When AI Moves Faster Than Regulation

ByOz Berkovitz

Founder & Owner · Oz Berkovitz Law Office

Consider a hypothetical claim in which an insurer uses AI to summarise medical records. A summary omits a qualification in a specialist’s report, and that omission influences the assessment of a claim. The dispute will not necessarily turn on whether a dedicated AI rule prohibited that particular tool. It may turn on the information available, the care taken to verify it, the policy wording and the reasons for the decision. Regulatory uncertainty offers little practical comfort when the underlying decision cannot be explained.

Existing legal duties in Israel

Israel’s December 2023 AI policy favoured regulation adapted to individual sectors and risks, while recognising the continuing role of contract, tort, consumer protection and privacy law. Businesses should read that policy framework alongside the legal duties already applicable to their activities. The starting point is therefore the activity in question: advising a customer, handling a claim, assessing a risk or processing personal information. The label attached to the software does not answer the legal question. [1]

Privacy illustrates the distinction between evolving guidance and existing duties. Amendment 13 to Israel’s Protection of Privacy Law took effect on 14 August 2025, expanding enforcement powers and introducing significant changes to organisational obligations. The Privacy Protection Authority’s April 2025 AI document was published as a consultation draft, setting out its proposed approach to applying privacy law to AI systems. Its status is distinct from the binding duties imposed by legislation. A business must assess the law already applicable to its information processing while monitoring the development of AI-specific guidance. [2] [3]

The European regulatory timetable

The European position also requires attention to legislative status. The AI Omnibus entered into force on 27 July 2026. The revised timetable places the principal Annex III high-risk obligations at 2 December 2027 and the relevant regulated-product high-risk obligations at 2 August 2028. Article 50 transparency requirements began applying on 2 August 2026, subject to a specific transition for certain existing systems. These are distinct milestones. A postponement affecting one category should not be treated as a suspension of the whole regime. [4] [5]

Define authorised uses and contractual safeguards

In my view, an organisation should begin by identifying the decisions affected by AI. For each use, identify the information involved, the consequences of error and the person authorised to accept the output. A tool that drafts an internal note warrants a different review process from one influencing a coverage decision or a communication to an insured. Approval should attach to a defined use, with clear limits, rather than to a product name.

Supplier contracts deserve the same precision. What may the provider do with uploaded information? Can it retain inputs or use them for training? Who receives notice of a material model change or security incident? Can the customer obtain the records needed to investigate an error? An indemnity has limited practical value if its trigger is unclear, its cap is inadequate or the evidence required to invoke it is inaccessible.

Preserve evidence and effective human review

Evidence should be designed into the process before a dispute arises. For material decisions, consider preserving the relevant source material, system version, output, reviewer corrections and reasons for the final decision. Retention must remain proportionate and consistent with privacy obligations. The aim is a record that distinguishes what the system suggested from what the organisation ultimately decided, without creating an uncontrolled archive of sensitive data.

Effective human review requires access to the underlying documents, sufficient time and authority to reject the result. Recording an approval does not, by itself, establish that a meaningful review took place. Organisations should test how their process responds to an apparently persuasive but incorrect output, and establish when repeated errors require a system to be restricted or withdrawn.

Implications for insurers

For insurers, this analysis has two dimensions: their own use of AI and the exposures assumed from insured businesses. Coverage review should examine the actual allegation and loss against the relevant policy terms, including exclusions, notification provisions and contractual assumptions of liability. It should not begin with an assumption that every AI-related loss belongs under cyber cover.

As regulation develops, businesses should define authorised AI uses, allocate responsibility and preserve the reasons for decisions with material consequences. These measures support compliance, effective investigation and a reasoned response if a decision is challenged.

Law and sources reviewed as at 24 October 2026. General commentary only; the applicable law, facts and policy wording must be considered in each matter.