Duck Creek Technologies

A core platform with an agentic layer added in April 2026, and the launch material describes the relationship precisely. The platform is stated to leverage existing customer data, manuscripts, configurations and interfaces, to support embedded and headless deployment while preserving prior technology investments, and to embed intelligent automation directly into core insurance workflows. Every one of those phrases describes something placed on top of a system that already works.

Remove the models and what remains is the business: policy administration, billing, claims, rating, loss control, reinsurance, distribution management and payments, all deterministic and all predating the agents by decades. The company's own repositioning acknowledges the direction of travel, contrasting competitors that merely cloud host legacy logic with its own architecture unifying data, workflows, automation, governance and artificial intelligence, but a system of record described as a system of intelligence is still a system of record with intelligence attached.

Human in the loop stated at chief executive level and supported by architecture, with the marketplace leaving the same accountability question this index has recorded elsewhere. The commitment is explicit rather than implied, with the chief executive describing agents that operate with full context, governance, traceability and human in the loop, and governance named as one of the platform's architectural layers rather than a feature within one.

Traceability means an agent's actions can be reconstructed, which is the precondition for meaningful oversight. Two things hold it below the top band. Neither of the launch applications publishes a boundary: an agentic underwriting workbench and an agentic first notice of loss experience both sit at decision points affecting applicants and claimants, and nothing states what an agent may complete unattended or what a person must approve. And because the gateway hosts agents built by partners and customers alongside the vendor's own, nothing describes what governance obligations attach to an agent the vendor did not build.

Architecture described, performance not measured. On the transparency side the disclosure is better than most: the technique is named as neuro symbolic reasoning combined with insurance specific models and a proprietary domain ontology, the platform layers are enumerated, and traceability and auditability are stated as built in controls rather than aspirations, which gives a carrier's model risk function something to interrogate. What is absent is any number.

Across two passes no accuracy figure, error rate, validation methodology, benchmark, sample or observation period was located for the platform or either launch application, which is unsurprising four months after launch but leaves a buyer with nothing to assess.

The one large figure in the launch material belongs to someone else and describes the market rather than the product, being a consultancy's projection of up to 80 billion dollars in annual artificial intelligence impact across United States insurance, and should not be mistaken for a result.

Strong evidence for the platform, thin evidence for the artificial intelligence line this record grades. On the platform side customers are named across tiers and continents, including a large specialty insurer, a Bermuda based global specialty carrier whose global chief information officer appears on the record, a South African group, a Canadian carrier, a European assistance business and two United States regionals, with analyst quadrant leader standing and a partner ecosystem independently cited at more than 2,000 integrations.

Ownership by a major software investor and a customer conference with an analyst panel drawn from three named research houses add further external validation. On the agentic side the record is early: the platform launched in April 2026 with no named customer, no quantified outcome and no adoption figure.

The single artificial intelligence award cited is a hackathon run by the company's own private equity owner among its portfolio companies, which is an internal competition rather than industry recognition and should not be read as the latter.

Governance treated as architecture rather than as a policy statement, with one technical claim that would matter if evidenced. The platform is described in named layers including a governance layer, with built in controls for traceability and auditability, and the launch positions the whole product around transparent, auditable and extensible decisioning.

The technical claim is neuro symbolic reasoning, presented as the mechanism allowing agents to operate within existing carrier workflows and regulatory constraints. That is a meaningful thing to claim, because a symbolic component can encode a rule an agent must not violate in a way a purely learned system cannot, and combined with a proprietary insurance domain ontology it describes constraint by construction rather than by instruction.

It is asserted without technical detail, evaluation or demonstration. Absent across two passes: model card, evaluation methodology, red team result, incident disclosure and acceptable use boundary for either first party or marketplace agents.

Four named regulatory regimes across three continents, each with a document behind it, which is broader published coverage than anything else in this lane. The cloud service is stated to support the European data protection regulation, the Australian prudential regulator's standards, and the payment card security standard at the self assessment level for service providers, with an attestation document listed as obtainable.

A whitepaper on the European operational resilience regime for financial entities is published separately. Architectural commitments are specific rather than general, including encryption with customer specific security keys, continuous threat monitoring, and a documented shared responsibility model setting out which controls belong to the vendor and which to the carrier, which is the artefact a buyer's risk function actually needs.

What is absent is the American financial privacy statute, which is not named anywhere, along with any retention schedule or subprocessor list, and nothing separately describes what data the agents may access.

The strongest security disclosure located in this lane and among the best in this index, because the documents themselves are obtainable rather than the credentials merely asserted. A dedicated trust page is structured into overview, shared responsibility, physical security, security operations, architecture, compliance and resources.

Credentials are named specifically: the international information security management standard, annual independent audits of both service organisation control types at the second level, and the payment card security standard at the self assessment level for service providers. Annual risk assessments and internal audit are stated.

Crucially the artefacts are enumerated and reachable, covering a security whitepaper, the certification document, both audit reports, the card attestation and an operational resilience whitepaper, downloadable by existing customers and partners from a solution centre and available to others on request from a published security address. That is a working route to evidence rather than a badge.

One drafting inconsistency belongs on the record: the trust page describes the offerings as compliant with the information security standard while the product page describes them as certified, and those are different claims.

No licence, and the broadest published regulatory engagement in this lane. Three regimes are supported and documented rather than mentioned: the European data protection regulation, the Australian prudential regulator's standards for outsourced material business activities, and the payment card security standard with an attestation obtainable.

