In December 2025, a class action lawsuit was filed against Google alleging that Gmail's AI features violated California privacy law. The plaintiffs claimed that hidden settings allowed user content to train Gemini models without meaningful consent. Google's spokesperson responded that "We do not use your Gmail content to train our Gemini AI model." The lawsuit is ongoing.
The insurance industry is watching cases like this closely. When your claims adjusters use Gemini to summarize policyholder medical records, when your underwriters paste financial documentation into AI tools to speed up analysis, the question of where that data goes and how it's used becomes a compliance issue, not just a privacy preference.
Google positions Gemini as enterprise-ready with strong privacy protections. But the distinction between consumer Gemini and Gemini for Workspace matters enormously for insurance. And even with the right tier, gaps remain between what Google offers and what insurance regulators increasingly demand.
The short version: If you need to redact sensitive documents before they reach AI systems, PaperVeil handles that layer. The rest of this article explains where it fits in the broader governance architecture.
What "Safe" Actually Means for Insurance
Safety in insurance isn't a checkbox. It's a spectrum defined by the specific data you're processing and the regulatory frameworks that govern it.
Insurance companies handle multiple categories of sensitive data, each with its own risk profile:
Policyholder PII includes names, Social Security numbers, dates of birth, addresses, and contact information. This is the baseline of sensitive data that every insurer touches.
Health information appears throughout life insurance, health insurance, and disability claims. Much of this data falls under HIPAA protections, which require Business Associate Agreements with any third party that handles it.
Financial records include bank account details, credit histories, income documentation, and payment information. This data creates exposure under state financial privacy laws and creates fraud risk if leaked.
Claims data combines all of the above with detailed descriptions of incidents, medical treatments, property damage, and legal proceedings. A single claims file can contain enough information to devastate a policyholder if exposed.
Underwriting data includes risk assessments, actuarial analyses, and pricing decisions that may reveal health conditions, lifestyle factors, or other sensitive attributes.
For an AI tool to be "safe" for insurance, it needs to handle all of these data types without creating regulatory violations, breach risks, or competitive exposure.
Insurance Data Risks in the AI Era
The traditional threat model for insurance data focused on external attackers and insider theft. AI tools add new vectors that existing security controls weren't designed to handle.
The Shadow AI Problem
When your claims adjuster pastes policyholder medical records into consumer Gemini to speed up a summary, that data leaves your controlled environment. It travels to Google's servers. It gets processed by systems you don't control. And depending on the account type and settings, it might be reviewed by humans or used for model improvement.
Free and consumer versions of Google Gemini are not covered by Business Associate Agreements. They should never be used with any insurance data that contains protected health information or other policyholder identifiers.
The Configuration Problem
Google's enterprise Gemini offerings have strong security properties, but those properties don't activate automatically. Administrators must accept Google's BAA through the Admin Console. Projects handling protected health information must explicitly enable the HIPAA project flag. Data retention policies must be configured according to your compliance requirements.
The gap between "we have Gemini for Workspace" and "we have Gemini configured for insurance compliance" is significant.
The Patchwork Regulation Problem
Insurance is regulated state by state in the United States. Colorado's Artificial Intelligence Act prohibits the use of AI that results in unfair discrimination in insurance, with implementing regulations that now cover life, auto, and health insurance. Other states are considering similar legislation.
The NAIC Model Bulletin on AI, adopted in some form by 23 states and Washington D.C. by late 2025, requires insurers to maintain governance frameworks for AI systems. Compliance isn't just about data security; it's about demonstrating that your AI usage doesn't create discriminatory outcomes.
Gemini's Security Model for Insurance
Google offers different tiers with dramatically different security characteristics.
Consumer Tiers (Free Gemini, Gemini Advanced)
Consumer Gemini operates under Google's consumer terms. Conversations may be reviewed by humans and used for model improvement. There is no Business Associate Agreement available. For insurance purposes, consumer Gemini cannot safely process any data containing policyholder PII, health information, or claims details.
The consumer-enterprise distinction matters more than most organizations realize. A free Google account accessing Gemini through the web interface is not the same as Gemini for Workspace, even if they look similar to end users.
Gemini for Google Workspace
When Google Workspace commercial customers adopt Gemini, they get the same data protection and security standards that come with Workspace, with specific protections for enterprise customers:
Enterprise data is not used for model training outside your domain without permission. Your interactions with Gemini stay within your organization. Prompts and responses are not saved beyond the user session by default.
As of September 30, 2025, Gemini in Workspace is covered under Google's Business Associate Addendum, which means it can support HIPAA-covered workloads when properly configured.
Google has introduced centralized retention policies in the Admin Console. Administrators can configure automatic data retention windows of 30, 90, or 180 days, with 180 days as the default. For sensitive workflows, Temporary Chat Mode stores data for only 72 hours.
Vertex AI and Cloud Deployments
For organizations with technical resources to build custom integrations, Google Cloud offers Vertex AI with zero data retention options. This provides the most control over data handling but requires building applications rather than using chat interfaces.
Certifications and Compliance Coverage
Gemini's compliance coverage expanded significantly in 2025:
- ISO 27001/27017/27018 for information security and cloud controls
- ISO 27701 for Privacy Information Management
- ISO 42001 for AI management and governance (achieved May 2025)
- HITRUST certification
- PCI-DSS v4.0 certification
- FedRAMP High authorization
These certifications provide a foundation for compliance, but certifications alone don't make your specific deployment compliant.
Where Gemini Falls Short for Insurance
Even with enterprise tiers and BAA coverage, gaps remain between what Gemini offers and what insurance industry requirements demand.
