Can an insurance agency sell its data to AI companies?

Possibly. As of October 2026, eight providers name insurance, half of them for claims or underwriting files. Policyholders’ personal information falls under state insurance privacy rules built on the Gramm-Leach-Bliley Act, and carrier agreements can limit reuse; check both first.

What does an insurance agency keep that AI buyers ask for?

The working record of placing and servicing coverage: which markets were approached, what they quoted, what the agency recommended and what the client chose, then every change and claim. Most of it sits in the agency management system (Applied Epic, AMS360, HawkSoft or EZLynx, among others); the rest is in email and carrier portals.

Record	What it shows	Where it usually lives
Quotes and rater results	Which carriers quoted, at what premium and terms	Comparative rater, agency management system
Submissions and underwriter email	How the account was presented and what underwriters asked	Email, attachments in the management system
Proposals	Options offered, coverages accepted or declined	Document storage, the management system
Binders, policies and endorsements	What was bound and every midterm change	The management system, carrier downloads
Certificates of insurance	Who required proof of coverage, and on what terms	The management system
Service activities	Each request, who handled it and how long it took	Activity notes in the management system
Claims correspondence	First notice of loss and follow-up with adjusters	Email, the management system
Renewal and expiration lists	Retention, remarketing and lost accounts	The management system

Providers mostly name the carrier side of this. Mercor lists Finance & Insurance records as “Statements, underwriting files, claims”, and Miro Advisory’s insurance workflow is “Claim through investigation and resolution” (both as of October 2026). An agency holds its side of those files, plus the quoting and service record that is its own work.

What does one commercial renewal leave behind?

Records of judgment, mixed with other people’s restricted information. For example, the renewal of a hypothetical 25-truck contractor’s commercial auto policy at a 15-person agency:

1. Pre-renewal, 120 days out. The account manager pulls the expiring policy and loss runs and asks the client for current driver and vehicle lists. Leaves: activity notes, client email, a driver list with license numbers.
2. Marketing. The producer submits to four carriers; two quote, one declines, one asks about a driver’s violations. Leaves: submissions, quotes, a declination, underwriter email, motor vehicle reports.
3. Proposal. The agency recommends higher liability limits; the client takes one quote and declines an umbrella. Leaves: a proposal and a signed acceptance with the declined coverage noted.
4. Binding and service. Binder, policy and invoice, then certificates for the client’s general contractors and a midyear endorsement adding a truck. Leaves: a policy record, certificates, an endorsement.
5. A claim. A driver backs into a parked car; the agency reports it and follows up with the adjuster. Leaves: a first notice of loss and claim correspondence.

The judgment is in steps 2 and 3. The restricted material is in steps 1, 2 and 5: driver details, motor vehicle reports and anything about injuries.

Which buyers say they want insurance data?

As of October 2026, eight providers name insurance on their own pages. Four do not pay you themselves: Avelence, Miro Advisory and Sell My Business Data are introducers, and FileYield is a listing marketplace where buyers and sellers deal directly.

Provider	Type	What its pages say
Avelence	Introducer	“Financial services and insurance” among business types in its profile form
FileYield	Listing marketplace	“insurance claims” among examples in its Financial category (source)
Mercor	Licenses directly	Finance & Insurance among eight industries, with underwriting files and claims (source)
Miro Advisory	Introducer	Insurance among highlighted industries, and claims among industry systems (source)
Scale AI	Licenses directly	“Insurance Brokerage” among its industries
Sell My Business Data	Introducer	Insurance among ten target industries (source)
Telegraph Lab (affiliated)	Licenses directly	“Finance & insurance” among activities in its intake form
Troveo	Licensing agent	Insurance and claims among business types in its assessment

Only Scale AI names brokerage, the agency side of the business. None names an agency management system such as Applied Epic; Polyshares’ data-source guides cover nearly 100 systems, none of them insurance software. The other providers that buy from operating companies do not name insurance on their program pages (checked October 2026); their general categories (email, documents, CRM) would cover an agency’s internal records, so ask them directly.

Do privacy rules let an agency license policyholder information?

Not freely. For insurance, the Gramm-Leach-Bliley Act’s privacy rules are enforced “Under State insurance law” by the insurance authority of the state where the business is domiciled. Apart from listed exceptions, the Act bars a financial institution from disclosing nonpublic personal information to a nonaffiliated third party unless the consumer was told it might be and given the chance, “before the time that such information is initially disclosed”, to say no. A “consumer” is an individual who obtains coverage to be used “primarily for personal, family, or household purposes”, so the rules apply most directly to personal-lines files.