The distinguishing item is a published whitepaper on the European operational resilience regime for financial entities, which is a substantive position on a regime that makes information technology suppliers to European insurers part of their customers' regulatory perimeter, and almost no vendor graded in this index has published one. Multi country platform layers and a stated commitment to the London specialty market indicate the same regulatory literacy applied commercially.

The conspicuous absence is the newest regime and the one closest to this record: no position on the European artificial intelligence regulation was located, despite the company shipping agentic underwriting into European markets where insurance risk assessment is designated high risk.

Governance here answers questions about process and record, not about whether outcomes fall evenly. Everything published concerns traceability, auditability, orchestration and control: whether an agent's actions can be reconstructed, which workflows it may enter, and that a human remains in the loop. Those are real and well specified. None of them addresses fairness. The exposure sits in both launch applications.

An agentic underwriting workbench shapes decisions about who is offered cover and on what terms, and an agentic first notice of loss experience shapes how a claim is characterised at the moment it is reported, which influences everything downstream for the claimant. Across two passes no bias testing, fairness metric, disparate impact analysis, model card or conformity assessment under the European artificial intelligence regulation was located. The neuro symbolic architecture could in principle support fairness constraints expressed symbolically, and nothing published indicates whether it does.

A service level agreement exists and is referenced publicly, which lifts this above the vendors in this index that publish nothing, and it covers the wrong thing for this axis. The company states that its commitment is backed by a service level agreement structured for around the clock availability, disaster recovery and dynamic growth in business capacity, and disaster recovery commitments appear in the trust material. Those address whether the platform runs.

Across two passes no warranty, indemnity, liability cap or terms of service was located, and nothing addresses whether the platform was right. The uncovered exposure is specific to the new products: an agentic underwriting workbench that shapes who is offered cover and an agentic first notice of loss experience that shapes how a claim is characterised both produce consequences for applicants and claimants who are not the customer.

And because partner and customer built agents run inside the same gateway, nothing published describes how responsibility divides when an agent the vendor did not build causes harm inside its governance layer.

More technical disclosure than this category usually offers, with the model provider itself left unnamed. On the disclosed side: the cloud and infrastructure partner is named, with that partner's own financial services general manager appearing on the record about the collaboration; the reasoning approach is named as neuro symbolic rather than described vaguely as artificial intelligence; a proprietary insurance domain ontology is identified as the context layer; and the interoperability protocols are named as open standards, which tells a buyer exactly how third party components attach.

The marketplace and registry make the existence of partner and customer built agents explicit rather than presenting a monolithic platform. What is not disclosed is whose foundation models sit inside the agents. No provider, family or version is named for the learned component, and no supply chain information at all attaches to the partner agents that can run in the same environment, so a carrier adopting one inherits a dependency it cannot see.

Two architectural choices here work against the vendor's own commercial interest, which is what earns the grade. First, the data foundation integrates natively with the company's own systems of record and is explicitly stated to support integration with other core systems, so a carrier running a competitor's core can still adopt the agentic layer. A core vendor building its newest product to work on rival cores is deliberately declining a lock in it could have taken.

Second, the gateway layer is an open integration framework with a marketplace and registry supporting the model context protocol and agent to agent protocol by name, meaning agents built by the vendor, its partners or the carrier itself connect over published open standards rather than proprietary interfaces. Naming those protocols is unusually forward for enterprise insurance software.

Around them sit a partner ecosystem independently cited at more than 2,000 integrations, embedded and headless deployment options, and explicit anti lock in positioning. Counter evidence belongs on the record: analyst peer reviewers describe the data architecture as difficult for integration and analysis.

A documented cloud model with a named hyperscaler and a genuine shared responsibility artefact, short of an explicit residency commitment. The cloud service runs on Microsoft Azure, named openly, and the trust material publishes a shared responsibility model setting out which controls the vendor holds and which remain with the carrier, which is the document a third party risk function needs and which most vendors in this index never produce.

Availability, disaster recovery and capacity growth are stated as covered by a service level agreement. Support for the Australian prudential standards and European data protection implies regional processing capability, and multi country platform layers indicate localisation work. The agentic platform adds deployment flexibility on top, supporting embedded and headless models so a carrier can adopt it inside existing workflows or alongside them. What is missing is specificity: across two passes no named region list, explicit residency commitment or tenancy description was located.

No price, unit or tier is published for the core suite or the agentic platform, and two passes across the company's site, its press archive, marketplace listings and third party directories produced nothing. The company has been privately held since 2023, so no financial reporting substitutes for it.

What independent review data does supply is a consistent warning rather than a number: analyst peer reviews record implementation cost, timeline and complexity as the most common negative themes for this vendor, and separately note that version upgrades with heavy customisations frequently take many months and require expert assistance. That is a real total cost of ownership signal for a buyer, and it comes from customers rather than the vendor.

For the agentic platform specifically, nothing indicates whether it is licensed separately from the core, whether it is available to carriers running a competitor's core despite being stated to integrate with other systems, or how marketplace agents from partners are charged.

Genuine international and segment breadth within property and casualty, evidenced by named customers rather than claimed. The roster spans a large United States specialty insurer, a global specialty carrier, a South African insurance group, a Canadian property and casualty company, a European assistance and travel insurer, and United States regional and specialty carriers, which covers personal, commercial and specialty lines across four continents.

Product depth reaches the whole operating estate rather than one function, covering policy, billing, claims, rating, loss control, reinsurance, distribution management and payments, so a carrier can run its core operations from one supplier. Recent expansion is directed at markets requiring local adaptation, with multi country layer enhancements and a stated commitment to support the London specialty market. Two limits: the scope is property, casualty and general insurance only, with no life or health lines, and no customer count is published for any market.