Engineering · 7 min read
Insurance Software Development: Core Systems, Buy vs Build, ACORD and Regulation
Insurance software development guide: policy, billing, claims and rating systems, Guidewire vs custom, ACORD data, NAIC Model 668 rules and AI limits.
Zain Khalid MalikCTO & Co-founder, Innovation Insight·Published 
Short answer
Insurance software is five connected systems: policy administration, billing, claims, rating and distribution portals. Carriers writing many lines usually license a core suite such as Guidewire, Duck Creek or Socotra and build around it; MGAs and insurtechs with a narrow product often build. Plan for effective-dated data, ACORD vocabulary and the NAIC Insurance Data Security Model Law. Innovation Insight scopes builds in a $3k to $8k discovery; regulated platforms run $80k to $200k+.
What insurance software actually covers
When someone says "we need insurance software" they usually mean one slice of a chain. A policy is quoted, rated, bound, issued, billed, endorsed, renewed and sometimes claimed against, and each step tends to live in a different system. Knowing which slice you are replacing is the first decision, because the integration work between slices is often larger than the slice itself.
| System | What it does | Typical data it owns | Usual choice |
|---|---|---|---|
| Policy administration (PAS) | Product definition, quote, bind, issue, endorsements, renewals, cancellations | Policies, coverages, forms, effective-dated versions | License for multi-line carriers; build for one narrow product |
| Rating engine | Calculates premium from rating factors and filed rate tables | Rate tables by state and effective date, factor rules | Often inside the PAS; sometimes a separate service |
| Billing | Invoices, instalment plans, payments, commissions, reinstatement and cancellation for non-payment | Accounts, schedules, receivables, agency commission | Licensed or built beside a payment provider |
| Claims | First notice of loss (FNOL), triage, reserves, adjuster workflow, payments, recoveries | Claims, exposures, reserves, payments, documents | Licensed core or custom intake and workflow around it |
| Distribution portals | Agent, broker and customer self-service: quotes, documents, payments, claim status | Users, roles, submissions, saved quotes | Usually custom; this is where carriers differentiate |
| Documents and correspondence | Declarations pages, certificates, notices, letters | Templates, generated PDFs, delivery records | Template service plus a PDF engine |
For the two slices people most often ask us about, see our pages on claims management software development and policy administration system development. The insurance industry hub lists everything we build for carriers, MGAs and brokers.
Buy, build or extend
The large core vendors exist because policy, billing and claims are hard to get right across many states, lines and years. A regional carrier writing personal auto, homeowners and commercial package in twenty states should not write its own policy engine. An MGA launching one pet or cyber product in three states often should, or should use a configurable API-first core and build everything around it.
| Vendor | Scope (from the vendors' own product pages) | How it is priced | Fits |
|---|---|---|---|
| Guidewire | InsuranceSuite: PolicyCenter, BillingCenter, ClaimCenter for P&C, on Guidewire Cloud | Quote-based; its 10-K says core products are generally priced on direct written premium (DWP) managed | Mid-size and large P&C carriers |
| Duck Creek | P&C policy, billing, claims, rating and distribution, delivered as SaaS | Quote-based | P&C carriers and MGAs wanting a full suite |
| Majesco | P&C and life and annuity core suites | Quote-based | Carriers that need both P&C and L&A |
| Socotra | API-first cloud core where products are configured as code | Quote-based | Insurtechs and MGAs with engineering teams |
| EIS | Cloud core suite for P&C, life and group benefits | Quote-based | Carriers replacing several cores at once |
| Custom build | Exactly the product, workflow and portals you need | Our regulated platforms: $80k to $200k+ | One or two narrow products, or a portal and workflow layer around a core |
None of these vendors publishes a list price, and anyone quoting you a precise licence figure without your premium volume is guessing. Guidewire's annual report states that it generally prices core subscriptions on the amount of direct written premium the platform manages (Guidewire Form 10-K, FY2026, checked October 2026). The licence is also only part of the bill: implementation partners, data migration and the internal team usually match or exceed it in the first years.
The middle path is the most common one we see recommended: keep the licensed or legacy core as the system of record and build the parts customers and agents touch. An agent portal, a claims intake app, a document extraction service or a broker submission inbox can ship in months and connect to the core through its API. Our API development and integration team does most of its insurance-shaped work at exactly this seam.
Engineering rules that differ from ordinary SaaS
- Everything is effective-dated. A policy has many versions, each valid from one date to another, and an endorsement may be backdated. Model this from day one (most teams end up with bitemporal tables: valid time and record time) or reporting and audit break later.
- Rates are filed. In most US states the rate tables and rules you use must match what was filed with the regulator, by state and effective date. Store rate tables as versioned data with the filing reference, never as constants in code.
- Money needs a ledger. Premium, instalments, commission, refunds and claim payments should post to an append-only ledger so that every balance can be rebuilt. Our Stripe webhooks guide covers the idempotency patterns that keep payments from posting twice.
- Documents are legal records. A declarations page must be reproducible exactly as issued years later, so store the generated PDF and the data snapshot behind it.
- Roles are many. Underwriters, adjusters, agents, agency principals, customers, auditors and reinsurers need different views; see our RBAC and audit logging guide.
Data standards: ACORD
ACORD is the insurance industry's standards body. Its property and casualty standards come in two main formats: AL3, a batch format used for policy and commission downloads between carriers and agency management systems, and XML for real-time request and response messages; life, annuity and health use an XML standard built on ACORD's Life Data Model (ACORD P&C data standards, checked October 2026). ACORD notes that AL3 use is governed by a licence agreement, so budget for membership if you need it. ACORD forms, such as certificates of insurance, are also licensed.
