Who is in control?
You are, and it is worth being precise about where.
Regulators increasingly distinguish between three oversight models, and naming which one applies to which process is more useful than claiming oversight in general.
| Process | Oversight model |
|---|---|
| Underwriting and claims decisions | Human-in-the-loop. Decision authority stays with your people. Agents assemble the case, validate it against your rules and recommend |
| Standard servicing inside codified rules, for example an endorsement validated against the product | Human-on-the-loop. Agents execute, your team supervises at portfolio level, exceptions escalate |
| Notifications, reconciliation, document generation, internal routing | Human-on-the-loop with sampled review |
No customer-facing decision of consequence runs without a human gate. Confidence thresholds route borderline and sensitive actions to a person before they have any real-world effect, with the case assembled and the reasoning attached so the decision takes one step rather than a reconstruction.
What is in place on every agent
A declared role and scoped permissions. Each agent has a defined purpose, a specific set of capabilities and explicit permissions over named systems. It cannot act outside them.
A named human owner. Usually the underwriter or claims lead accountable for that part of the book. Accountability sits with a person, not with a platform.
Certification before production. An agent passes certification before it touches live data or live customers. Sherpa+Mesh holds the registry of what has been certified and what each agent may do.
Validation against live rules. Agents check every action against your current product configuration, pricing logic and underwriting guidelines. This is what lets you demonstrate the rule that was in force at the time, rather than the procedure that was written last quarter.
A manual fallback. Every automated process has a documented manual route and an accountable team through the transition.
What can an auditor actually see?
The practical test a supervisor applies: produce every agent decision taken on a given day, with the rule that drove each one. Complete, not a sample.
Each action is logged with its inputs, the rule that triggered it, the decision taken, the confidence level and the outcome, queryable for any period. That has to satisfy three audiences at once.
The business needs performance, exceptions and processes running outside tolerance.
Compliance needs evidence that codified rules were applied consistently, so customers in the same position were treated the same way.
Internal audit needs a trail nobody can edit after the fact, traceable from a single customer outcome back to the rule, the agent and the human who owns it.
Governance added after agents are live cannot reach back over the decisions they have already made. That is why it sits in the design.
Who holds the licence, and who chooses the partner?
Insurance is a licensed business, and every regulated function inside a Gangkhar programme is performed by a licensed party. We design the operating model around that from day one, and we bring a partner ecosystem to draw on.
You choose the partner. Gangkhar is partner-agnostic. If you already work with a third-party administrator, a broker or a loss adjuster you trust, we operate alongside them and they keep the regulated relationship they already hold. If you would rather we brought options, our ecosystem spans claims and TPA groups, brokers, licensed intermediaries and systems integrators across the markets we work in, and you pick from a shortlist.
That flexibility is what lets one operating model work across many markets. Licensing regimes differ jurisdiction by jurisdiction. Because the technology layer and the regulated layer are contracted separately, you extend the same platform into a new market by adding the right local licensed party rather than rebuilding the programme.
Three structures cover almost every case:
You run the agents under your own licence. We license the platform as technology. The simplest arrangement, and the common one where a carrier or broker already holds everything it needs.
A licensed counterparty inside a financial free zone, where the regulatory perimeter allows the whole programme to sit there.
Parallel contracts. You hold one with the licensed party for the regulated work and one with Gangkhar for the technology, with a scope-limited platform-access agreement between us.
Where a programme includes regulated administration, the licensed party contracts for it directly. That keeps the perimeter clean and gives your supervisor a single, obvious line of accountability.
One useful consequence: we are always on your side of the table. Gangkhar provides the technology and operates as a data processor, so we have no interest in displacing your TPA, your broker or your adjuster. Your supervisor sees accountability sitting exactly where it expects to find it. Your existing partners see a platform that makes their work faster and their contracts more profitable, which is usually why they become advocates for the programme rather than obstacles to it.
How this maps to emerging AI regulation
Insurance supervisors are now writing AI rules directly. The Central Bank of the UAE is a useful example, because it moved early and because Federal Decree-Law No. (6) of 2025 brought insurance business inside its perimeter.¹ In February 2026 the CBUAE issued guidance on the responsible adoption of artificial intelligence and machine learning by licensed financial institutions, which applies to insurance providers, setting principles on "governance and accountability, fairness and non-discrimination, transparency and explainability, effective human oversight, as well as requirements relating to data management and privacy".²
| Principle | How it is addressed |
|---|---|
| Governance and accountability | Declared roles, scoped permissions, a named human owner, certification before production |
| Fairness and non-discrimination | Decisions run against your codified rules, applied consistently to every policy in the same position |
| Transparency and explainability | Each decision shows the rule that triggered it and any overriding exception, legible line by line |
| Effective human oversight | Confidence thresholds route sensitive actions to a person before any effect; decision authority stays with you |
| Data management and privacy | In-region deployment answers residency expectations. Where the AI runs, not only where the company is registered |
That guidance also addresses outsourcing and third-party risk, which is the assessment this model is built for: scoped permissions per agent, a complete audit trail available to you and your supervisors, defined service levels, and a clear statement of which party performs any regulated function.
Frequently asked questions
Who is accountable when an agent makes a mistake?
The named human owner of that agent, normally the underwriter or claims lead responsible for that part of the book. Ownership is recorded alongside every action.
Who holds the licence on a Gangkhar programme?
A licensed party, chosen with you. Gangkhar provides the technology layer and operates as a data processor, and we work with whichever licensed partner you prefer, including one you already use. Where you do not have one in a given market, we bring options from our partner ecosystem.
Can we audit you?
Yes. Audit rights, evidence access and reporting cadence are set in the contract, and the three-tier governance model gives your teams standing forums rather than an annual request.
Where is our data held?
Deployment can be located in-region, which is what residency rules require. We confirm the specific arrangement for your jurisdiction during scoping.
Which AI model do you use?
Sherpa+Mesh is model-agnostic. The governance layer, the audit trail and the product validation sit above the choice of underlying model, so a model change does not change your control environment.
Will this satisfy our board and our internal audit function?
That is the design intent, and it is why we recommend involving both in scoping rather than at go-live. Send us your vendor assessment or security questionnaire and we will complete it.
¹ Federal Decree-Law No. (6) of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business, CBUAE Rulebook.
² Central Bank of the UAE, guidance note on the consumer protection and responsible adoption and use of artificial intelligence and machine learning by licensed financial institutions, announced 23 February 2026.
Most conversations with a new client start with a questionnaire. Send yours and we will complete it, then walk your compliance and audit teams through the agent registry and the licensing structure for your jurisdiction.