Unstructured Data Management in Banking and Insurance: A Practical Guide

TL;DR: Banks and insurers hold huge amounts of unstructured data, like loan files, KYC packs, claims, broker submissions and call recordings, but most of it isn’t ready for AI. Good storage tells you where a file is. AI-ready data also tells you what’s in it, whether it’s labelled correctly and where it came from. Getting there takes five steps: organise, protect, label with experts, check quality and keep a full audit history. With the EU AI Act’s high-risk rules applying from December 2027 and SR 11-7 already in force in the US, provable data provenance is becoming a requirement, not a nice-to-have.

Banks and insurers aren't short on data. Most have decades of loan files, KYC packs, claim forms, broker submissions, call recordings and damage photos sitting in storage. The problem is that very little of it is in a state an AI model can learn from.

That data could be a real competitive advantage, because no one else has your loan book or your claims history. But how it gets digested, reviewed and approved for model training looks completely different from one business to the next, and often from one team to the next. Some have clear owners and a review trail. Many rely on spreadsheets and whoever happens to know where things live. That only becomes obvious when a model risk team or a regulator asks what a credit model was trained on, and “it’s somewhere in the shared drive” won’t cut it.

What is unstructured data?

Unstructured data is anything that doesn't fit neatly into rows and columns. Think documents, emails, scanned forms, call audio, transcripts, images and video. A model can't do much with it until someone has given it structure and labels.

It's also most of what a company holds. MIT Sloan puts unstructured data at 80 to 90% of all company data. In insurance, the figure is even higher, with Collibra estimating more than 90%.

What unstructured data looks like in banking and insurance

In banking, unstructured data shows up as:

• Loan applications and supporting documents
• KYC packs, including ID scans and proof of address
• Call recordings and transcripts from contact centres
• Customer complaints and email threads

One bank's data team we've spoken with deals with millions of call transcripts and millions of document images. That's a normal scale for a large lender.

In insurance, it looks like:

• Broker submissions, often as long PDFs
• Claim forms and supporting evidence
• Adjuster notes
• Photos of vehicle or property damage

A reinsurer we spoke to needs to pull values like fleet size and sum assured out of broker submission PDFs. In some of those forms, the most important signal is whether a single checkbox has been ticked.

Why is this unstructured data hard to use?

In financial documents, a lot of the meaning sits in the layout. Where a number appears on the page, which table it belongs to, whether a box is ticked. It also depends on expert judgement, the kind an underwriter or compliance analyst builds up over years.

Both of those are easy to lose. The same reinsurer used to copy text from documents into Excel so experts could review it, stripping out all spatial context. Even then, their experts only agreed with each other about 60% of the time. If the people who know the work best can't agree on the right answer, a model trained on their labels won't do much better.

Storage vs AI-ready data: why good file management isn't enough

Most banks and insurers already have solid document management. Files are stored, backed up, permissioned and retained for the right number of years. That work matters, but it answers a different set of questions.

Storage tells you where a file is and who's allowed to open it. To train or test a model, you also need to know what's in the file, whether it's been labelled correctly, and where it came from. That second set of questions is where most teams get stuck.

Gartner found that 63% of organisations either don't have, or aren't sure they have, the right data management practices for AI. It also expects organisations to abandon 60% of AI projects that aren't backed by AI-ready data through 2026.

Here's what the gap looks like day to day.

• Files with no context. A head of data at a large asset management company described their situation as "lots of documents with no metadata". On top of that came duplicates, plus "old knowledge that needs to be deprecated, but is still floating around". If you can't tell which version of a policy document is current, you can't safely train on any of them.
• Labels scattered everywhere. An insurance claims AI team told us their labels lived in spreadsheets and code repositories. Engineers were relabelling data that someone else had already labelled, simply because they had no way of knowing it existed. Over time, their ground truth also went stale.

The benefits of AI-ready data:

You know your data is AI-Ready when that data stops being a liability you have to explain and instead becomes an asset you can build on. Teams move faster, experts spend less time on rework, and you can show auditors exactly what’s behind every model. Here’s what that looks like in detail:

1. One place for all your data. Documents, call recordings, images and their labels sit together in one platform, linked from the cloud storage you already use. Teams can check what already exists before they collect or relabel something new, which stops the same work being done twice in different silos.
2. Expert time spent where it counts. Teams can remove duplicate and outdated versions, then pick the data that will actually contribute to improving your model, before anyone starts labelling. In banking and insurance, the labellers are often underwriters and compliance specialists. Their time is the expensive part of the whole process, so it shouldn't go on files that add little to no value.
3. Quality you can prove to an auditor. Every label carries a record of who made it, who approved it, when, and how far the experts agreed. That's exactly what model risk teams and regulators will ask to see (more on that below).
4. Your data becomes the advantage. Everyone has access to the same base models. What you train them on is the part nobody else has. The chief scientist at one of the largest US banks has said the bank started from the idea that its own data was the key to better models, and that the past couple of years have proved that right. Industry analysts make a similar point about banks building their own foundation models: the model itself isn’t what sets you apart.

