Shift Technology

Shift has only ever been an insurance AI company, with a stated 100 percent focus on insurance since its founding in 2014. Every product it sells is a model output rather than a workflow with models attached. That covers fraud detection across claims, applications and organized rings, underwriting fraud caught before binding, and subrogation opportunity assessment, along with payment integrity and claims automation from first notice of loss.

There is no policy administration system, no billing engine and no system of record underneath that would survive if the models were removed. The technical lineage supports the claim rather than merely asserting it. The company adopted LLMs early, in 2020, has analyzed more than 2.6 billion policies and claims, and now describes combining generative, agentic and predictive approaches. The agentic layer extends model dependence rather than diluting it, with agents drafting demand packages, guiding negotiation and estimating medical treatment duration.

The stated posture is consistently assistive and a customer quote demonstrates it in practice, with one area where the agents go further than that framing suggests. On the assistive side the language is uniform: AI empowering human experts, agents that recommend relevant next actions for claims handlers, and a published customer statement describing the value as consistently identifying suspicious activity at first notice of loss and assigning the claim to the appropriate expert for investigation.

Fraud detection surfaces cases for special investigation units rather than disposing of them, which leaves the adjudication with a person. The area to examine is the newer agentic suite. Agents that draft an initial demand package, guide a negotiation, estimate medical treatment duration and develop a treatment plan are producing substantive work product rather than surfacing a signal, and claims automation includes straight through processing by design. Nothing published states what an agent may complete without review or what a handler approves.

The company publishes real technical work about the field and no measurement of its own models. An ongoing research series includes an edition evaluating reasoning models against performance, cost and latency across insurance use cases. That is comparative model evaluation methodology put into the public domain rather than a marketing paper. Explainability is a stated design property, and a customer corroborates it.

Scale gives some confidence in the training base, at more than 2.6 billion policies and claims analyzed. What is missing is the product's own numbers. No detection rate, false positive rate, or precision or recall measure is published for any detection product, and no validation methodology, sample or observation period. The headline figure of more than $5 billion in fraud savings is an aggregate across the customer base with no method attached. For fraud detection the false positive rate is the number that matters most, because each one is a legitimate claimant investigated.

The evidence is corroborated from several directions rather than one. Customers are named, with their executives quoted. A global insurer renewed a five year strategic agreement in March 2026, extending a collaboration begun in 2016 across 15 countries, and quoted its own chief transformation officer for European markets. A second large European mutual signed as a strategic partner for fraud and risk.

Scale is stated precisely at more than 115 insurance customers across 25 countries, with more than $5 billion in reported fraud savings. Independent recognition is current and specific, including a luminary designation from a named analyst house for insurance fraud detection. The strongest single item is structural.

The dominant property and casualty core platform vendor named this company its strategic partner for insurance decisioning and separately invested in it, which is validation by the party best placed to build the capability itself. A national industry body selected it to build a country wide motor fraud platform.

Explainability is claimed by the vendor, corroborated by a customer and backed by published technical research. The vendor describes its insurance grade AI as accurate, explainable and secure, which alone would be marketing. The difference is that the customer says the same thing independently.

In announcing a five year renewal, a global insurer's own executive framed the relationship around combining technology with human expertise, and the vendor's chief executive characterized the value as explainable, insurance specialized AI. A customer signing a five year commitment and describing the technology in those terms is meaningful corroboration. The company also publishes an ongoing technical research series.

One edition evaluates reasoning models on performance, cost and latency across insurance use cases, and threat research covers document fraud and synthetic media in the generative era. There is no model card or published evaluation of its own models, no red team result or incident disclosure, and no acceptable use boundary.

Nothing is published on a privacy or trust surface. What can be established about the regimes this company operates under comes from a job advertisement. A senior security role names the intersection the company expects that person to manage: European data protection law, ISO 27701 and a health information security framework, along with the French health data hosting certification and financial services regimes. That indicates a real and broad privacy infrastructure including health data.

It matters because the platform's agents assess whether medical billing applies to a claim, estimate treatment duration and develop treatment plans, so medical records pass through it. But a recruitment advertisement is not a privacy posture. No privacy policy content, data processing description, retention schedule or subprocessor list is published. The claimant whose medical file is analyzed is not the customer and has no described route to any of it.

The most detailed public account of Shift's security and compliance posture is a job advertisement: informative, and the wrong source. A senior security role posted by the company describes maintaining compliance with core standards, naming a SOC framework and ISO 27001.

The role also manages an intersection that includes ISO 42001, ISO 27701 and a health information security framework, along with the French health data hosting certification, DORA and New York state financial services rules. That is a serious and specific compliance surface. It is also unverifiable. No trust center or certification page is public, and no downloadable certificate or attestation report. Nor is there a penetration test summary or subprocessor list.

The company was also recruiting a chief information security officer in 2026 while serving more than 115 insurers across 25 countries, and nothing public says whether that is a first appointment or a replacement.

Shift is an unregulated software vendor whose regulatory surface is visible mainly through a job advertisement, and that is the finding rather than an aside. A senior security role posted by the company names the regimes it expects that hire to translate into engineering controls: the EU AI Act, ISO 42001 and European data protection law.

