AI Claims Readiness Assessment For APAC Insurance
Executive Summary
On Wednesday we argued that a published figure without a stated population, comparison basis and window does not belong in a business case.
Today we publish a score. A score is a number, and it is subject to the same rule.
So the AI Claims Readiness Assessment appears below in full - ten questions, their weights, the five scoring levels, the band boundaries, and the sensitivity of the composite to every individual answer. Nothing about the instrument is gated. What is gated is the tailored roadmap consultation that a high score earns; the measuring device itself is ungated, because a score whose weights you cannot inspect is a score you cannot defend to a board.
Three findings shape the instrument.
One. Bank Negara Malaysia's supervisory survey of 120 financial service providers found that 77% of insurance and takaful operators had adopted at least one AI application in 2024, up from 58% a year earlier - while claims review and processing accounted for under 1% of all AI projects across respondents. Adoption in APAC insurance is real. Adoption in claims is, on the only regulator-collected evidence available, close to a rounding error.
Two. The Bank of Japan surveyed 153 financial institutions with a 100% response rate: over 90% were using, trialling or considering generative AI, and around half told their own central bank there was "room for improvement" or the matter was "under consideration" on monitoring of usage, third-party risk and review of practical rules. Adoption and control maturity have decoupled, and the institutions concerned say so themselves.
Three. On 6 August 2026 the Japan FSA published its annual Insurance Monitoring Report, documenting insurers expanding the scope of automated benefit payment on the back of AI document processing. It attaches no expectation of human review to that expansion. Nor does any binding instrument we could locate in Japan, Singapore, Hong Kong, Malaysia or Indonesia. The automation is being supervised. The human checkpoint is not being required.
Introduction
Every consultancy in this market will sell you a maturity score. Very few will show you the arithmetic.
That is not a rhetorical complaint. It is a documented condition of the field. A systematic review of 64 digital-maturity-model publications between 2011 and 2022 found that only nine claimed empirical evidence of a positive link between maturity and performance - and six of those nine were authored by consultancies rather than produced under academic scrutiny. The authors describe the field as suffering from "poor theoretical basis and lack of empirical evidence", and note "the absence of objective evaluation criteria of these models".
A live specimen sits in the public record. A major consultancy has published the finding that APAC insurers' average AI maturity score is 2.9 out of 5. There is no disclosed sample, no fieldwork window, and no stated method anywhere in that publication. It is a five-point scale with an average on it and nothing underneath. The same publication reports that 87% of surveyed companies either capture less than 5% operating-profit uplift from AI or do not track value capture at all - which, taken at face value, means most organizations scoring themselves on AI maturity cannot establish whether the maturity paid for itself.
We are about to publish a scored instrument into that environment. The only honest way to do it is to publish the instrument.
Industry Context
Two things changed in APAC insurance this year, and they point in opposite directions.
The first is that supervisors have converged on proportionality as the governing principle for AI. MAS's consultation on Guidelines on AI Risk Management, issued 13 November 2025 and closed 31 January 2026, proposes that firms apply lifecycle controls - including human oversight - "based on their relevance and be proportionate to the assessed risk materiality of AI usage", supported by risk-materiality assessments covering impact, complexity and reliance. Bank Negara Malaysia's discussion paper uses near-identical language: controls "proportionate to the complexity, potential risks, and intended use" of the models.
Read that carefully, because it is the executive insight of the week. Under a proportionality regime, the firm's own self-assessment determines the firm's own control obligations. The quality of your internal scoring is no longer a marketing exercise or a procurement artefact. It is a supervisory variable. A self-assessment that flatters you now produces a control set that under-protects you.
The second change is that the measured picture and the reported picture of AI adoption have pulled apart far enough to be a governance problem in their own right. The Australian Bureau of Statistics, surveying roughly 7,000 businesses with fieldwork from October 2025 to February 2026, found 12% of Australian businesses used AI, rising to 35% of large businesses. Eurostat's 2025 enterprise survey found 20.0% of EU enterprises with 10 or more employees, up from 13.5% in 2024. Against that, a widely-cited consultancy panel of 1,993 self-selected respondents reports 88% regular AI use in at least one business function.
The naive contrast - 12% against 88% - overstates the case, and we will not use it that way. The fair comparison is large businesses at 35% against a large-enterprise-weighted panel at 88%, on a lower bar for the official statistic ("used AI") than for the panel ("regular use"). That is still a gap of more than two and a half times, between a probability sample and a self-selected one, measuring the same phenomenon.