The NAIC Model Bulletin Requirements
The National Association of Insurance Commissioners adopted its Model Bulletin on the Use of Artificial Intelligence Systems by Insurers in December 2023. By late 2025, 23 states and Washington D.C. had adopted some version of it, and the NAIC began piloting AI examination tools.
The bulletin requires insurers to maintain a written AI System Program covering:
- Purpose, scope, and structure of AI systems in decision-making
- Governance framework with stakeholders from actuarial, data science, underwriting, compliance, and legal
- Risk assessments for consumer impact
- Documentation of how AI influences underwriting, rating, pricing, claims, and fraud detection
Gemini, as a general-purpose AI tool, doesn't come with insurance-specific governance documentation. You'll need to build that framework yourself, which means significant compliance work before deployment.
The Bias and Discrimination Risk
State regulators are increasingly focused on AI bias in insurance. Colorado's expanded AI regulations now cover life, auto, and health insurance with requirements for governance and testing procedures to prevent unfair discrimination.
If Gemini influences underwriting decisions, pricing, or claims outcomes, you need to demonstrate that those influences don't create discriminatory results. Google doesn't provide the actuarial documentation or bias testing that regulators increasingly demand.
The Audit Trail Gap
Insurance regulators expect documentation of how decisions were made. When an AI tool influences a claim denial or a pricing decision, you need to show what went in and what came out.
Gemini for Workspace provides admin analytics, but the level of detail may not match what insurance examiners expect. Building comprehensive audit trails requires additional infrastructure on your side.
The NAIC's AI Systems Evaluation Tool, expected to pilot in early 2026, includes questionnaires and checklists aimed at standardizing assessments of insurers' AI governance and risk management. Your audit capabilities need to support these examinations.
Making Gemini Safe for Insurance Workflows
The path to safe Gemini usage in insurance follows a familiar pattern: understand your data, control its flow, and document everything.
Step 1: Classify Your Data
Before Gemini touches insurance data, classify it:
Tier 1 (Never Consumer Gemini): Health records, full claims files, underwriting decisions with PII, policyholder financial records. These should never reach consumer AI tools under any circumstances.
Tier 2 (Requires De-identification): Claims summaries, policy questions, general insurance scenarios. Can be processed by Gemini if all identifying information is stripped first.
Tier 3 (Lower Risk): Industry research, regulatory guidance, general insurance concepts with no policyholder data. Can be processed with appropriate enterprise agreements in place.
Step 2: Implement Pre-Processing Redaction
For Tier 2 data, implement a redaction layer that strips identifying information before Gemini processing:
- Named Entity Recognition for names, organizations, and locations
- Pattern matching for SSNs, policy numbers, claim numbers, and account numbers
- Date detection and generalization
- Address and phone number removal
The redacted content goes to Gemini. The AI generates its response based on de-identified data. You re-associate identifiers internally if needed. Gemini never sees the PHI or PII.
Step 3: Deploy Enterprise Infrastructure
For approved use cases:
- Implement Gemini for Workspace with Business Associate Agreement for any health-related data
- Configure data retention policies appropriate to your compliance requirements
- Enable audit logging and integrate with your compliance documentation systems
- Establish access controls limiting who can send what categories of data
- Ensure HIPAA project flags are enabled for PHI-handling workflows
Step 4: Build the Governance Framework
The NAIC Model Bulletin expects a formal AI governance program. Document:
- Which AI systems are approved for which use cases
- Who has authority to approve new AI applications
- How you assess bias and fairness in AI-influenced decisions
- What audit trails exist for AI-assisted decisions
- How you respond to regulatory inquiries about AI usage
Step 5: Block the Alternatives
Shadow AI is your biggest risk. Your governance framework only works if employees actually use it. Implement:
- Network-level blocking of consumer Gemini interfaces
- Endpoint controls preventing AI access through personal accounts
- Clear policies with consequences for policy violations
- Make the compliant workflow easier than the workaround
Step 6: Train Your Staff
Insurance employees need to understand:
- What policyholder data looks like (it's not always obvious)
- Why consumer AI tools create compliance risk
- How to use the approved redaction workflow
- What to do if they accidentally expose data
The organizations that suffer AI-related data breaches aren't employing malicious actors. They have well-meaning employees who didn't understand the risks. Training closes that gap.
The Bottom Line
Is Gemini safe for insurance? Consumer Gemini (free tier, Gemini Advanced) is definitively not safe for any insurance data containing policyholder information, health records, or claims details. The lack of BAA coverage and the potential for data to be used for training make it inappropriate for insurance use.
Gemini for Google Workspace with BAA coverage can support insurance workflows when properly configured with appropriate retention settings, HIPAA project flags enabled, and integration with your AI governance framework.
The practical path forward:
- Assume shadow AI is happening in your organization
- Classify data and establish clear tiers for AI processing
- Implement redaction for sensitive data before AI processing
- Deploy Gemini for Workspace with proper BAA and configuration
- Build the governance documentation NAIC requirements demand
- Block consumer alternatives and train staff on approved workflows
- Monitor continuously and update as regulations evolve
The insurance industry is under increasing regulatory scrutiny for AI usage. The NAIC is piloting AI examination tools in 2026. States are passing new AI oversight legislation. The time to get AI governance right is before regulators come asking questions, not after.
PaperVeil lets you redact sensitive information from documents before they touch any AI system. Detect and remove policyholder PII, health information, and claims data automatically. Generate the audit trails that insurance compliance requires. The redaction layer that makes AI document processing actually safe for insurance.