This whitepaper is for organizational leaders who have been through the AI conversation and now need to figure out how to actually do it. It is based on AI implementation work at Canada Life and on the EU AI Act readiness assessment I led for my team, and it draws on the pattern I have seen across multiple organizations trying to move from AI interest to AI delivery.
Canadian insurance is at an interesting moment with AI. The interest is high. The governance frameworks are underdeveloped. The talent is available but distributed. The regulatory expectations are still forming. Organizations that build genuine AI readiness now will have a significant advantage when the regulatory framework firms up and the market pressure to deploy AI at scale increases.
AI readiness is not the same as AI awareness. Most Canadian insurance organizations are AI-aware. They have read the articles, attended the conferences, and formed an AI steering committee or a centre of excellence. AI awareness is the starting point, not the destination.
AI readiness means having the organizational capacity to deploy AI responsibly and sustainably. It has four components that need to be assessed independently, because organizations that are strong in one are often weak in another.
Data readiness. AI systems are only as good as the data they are trained and operated on. An organization's AI readiness is heavily constrained by the quality, consistency, and accessibility of its data. The MDM governance work that builds data quality is also AI preparation, even when it is not framed that way.
Governance readiness. The policies, accountability structures, and oversight mechanisms that ensure AI is deployed responsibly. This includes model documentation requirements, bias testing, human oversight mechanisms, incident response procedures, and regulatory compliance processes. Most Canadian insurance organizations have partial governance readiness: they have some of these elements in place, but not a complete and integrated framework.
People readiness. The skills, roles, and ways of working that allow the organization to develop, deploy, and maintain AI systems. This is broader than a data science team. It includes business leaders who can identify where AI creates value, BAs who can translate business requirements into AI specifications, and operational staff who can work effectively with AI-assisted decision making.
Process readiness. The operational processes that AI systems will interact with, modified to work effectively with AI outputs. This includes the quality assurance processes that validate AI outputs, the escalation paths for AI-assisted decisions that need human review, and the feedback mechanisms that capture when AI outputs were incorrect and feed that information back into model improvement.
Canadian insurance organizations typically have decades of data. The challenge is not data volume. It is data quality, data consistency, and data accessibility.
Data quality in Canadian insurance systems reflects the history of how data was collected. Paper forms transcribed by hand. Systems that allowed free-text entry in fields that should have been coded. Multiple systems that collected the same data element differently. Migration projects that mapped old formats to new ones imperfectly. The result is that the data that exists is often not the data that an AI system can use reliably.
Data consistency is the MDM problem described in the MDM article in this series. When the same client exists as multiple records in multiple systems with different information in each, the AI system trained on that data learns the inconsistency. The output of the AI system reflects the quality of the input, including its inconsistencies.
Data accessibility is a governance and architecture question. AI systems need data that can be accessed programmatically, in formats that the AI framework can consume, with appropriate permissions that allow the AI team to work with it without exposing sensitive information improperly. Many Canadian insurance organizations have data that exists but cannot be easily accessed in ways that support AI development.
Assessing data readiness means being honest about all three of these dimensions. Organizations that overestimate their data readiness start AI programs with false optimism, discover the data quality problems when the model training begins, and then spend the first phase of the AI program doing data remediation they did not plan or budget for.
The EU AI Act provides the most comprehensive published framework for AI governance currently available. Even for Canadian organizations without EU regulatory exposure, it is the most useful template for building AI governance because it is specific, because it is risk-based, and because it requires the documentation and oversight practices that responsible AI deployment requires regardless of jurisdiction.
The high-risk AI system requirements under the EU AI Act include: a risk management system for the AI system throughout its lifecycle, data governance practices for training data, technical documentation sufficient to assess compliance, logging and record-keeping of the system's operations, transparency to users about the system's limitations, human oversight mechanisms, accuracy and robustness standards, and cybersecurity requirements.
Most Canadian insurance organizations assessed against these requirements would find significant gaps. Not because they are irresponsible, but because the requirements are more comprehensive than the informal governance that most organizations have developed organically.