Current Challenges
The claims function is the least-automated part of an aggressively-automating industry. Bank Negara Malaysia's Exhibit 2 puts claims review and processing at under 1% of AI project counts among 120 supervised firms. That is a project count rather than a claims-volume measure - the distinction matters and we state it - but it is the closest quantification of AI-in-claims that any APAC regulator has published, and it is not close to the market narrative.
The controls are self-reported as incomplete by the firms themselves. The Bank of Japan's census is unusually clean evidence: 153 institutions, 100% response, roughly half using generative AI and over 90% engaged with it, and roughly half reporting gaps in monitoring, third-party risk and rule review. The gap is not hidden. It is disclosed and unclosed.
Nobody is required to keep a human in the claims decision. Japan's FSA describes human review as something "many organizations set up" - a description of practice, not a requirement. BNM observes that near-term AI is designed to "augment rather than replace human decision-making" - again, an observation. MAS's human-oversight control is proportionate to risk materiality, is not claims-specific, is not final, and carries a proposed 12-month transition after issuance. As at 11 August 2026, we could locate no instrument in any APAC jurisdiction granting a claimant a right to human review of an automated claims decision.
And the instrument most firms will use to assess themselves is the wrong shape. A ten-question self-assessment completed by one executive is a single-source, single-method, self-report measure - the exact design that the measurement literature identifies as inflating apparent relationships. The canonical review reports that roughly 26% of the variance in a typical research measure is attributable to systematic measurement error, and that where common-method variance is present, variance accounted for runs at about 35% against about 11% where it is absent.
We are publishing a ten-question self-assessment. We are also publishing that paragraph. Both are necessary.
Key Trends
1. Proportionality is transferring measurement risk to the firm. Every APAC guidance instrument reviewed for this piece anchors control intensity to a self-conducted materiality assessment.
2. Supervisors are documenting automation without gating it. The FSA's 6 August report describes AI-OCR reducing data entry and expanding the automated scope of benefit payment, alongside generative AI in call centers - described, monitored, not conditioned.
3. Governance ownership is being organized before adoption data exists. Hong Kong's Insurance Authority reported on 15 June 2026 that its AI Cohort had reached ten core participants since August 2025, with insurers "showing stronger ownership and governance". No adoption statistics accompanied it.
4. Surge is the untested condition. August's catastrophe cluster is a reminder that claims processes are specified at steady state and judged at peak - and that a regulator's first instruction in a disaster is usually to relax controls, not tighten them.
5. Scoring is outrunning validation. Maturity instruments are proliferating faster than evidence that maturity predicts anything.
Strategic Analysis: the single-answer swing
Here is the construct this article contributes, and the reason the instrument is publishable.
Single-answer swing (n.) - the number of index points a composite readiness score moves when exactly one answer changes, expressed as a share of the instrument's full range. It is a sensitivity property. It answers the only question that matters about a composite: which answer is doing the work?
It is deliberately a different kind of property from the constructs this series has already introduced. Contest coverage is completeness. Disclosure floor is a binary admissibility test. Evidentiary distance is ordinal. Reversibility horizon is a decision property. Retained capacity is persistence. Integration tail is dispersion. Single-answer swing is sensitivity - it describes how a number behaves, not what it counts.
For the instrument below, the swings are as follows. Two of the ten questions carry a weight of 14 and therefore a maximum single-answer swing of 14 points on a 100-point scale. Between them, two answers out of ten control 28% of the score. The median question swings 10. The bands are 20 points wide, so a single answer on either heavy question moves you 70% of a band on its own - enough to cross a boundary without any change in the other nine.
That is not a defect we are conceding. It is a design choice we are declaring, and it is the reason the two heavy questions are the two that matter: what the automated path does under surge, and whether an AI-influenced claims outcome has a named human owner and a documented challenge route.
**Now the three things the score cannot tell you. **
It cannot tell you whether AI is earning money. The instrument measures the readiness of a process, not P&L. Given that most organizations scoring their AI maturity cannot establish value capture at all, a readiness score that implied financial return would be inventing a link the evidence does not support.
It is a single-source self-report and carries that design's biases. Scored by one executive, in one sitting, on questions whose socially-desirable answers are obvious. The correction is structural, not motivational: the instrument requires a number with a denominator for six of the ten questions. You cannot score question five without stating what proportion of AI-influenced outcomes have a named owner, out of what population.
It cannot be compared across firms. There is no validated APAC claims-readiness benchmark, because no APAC regulator, statistics agency or consultancy publishes measured AI adoption in claims handling with a stated method. The instrument is a within-firm, over-time measure. Anyone offering you a peer percentile against it is selling you an artefact.
