Regulatory position
Where this platform sits under EU and Belgian insurance law, what it does with data, and which obligations belong to you rather than to us. Written so that a compliance officer can check it against the system rather than take it on trust.
This is not an offer of insurance, and no cover is ever placed. Nothing this platform produces constitutes insurance mediation, distribution or advice within the meaning of Directive (EU) 2016/97. No policy is bound, no carrier is notified, no premium is collected and no payment instrument is touched at any point.
Position
Infrastructure, not an intermediary
RiskRouter supplies software: a pricing engine, a configurator and an audit ledger. It is not an insurer, not an insurance intermediary and not an ancillary insurance intermediary. It has no customers of its own, holds no client money, and carries no risk.
Insurance distribution is performed by the licensed distributor who integrates it. That distributor owns the customer relationship, the product approval process and the regulatory permissions. We hold none of those and do not act as if we do.
Where a licensed distributor uses this platform in production, we would be an ICT third-party service provider to a financial entity, with the contractual and oversight consequences that carries under DORA. That relationship is deliberately narrow and documented rather than implied.
Status
What is and is not in place
| Item | Status |
|---|---|
| Insurance distribution activity | Suspended |
| Live production binding | Blocked |
| FSMA intermediary registration | Not held, and not applied for |
| Carrier or underwriting pool | Not contracted |
| Professional indemnity cover | Not in place |
| Client money handling | Not applicable, none is held |
| Technical routing path | Verified |
| Audit ledger | Live, append-only |
We publish no registration number, licence reference or carrier name, because none has been issued. Every figure the console shows is a simulation produced by fixed server-side rules.
Frameworks
Which EU rules bite, and where
Listing the ones that do not apply matters as much as listing the ones that do. A platform that claims coverage of everything has usually thought carefully about nothing.
| Framework | Relevance | Where RiskRouter stands |
|---|---|---|
| Insurance Distribution Directive Directive (EU) 2016/97 |
Governs anyone distributing insurance, including the conduct, information and record obligations. | Applies to the distributor, not to us. The platform is built so a distributor can meet the traceability and fair-presentation obligations rather than fight the tooling. Detail below. |
| Belgian insurance law Act of 4 April 2014, supervised by the FSMA |
Transposes the IDD in Belgium and requires intermediaries to be registered before distributing. | No registration held. Distribution stays suspended until a registered distributor operates the platform. |
| GDPR Regulation (EU) 2016/679 |
Applies to any processing of personal data. | A quote record contains no personal data at all. The personal data we do hold comes from the contact form and from email sent to our published address, and from nowhere else. Set out in full on the data protection page. |
| DORA Regulation (EU) 2022/2554 |
Operational resilience for financial entities, and oversight of the ICT providers they depend on. | Relevant the moment a regulated distributor depends on this platform. The audit ledger, the degraded-write behaviour and the ledger health probe exist partly for this. Formal contractual arrangements would be agreed per pilot. |
| PRIIPs Regulation (EU) 1286/2014 |
Key information documents for packaged retail investment products. | Not applicable. These are general insurance covers with no investment component. |
| Solvency II Directive 2009/138/EC |
Capital and governance requirements for insurance undertakings. | Not applicable. We underwrite nothing and carry no risk. It binds the carrier standing behind the cover. |
| ePrivacy Directive 2002/58/EC |
Storage of, and access to, information on a user's device. | No cookies, no analytics, no third-party requests of any kind. One setting is kept in your own browser for the demo tool. Detail here. |
| EU AI Act Regulation (EU) 2024/1689 |
Obligations attaching to AI systems, including risk assessment and pricing in insurance. | Not applicable. Pricing is a fixed lookup table. There is no model, no inference and no automated decision-making about any individual. |
Design
How the IDD shaped the build
Traceability, Article 20
A distributor has to be able to show what was presented to a customer and on what basis. Every routing event is appended to a ledger that records the vertical, the exact true or false state of every component, the premium and the timestamp. The database refuses edits and deletions for every role including the administrative one, so the record cannot be tidied up afterwards.
Fair, clear and not misleading, Article 17
Only the server prices a policy. It discards any price a browser sends and forces the mandatory base cover back on if a modified request tries to strip it. A customer therefore cannot be shown a number the engine would not charge.
The same principle governs the audit trail. When a ledger write fails, the interface says no record exists rather than implying one does. A system that reports success it cannot evidence is precisely what an inspection is designed to find.
Product oversight and governance, Article 25
The rating matrix is a single frozen object with one definition per component, published at a public endpoint so the interface renders exactly what the engine charges. A change to a price is a code change with a test that fails if the console or the documentation disagrees. That gives a product owner a reviewable, versioned record of every rate that has ever applied.
What the platform does not do is decide whether a product is appropriate for a target market. That judgement belongs to the distributor and the manufacturer.
Division of responsibility
What stays with you
Using this platform does not transfer any regulatory obligation to us, and no contract we could write would achieve that. A distributor integrating RiskRouter still holds:
- Registration with the FSMA, or the equivalent authority in your member state
- The demands and needs assessment, and the insurance product information document
- Product approval and target market definition under product oversight and governance
- Professional indemnity cover and the conduct requirements attaching to your permissions
- The customer relationship, complaints handling and any redress
- Controllership of your own customers' personal data
We supply routing, deterministic pricing and an audit trail you can evidence. That is the whole of it, and we would rather say so plainly than let a diagram imply otherwise.
Scope
Limits of this page
This describes a prototype we run for technical validation. It is not legal advice, carries no contractual terms, and claims no regulated activity. Statements about EU and Belgian law are given in good faith to explain design decisions, not as an authoritative reading. Take your own advice before distributing anything.
If something here does not match what the system actually does, that is a defect and we want to know. Tell us and we will correct the page or the code.