The NAIC’s model privacy regulation (Model 672) shows what state rules built on the Act typically contain:

• Agents are covered. Its definition of “licensee” names insurers and producers.
• Relying on the carrier’s notice has a condition. An agent can skip its own notice when its carrier sends one, but only if the agent “does not disclose any nonpublic personal information to any person other than the principal or its affiliates” in a permitted way (Section 4Q(2)). If your agency has never sent its own privacy notice, raise this with your lawyer first.
• Health information needs authorization. Life, health and disability applications and injury claims hold it, and the model says a licensee “shall not disclose nonpublic personal health information” without the person’s authorization (Section 18), apart from listed insurance functions such as claims administration and underwriting.
• Stripped data is treated differently. The model’s financial-information definitions leave out “aggregate information or blind data that does not contain personal identifiers such as account numbers, names or addresses”. Its health definition is wider: anything with “a reasonable basis to believe” it could identify someone.

More than a dozen states, including California and Illinois, also adopted all or part of the NAIC’s older Insurance Information and Privacy Protection Model Act (Model 670; NAIC chart, fall 2021). Under its Section 13, an insurer or agent “shall not disclose any personal or privileged information about an individual collected or received in connection with an insurance transaction” without the person’s written authorization, apart from listed exceptions.

Your state’s law, not either model, is what binds you; a lawyer who advises agencies in your state can say how it applies to your files.

Who owns the policy records, the agency or the carrier?

For an independent agency, custom says the agency, but the agreement decides. IA Magazine, published by the Independent Insurance Agents & Brokers of America (IIABA), calls ownership of expirations, “including related records and data”, perhaps the most critical issue for independent agents (March 2, 2021). New York’s insurance department, asked in 2004 about a terminated agent’s clients, found no insurance law or regulation on point and said “the agreement between the agent and the insurer would control”. An agency that writes for one carrier exclusively should read its agreement for who owns the policy records.

Owning the records does not settle what you may do with the information in them. The sample confidentiality clause in IIABA’s guide to agency-company contracts reads: “Both Agent and Company agree that they will not redisclose or use this nonpublic personal information except as necessary to carry out the terms of this Agreement” (IIABA guide, version 1.0, 2022). Check each carrier and wholesaler agreement for confidentiality, data security and ownership clauses, plus the terms of the carrier portals you download from.

What else in agency files needs care?

Driver records, consumer reports, health plan data and commercial clients’ files each carry their own limits.

• Motor vehicle reports. The Driver’s Privacy Protection Act lets insurers and their agents use driver records for “claims investigation activities, antifraud activities, rating or underwriting”, and a recipient “may resell or redisclose the information only for a use permitted” by the Act.
• Consumer reports. Credit and loss-history reports bought from consumer reporting agencies for underwriting come under the Fair Credit Reporting Act, which says a person “shall not use or obtain a consumer report for any purpose” it was not authorized for.
• Group health plans. If the agency handles plan members’ health information, ask your lawyer whether it is acting as a HIPAA business associate, whose agreement limits use of that information.
• Commercial clients’ information. Submissions carry payroll, revenue, loss runs and financial statements; check client agreements and NDAs as the legal page describes.

What could an insurance agency’s records be worth?

No provider publishes a figure for an insurance agency. As of October 2026, the providers on this page state these ranges, all their own statements rather than offers or averages: Telegraph Lab $100K to $4M, “Subject to data review and agreed terms”; Scale AI “$10K–$1M+ illustrative value per data partnership, scaling with cadence”; Troveo, typical full-company deals starting at six figures; Miro Advisory $100K to $1M+ for operating datasets, which it calls “illustrative only”; and Avelence’s calculator, a model estimate of $160K to $500K at its default inputs. FileYield’s guide prices its financial category, which includes insurance claims, at $0.01 to $100+ per record (FileYield). Mercor publishes no range.

Each assumes records you are free to license; a scope without personal-lines files and health information is narrower, so ask which records a number assumes. Why the ranges differ is on how much is my company’s data worth?

How does an insurance agency owner start?

With the agreements and a list of systems, before any export.

1. Pull the paper. Every carrier, wholesaler and MGA agreement, the agency’s own privacy notice if it has one, and client agreements on large commercial accounts. Mark the confidentiality and data clauses.
2. List the systems. The management system with the oldest activity you can open, the rater, email, document storage, the phone system and agency accounting.
3. Split the book. Personal lines, commercial lines, and life, health and benefits. Health information and motor vehicle reports are the first candidates to leave out.
4. Count what is left. The free sample tool reads mail (.mbox or .eml), a Slack export and CSV reports, such as activity lists exported from a management system, in your browser; nothing is uploaded unless you choose to. Write the totals into an inventory.
5. Apply with the scope stated. The application needs no files; say which books are in and what stays out.