The counter-argument, at full strength. Publishing the weights lets a competitor engineer a high score; and a score anyone can self-produce is a score no buyer values. Both are true of the number. Neither is true of the instrument. Gaming it requires answering the questions; answering the questions requires the denominators; producing the denominators is the readiness. And a score whose arithmetic a board cannot reproduce has no standing in the room where it will be quoted.
The instrument, in full
AI Claims Readiness Assessment · 10 questions · 100 points · four domains. Score each question at one of five levels - 0 (absent), 1 (ad hoc), 2 (defined), 3 (measured), 4 (managed) - and multiply by the weight shown, divided by four.
Bands. 0-39 Not ready. 40-59 Partial. 60-79 Operating. 80-100 Contestable.
Six questions require a number with a denominator - 2, 5, 6, 7, 8 and 9. A level-3 or level-4 score on any of them is not available without one. That constraint, not the total, is the instrument.
Real-World Examples
Malaysia - the adoption headline and the claims reality. BNM's 2024 survey of 120 financial service providers: 77% of insurance and takaful operators had deployed at least one AI application, against 58% the year before; over 60% of banks and ITOs rated AI a strategic priority for the next one to three years; claims review and processing sat under 1% of AI projects. A firm scoring itself Operating on claims readiness while its regulator's own census shows claims is where the industry has done least should expect that discrepancy to be noticed.
Japan - automation described, checkpoint absent. The FSA's 2026 Insurance Monitoring Report, published 6 August, records insurers using AI-OCR on claims documentation to cut data entry and to expand the scope of automated benefit payment, and records that firms are building risk frameworks "including outsourced vendors that use AI". Question 7 of the instrument exists because of that clause. Question 5 exists because of what the report does not contain.
Japan again - the cleanest control-gap evidence in the region. The Bank of Japan's 153-institution census, 100% response: over 90% engaged with generative AI, about half reporting improvement needed on monitoring, third-party risk and rule review. The population is bank-dominated and insurers are not separately identified - we state that rather than borrowing the number for insurance.
Hong Kong - governance first, measurement later. Ten core participants in the IA's AI Cohort since August 2025, with reported gains in ownership and use-case discipline, and no published adoption metric. That is a defensible sequencing. It is also the condition in which an unvalidated score does the most damage.
Actionable Recommendations
1. Score questions 3 and 5 first, alone, before anything else. They carry 28 points between them. If you cannot answer either with a number and a denominator, your composite is uninterpretable and you can stop there this week.
2. Run question 3 as an observation, not an estimate. Take last year's worst 72 hours of claim volume and replay it. A modelled surge answer scores level 2, not level 4, on this instrument by design.
3. Publish your own weights internally before you circulate the score. Any executive who sees the total before the arithmetic will anchor on the total.
4. Give question 6 a 90th-percentile figure, not a median. Human-review latency is a tail property; the median describes the claims nobody complains about.
5. Put questions 5, 6 and 9 on the board pack as standing lines. Question 10 scores what the board already sees, and it is the cheapest question on the instrument to move.
6. Re-score at a fixed interval and compare only to yourself. Quarterly, same scorer, same definitions. Any peer comparison is unsupported.
7. Treat your materiality assessment as the regulated artefact it is becoming. Under proportionality, that document determines your control obligations. Write it to be read by a supervisor, not by a steering committee.
sourceCode Perspective
We build claims systems, so we have an obvious interest in you scoring badly. That is precisely why the weights are published and the instrument is ungated: an assessment sold as a diagnostic by the firm that also sells the remedy is worth exactly as much as its transparency.
Two admissions belong here. The instrument is not validated. It has face validity from engagements and from the regulatory evidence cited above, and no more than that - we have not demonstrated that a higher score predicts a better claims outcome, and on the published record, neither has anyone else for any comparable instrument. And its weights are a judgement. Fourteen points on surge behavior and fourteen on contest coverage reflect our view that those two properties fail hardest and latest. Argue with the weights; that argument is more useful to you than the total.
What we will stand behind is narrower and firmer: the six denominators. An insurer that can state, with populations attached, its contest coverage, its human-review latency at the tail, its third-party AI inventory, its recertification cycle and its retained manual capacity is an insurer that can answer a supervisor. That set is worth having whether or not you ever compute the score.
Conclusion
August has given APAC insurers a live demonstration of the difference between a process that is fast and a process that holds. A typhoon does not care about your average handling time. A regulator's first move in a disaster is to relax the controls you optimized for, and the claims that follow arrive together, incomplete, and contested.