The EU AI Act requirements are the right target for AI governance in Canadian insurance, independent of whether the legal obligation applies. An AI system that meets those requirements is a responsibly governed AI system. That is worth building toward regardless of jurisdiction.
Building governance readiness requires starting with a governance policy before deploying AI, not after. The governance policy needs to cover: which types of AI use cases require what level of governance oversight, what documentation is required before an AI system goes into production, what the process is for monitoring AI system performance after deployment, and what the escalation path is when an AI system produces outputs that are incorrect or harmful.
The people readiness gap in Canadian insurance is not primarily a data science talent gap. Data scientists are available and can be hired. The harder gaps are in the roles that sit between data science and the business.
The AI product manager role, the person who can identify where AI creates business value, define the requirements for an AI system in terms that both data scientists and business stakeholders understand, and manage the delivery of an AI system from concept through deployment and monitoring, is genuinely scarce. Most organizations are trying to fill this role with either a business analyst who has learned some AI vocabulary or a data scientist who has learned some business vocabulary. Neither is a substitute for someone who has both.
The business analyst AI skills gap is one that organizations can address through structured development. A BA who understands the business domain and the requirements process can develop AI literacy to the point where they can contribute effectively to AI programs. What they need is exposure to how AI systems work at a conceptual level, practice translating business problems into AI problem formulations, and experience working in AI delivery teams.
At Canada Life, I invested in developing AI literacy within the BA team deliberately. We ran internal sessions on how the AI systems we were using actually worked, what their limitations were, and how to write requirements for AI-assisted processes that accounted for those limitations. That development was not a formal training program. It was structured learning in the context of actual delivery work, which was more effective than classroom training would have been.
AI systems produce outputs that need to be consumed by operational processes. Those processes need to be designed for AI outputs, not retrofitted to accommodate them.
The key process design question for any AI-assisted operation is: what happens when the AI output is wrong? This question has to be answered before the AI system goes live, not after. The answer determines the human oversight mechanism, the escalation path, and the feedback loop that captures incorrect outputs and uses them to improve the model.
In the QA program at Canada Life, the process design question was answered explicitly before the AI went live: when the AI flags a record as potentially defective, a human QA analyst reviews the flag and makes the final determination. The AI does not make final determinations. It makes recommendations that humans act on. That process design kept human judgment in the loop for every decision that had a significant risk of error, which is the right design for AI-assisted processes in regulated environments.
Process readiness also includes the feedback mechanism. AI models need feedback about when their outputs were incorrect in order to improve over time. That feedback has to be captured systematically, not anecdotally. The operational process needs a mechanism for recording when the AI output was wrong, what the correct output was, and what pattern that instance represents. Building that mechanism into the process design from the start is significantly easier than adding it after the AI system is already operating.
An AI readiness assessment should cover all four dimensions with honest scoring on each. The goal is not to produce a high readiness score. The goal is to identify the specific gaps that need to be addressed before AI deployment and to sequence the gap closure work in a practical order.
Data readiness assessment: inventory the key data sets that would be used to train or operate the AI systems under consideration. For each, assess quality (what percentage of records are complete and accurate), consistency (does the same data element exist in multiple systems with consistent values), and accessibility (can the data be accessed in formats the AI framework requires with appropriate permissions).
Governance readiness assessment: map the organization's current AI governance practices against the EU AI Act high-risk system requirements. Note the gaps explicitly. Prioritize the gaps that represent the highest risk of harmful AI output or regulatory non-compliance.
People readiness assessment: identify the roles required for AI delivery and operation and assess whether those roles are filled with people who have the required skills. Note where skills development or hiring is needed. Note where the gaps in AI product management and BA AI literacy are most significant.
Process readiness assessment: for each AI use case under consideration, design the end-to-end process that would consume the AI output, including the human oversight mechanism, the escalation path for incorrect outputs, and the feedback capture mechanism. Assess whether the operational teams have the capacity and the capability to operate those processes.
Canadian insurance organizations that build genuine AI readiness now are making an investment in organizational capability that will pay back when AI deployment at scale becomes both possible and necessary. The organizations that wait for the technology to mature without building the governance, data, people, and process foundations will find that the technology has outrun their capacity to use it responsibly.