The list continues with a health information security framework, the French health data hosting certification, DORA and New York state financial services rules. That is a precise and demanding list, and it indicates the company knows exactly where it sits. None of it is stated as a position.

There is no published statement on the EU AI Act, though this is a French company selling automated decisioning into insurance underwriting and claims across 25 countries, an application the regulation treats as high risk. No authorization, registration or supervisory outcome is public either.

Explainability is claimed and corroborated, and no fairness evidence exists behind it. The exposure is broad because of where these determinations land. A fraud flag routes an individual claimant to a special investigation unit, which means delay, scrutiny and potentially denial for a person who is never told a model selected them. Underwriting fraud detection can prevent someone obtaining cover at all.

And the medical agents reach further still, assessing whether billing applies to a claim, estimating treatment duration and developing a treatment plan, which shapes what an injured claimant actually receives. Insurance fraud detection carries documented disparate impact concerns, and detection built partly on claim characteristics correlating with geography, vehicle age, provider choice or repair network can distribute suspicion unevenly while appearing neutral.

No fairness testing, disparate impact analysis or model card is published, and no conformity work under the EU AI Act. Explainability partly answers this, since an explained flag can be reviewed, but review is not measurement.

Shift publishes no terms of service or master agreement, no warranty or indemnity, and no liability cap or service level. Nothing states what an insurer is owed if detection fails or misfires. The uncovered exposure takes two distinct shapes. For the customer, a missed organized fraud ring is a direct loss and a false positive rate that is too high is an operational cost, and neither is addressed. For the third party it is sharper.

A claimant wrongly routed to a special investigation unit faces delay, intrusive scrutiny and possible denial at the point they are least able to absorb it. Someone whose treatment duration is estimated low, or whose medical billing is judged inapplicable, may receive less care than they need. Those people have no relationship with this vendor, are not told a model made the assessment, and have no published route to see or contest it.

The foundation model dependency is named openly. Through the cloud provider's own published case study, the company discloses that it runs on that provider's hosted LLM service and vision service within its AI platform. It also uses machine learning based optical character recognition for document extraction, and adopts the provider's latest models soon after release so customers get improved detection quickly. It separately discloses that it began using LLMs in 2020.

An insurer therefore knows whose foundation models read its claim files and policy documents, and can assess that provider's own terms and data handling directly. Two qualifications apply. No model family or version is named, so the specific model behind a given decision is not identifiable. And the disclosure sits on the cloud provider's marketing surface rather than the vendor's own, where a buyer would look, and pages like that are withdrawn without notice.

The strongest distribution position available in this market, and it goes beyond a partnership. The dominant property and casualty core platform vendor named Shift its strategic partner for insurance decisioning and granted it premier technology partner status. It lists an accelerator for Shift on its marketplace, and separately made a direct strategic investment in it.

The product therefore reaches insurers through the system of record they already run, with integration built by the core vendor's own program rather than assembled by each customer. And the party best placed to build this capability itself chose to partner and invest instead.

Further named integrations sit around that: a major risk data provider's claims product combined with this platform's decisioning, a global services firm partnering on detection and deterrence, and a services partner co building a national industry platform. Delivery runs on a named hyperscaler's AI services. The one gap is developer documentation, which is not public.

Cloud delivery on a named provider, with the placement questions unanswered. The platform runs on a major hyperscaler's AI services, disclosed in that provider's own case study, and the vendor describes a software as a service platform. Beyond that, no region list, tenancy description, residency commitment or customer hosted option is published. The question is live for this company.

It serves a global insurer across 15 countries and more than 115 customers across 25, several of which sit under regimes that constrain where insurance and health data may be processed. The platform also handles medical records through its billing and treatment agents. A senior security role advertised by the company names the French health data hosting certification among the regimes it manages. That implies a residency capability exists for at least one sensitive category, but a recruitment advertisement is not a residency commitment, and nothing published states what is available to whom.

No price, unit or tier is published. The company's site, product and resource pages, news archive and third party directories say nothing about how any product is charged. The published entry route is a demonstration request. Two structural questions follow from the shape of the offering, and neither is answerable publicly.

The estate now spans detection, claims automation, underwriting and subrogation as separate product families, and nothing indicates whether they are licensed individually or as a suite. That matters because an insurer wanting only fraud detection is a very different buyer from one automating its whole claims operation.

And distribution through the core platform vendor's marketplace raises the question of whether an accelerator bought there prices differently from a direct agreement, with no published answer. One indirect signal exists: an independent review positions the platform as suited to medium and large insurers and suggests smaller teams may find simpler tools more practical.

Breadth on every dimension, evidenced rather than claimed. Institutionally, more than 115 insurance customers across 25 countries, spanning a global multinational insurer operating the platform across 15 of its own markets, a large European mutual, a national industry body deploying it as shared infrastructure, and a long established American motor mutual.

Geographically the company operates from France, the United States, Mexico, Brazil and Japan, covering Europe, North America, Latin America and Asia. By line of business it covers automotive, health, property and casualty and life, across both personal and commercial books.

By function it reaches the whole claims and underwriting lifecycle rather than one step, from application fraud before binding through first notice of loss, claims handling, payment integrity, subrogation recovery and compliance risk. The 100 percent insurance focus means none of that breadth is diluted by adjacent industries.