Readiness for that is measurable. It is measurable badly by a number with no arithmetic behind it, and measurably better by ten questions, six denominators and a declared sensitivity. We have published all three.
Fourteen points of your score depend on one answer. You should know which one, and so should your board.
Take the AI Claims Readiness Assessment. Ten scored questions, the weights above, a scored report emailed within one business day, and - new this week - your single-answer swing table, showing exactly which answers are carrying your composite. Scores of 60 and above are offered a 45-minute tailored roadmap consultation with sourceCode's AI and Insurance lead: your score, your two heaviest questions, and the shortest credible path to moving them.
FAQ
What is an AI claims readiness assessment? A scored self-assessment of whether an insurance claims process can retain traceability, contestability and throughput when automated decisions are made at volume. sourceCode's instrument uses ten questions across four domains - data, workflow, governance and change - weighted to 100 points, with bands at 40, 60 and 80.
What is a single-answer swing? The number of index points a composite score moves when exactly one answer changes, expressed as a share of the instrument's full range. In this instrument the maximum single-answer swing is 14 points on a 100-point scale, and two questions carry it.
Does any APAC regulator require a human to review an automated insurance claims decision? As at 11 August 2026, no. Japan's FSA describes human review as common practice without requiring it; Bank Negara Malaysia observes that AI is designed to augment rather than replace human decision-making; MAS's proposed human-oversight control is proportionate to risk materiality, is not claims-specific, and is not yet in force. No claims-specific right to human review was located in Japan, Singapore, Hong Kong, Malaysia or Indonesia.
How much AI is actually deployed in APAC insurance claims? On the only regulator-collected evidence available, very little. Bank Negara Malaysia's 2024 survey of 120 financial service providers found 77% of insurance and takaful operators had adopted at least one AI application, while claims review and processing accounted for under 1% of AI projects.
Are AI maturity scores reliable? Generally, no - not as published. A systematic review of 64 digital maturity model publications found only nine claiming empirical evidence of a maturity-performance link, six of those nine authored by consultancies. Treat any maturity score without published weights, sample and method as unusable for a board decision.
Can I compare my score to other insurers? No. There is no validated APAC claims-readiness benchmark, because no APAC regulator, statistics agency or consultancy publishes measured AI adoption in claims handling with a stated method. The instrument is a within-firm, over-time measure only.
Why publish the weights if it lets people game the score? Because gaming it requires answering the questions, answering the questions requires stating six denominators, and producing those denominators is the readiness. A score whose arithmetic a board cannot reproduce has no standing anyway.
What does the score not tell me? Three things: whether AI is earning money; anything free of single-source self-report bias; and anything comparable to another firm. All three are stated in the article rather than in a footnote.
Why was this article reframed? An APAC catastrophe cluster between 8 and 11 August 2026 - Typhoon Dolphin and enhanced Philippine monsoon flooding - made a claims-efficiency maturity scorecard the wrong instrument for the moment. The slot, tier and pillar are unchanged; the framing moved from speed to behavior under surge and contestability. The reframe is logged at the top of the article.
References
Bank Negara Malaysia (2025) Discussion Paper on Artificial Intelligence in the Malaysian Financial Sector. Kuala Lumpur: BNM, 5 August 2025. Available at: https://www.bnm.gov.my/documents/20124/3891366/Discussion+Paper+on+Artificial+Intelligence+in+the+Malaysian+Financial+Sector.pdf (Accessed: 21 August 2026).
Eurostat (2025) Use of artificial intelligence in enterprises. Luxembourg: Eurostat, 11 December 2025. Available at: https://ec.europa.eu/eurostat/statistics-explained/index.php/Artificial_intelligence_-_statistics (Accessed: 21 August 2026).
Hong Kong Insurance Authority (2026) 'IA AI Cohort Symposium' [press release]. Hong Kong: IA, 15 June 2026. Available at: https://www.ia.org.hk/en/infocenter/press_releases/20260615.html (Accessed: 21 August 2026).
McKinsey & Company (2025) The State of AI 2025. McKinsey & Company. Available at: https://www.mckinsey.com/capabilities/quantumblack/our-insights/the-state-of-ai (Accessed: 21 August 2026).
Podsakoff, P.M., MacKenzie, S.B., Lee, J.-Y. and Podsakoff, N.P. (2003) 'Common method biases in behavioral research: a critical review of the literature and recommended remedies', Journal of Applied Psychology, 88(5), pp. 879–903. Available at: https://doi.org/10.1037/0021-9010.88.5.879 (Accessed: 21 August 2026).