7-10.9, showing a more value focus. These different valuations reflect varied investor confidence in companies' ability to manage these issues.

Operational and Management Challenges

Many insurers use legacy systems without modern security, encryption, or real-time tracking, leaving them vulnerable to breaches and making compliance difficult. The directive's tight deadline of May 22, 2026, raises questions about whether companies can complete thorough assessments and fixes in time. Management will face a severe test in rapidly upgrading systems and adding AI defenses to old architectures. Failing to comply, or doing so superficially, risks regulatory fines and reputational harm, especially as IRDAI increases its scrutiny and has fined companies like Star Health previously.

Future Outlook and Modernization

Analysts expect India's insurance sector to continue growing, with revenues projected to increase about 22% annually for the next three years, well above the industry average. This growth depends heavily on the sector upgrading its technology. IRDAI's push for AI cyber readiness, though difficult, is likely to speed up investments in cybersecurity and IT modernization. Companies that successfully upgrade their legacy systems and adopt advanced AI defenses will be better prepared to meet regulations, reduce risks, and seize future opportunities. However, those that fall behind could face growing operational, financial, and reputational challenges in a more digitized and risky environment.