Even if you never exchange an ACORD message, borrow its vocabulary for your domain model: coverage, limit, deductible, line of business, insured, producer. It makes later integrations with carriers, agency management systems and data vendors much cheaper, because the mapping is mostly one to one.
Regulation you will be asked about
| Rule | Who it applies to | What it means for the software |
|---|---|---|
| NAIC Insurance Data Security Model Law (#668) | Insurance licensees in adopting states: 28 jurisdictions adopted as of the NAIC map dated 8 October 2026 | Written security programme based on a risk assessment, MFA, encryption in transit and on portable devices, audit trails, oversight of third-party service providers, notice to the commissioner within 72 hours of determining a cybersecurity event |
| New York 23 NYCRR 500 | Entities regulated by the New York DFS (shown separately on the NAIC map) | A stricter cybersecurity regulation with its own certification and notice rules |
| NAIC Model Bulletin on AI Systems (2023) | Insurers in adopting states using AI in regulated decisions | A written AI programme, governance and testing for unfair discrimination; covers vendor-built models |
| GDPR and UK GDPR | Anyone processing EU or UK policyholders' data | Lawful basis, data subject rights, records of processing, transfer safeguards |
| SOC 2 (AICPA) | Not a law; carriers ask vendors for a report | Evidence that access control, change management and monitoring work over time |
Two details in Model 668 matter to anyone building for insurers. First, the licensee must exercise due diligence on third-party service providers and require them to protect the data, so a software vendor will be assessed. Second, licensees with fewer than ten employees, including independent contractors, are exempt from the information security programme section, which is why a three-person agency and a carrier get very different questionnaires (NAIC Model 668 text; adoption map, checked October 2026). State versions differ in detail, so check the state you are licensed in.
Where AI helps and where it should not decide
| Use case | Works well when | Keep a human in the loop because |
|---|---|---|
| Claims document extraction (invoices, estimates, police reports) | Fields are named and documents are mostly typed | Extraction errors flow straight into reserves and payments |
| FNOL intake from email, web form or phone transcript | The output is a draft claim an adjuster reviews | Coverage questions need the policy wording |
| Broker submission triage | Submissions arrive as emails with ACORD forms and loss runs | Appetite and pricing are underwriting decisions |
| Fraud and leakage signals | The model flags, people investigate | A flag is not evidence; unfair discrimination rules apply |
| Customer service answers | Answers cite the policy document and stop at coverage decisions | Wrong answers about coverage create liability |
The NAIC bulletin on AI (NAIC AI topic page, checked October 2026) expects insurers to govern AI that makes or supports regulated decisions, whether built in-house or bought. In practice that means storing the model, prompt and input behind every AI suggestion and never letting the suggestion overwrite the human decision record. Our AI document processing page and the intelligent document processing guide go deeper on extraction accuracy.
Our relevant work (adjacent, not insurance)
We have no published insurance case study yet. The closest first-hand work is in the same technical patterns:
- Edge OCR: multi-tenant document extraction on AWS Lambda and AWS Bedrock with a dead-letter queue for failed documents and a screen where non-technical users correct extracted values. The same shape as claims document intake.
- GovDoc AI: a RAG pipeline that extracts 50+ data points per government contract with page-level references for every value, which is what an underwriter or adjuster needs to trust an extraction.
- AI body camera operations platform: every incident gets an AI review with provider, model, prompt and temperature recorded, stored beside the officer's record and never overwriting it. That is the audit pattern the NAIC AI bulletin points towards.
- Paint Nite: a platform rebuilt beside a live legacy system with dedicated sync services, the approach most insurers need for core replacement. See our insurance legacy modernization guide.
Cost and next steps
A discovery that maps your systems, data and regulatory scope costs $3k to $8k. An AI intake or extraction MVP typically lands at $25k to $60k, a regulated platform such as a policy or claims system at $80k to $200k+, and a legacy assessment at $5k to $15k. The detail is in our claims management software cost and policy administration system cost posts, and our day rates are on the pricing page.
Need a number for your project?
Send a short brief and get a written estimate.
A senior engineer replies within one business day. No sales call required.
Zain Khalid Malik
CTO & Co-founder, Innovation Insight
Zain owns architecture, engineering standards and the platform team at Innovation Insight. He sets the bar for code quality, security and the tooling every squad ships with.
LinkedInRelated questions.
Should an MGA build its own policy administration system?
Often yes, if it writes one or two narrow products and has, or hires, an engineering team. A focused custom PAS with rating, documents and a broker portal sits in our regulated platform range of $80k to $200k+. MGAs writing many lines across many states usually do better on a configurable core such as Socotra or Duck Creek.
Do we need to use ACORD standards?
Only where your partners require them, for example AL3 downloads to agency management systems. But modelling your data with ACORD terms costs little and makes every later integration cheaper.
Does the NAIC data security law apply to software vendors?
It applies to licensees, not vendors directly. But licensees must oversee their third-party service providers, so vendors are assessed through questionnaires, contracts and often a request for a SOC 2 report.
Can AI make claims or underwriting decisions?
It can support them. Regulators expect insurers to govern any AI that makes or supports regulated decisions, so the safe pattern is AI that drafts or flags, with a person deciding and a stored record of the model, prompt and inputs.
How long does an insurance software project take?
A portal or intake MVP takes three to five months. A custom policy or claims platform for a narrow product takes six to twelve months. Replacing a multi-line core with a licensed suite is commonly a multi-year programme.