The five parts of managing unstructured data for AI

Getting from a pile of files to data you can train and test on comes down to five jobs. You need to find and organise the data, protect it, label it with the right experts, check the quality of those labels, and keep a full history for auditors. Here's what each one involves.

1. Find and organise it

Start by connecting your data rather than copying it. Files should stay in your existing cloud storage, linked into one place, with new files syncing in automatically. Documents, text, audio, images and video can then sit side by side instead of in separate tools

Next, add the business context that makes data findable. Tag files with details like product line, region, date and document type, then filter on those tags. Remove duplicates, pick the subset you need, and save it as a versioned collection that's ready for labelling (Encord docs).

This step sounds basic, but it's often the blocker. A large consumer lender we spoke to had built up two years of call, image and text data. Several business use cases were on hold simply because none of it had been structured into a format that could be used across the business.

2. Protect sensitive information

Financial data is full of personal and commercially sensitive details, so security has to come first.

Keep data inside your own environment. Files should stay in your own storage. For the strictest setups, you can run projects inside your private cloud or fully on-premises with no internet connection. Encord's strict client-only mode means our servers never process your files at all.

Give people access to only what they need. With role-based access, an external labeller only sees the tasks assigned to them. Add single sign-on, multi-factor login, and encryption both in transit and at rest. 

Check the certifications. For banks and insurers, a vendor’s security posture is often the first thing procurement and risk teams review. Encord is SOC 2 Type II certified and compliant with GDPR and HIPAA, which covers the standards most financial services security reviews ask about. Just as important, no third party trains on customer data, so your loan files, claims and call recordings are never used to improve someone else’s model.

3. Label it with experts

This is where most of the value is created, and most of the cost.

Let AI take the first pass. AI agents, whether that's GPT-4o, Gemini or your own models, can pre-label documents and transcripts. Underwriters and compliance specialists then review and correct those labels instead of starting from a blank page (Encord docs).

Label inside the original document. When experts work directly in the PDF, tables, checkboxes and position on the page stay attached to every answer. Copying text out into a spreadsheet, which plenty of teams still do, throws that context away.

Send each task to the right person. Group reviewers by skill, for example, claims or underwriting, and route each type of task to the right group to produce the most accurate models whilst prioritising your experts’ time. Your in-house experts and any outsourced labelling team can work in the same workflow with different permissions.

4. Check quality

Expert labels aren't automatically correct labels, so quality needs to be measured.

Measure agreement. Send the same item to several experts independently and flag where their answers differ. That lets you settle edge cases and agree on a clear standard. Remember the reinsurer whose experts agreed only around 60% of the time. Without measuring it, they'd never have known.

Review before anything is final. Every label should go through review, where it's approved, sent back with a note, or escalated. Test labellers against a gold standard set before a project starts and at points during it

Track quality over time. Dashboards that show rejection rates by labeller and by label type tell you where guidelines are unclear or where quality is starting to slip.

5. Keep a full history for auditors

Record every action. You should be able to see who labelled what, who approved or rejected it, when that happened, and every change made to access or permissions.

Freeze the data behind each model. Save a version of your labels before every training run. That way you can show exactly what a model was trained and tested on, even months later

Rules and oversight: why provenance matters more every year

For banks and insurers, being able to prove where AI training data came from is fast becoming a regulatory requirement globally.

The EU AI Act. The Act classes AI used for credit scoring, and for risk assessment and pricing in life and health insurance, as high-risk. Providers of high-risk systems have to show documented governance of the data used to train, validate and test them, covering how it was collected, how it was labelled and cleaned, and how gaps and biases were checked (EU Artificial Intelligence Act, Article 10).

The deadline moved this year. The Digital Omnibus on AI, which entered into force on 27 July 2026, pushed the start date for standalone high-risk systems like these from August 2026 to 2 December 2027. The obligations themselves didn't change. With just over a year to go, and data governance being one of the slowest things to put right, most firms can't afford to treat that as breathing room.

US model risk management. US banks already document their models and the data behind them under the Federal Reserve's model risk guidance, SR 11-7. Model validators expect to see where the data came from, how it was prepared, and whether it suits the model's purpose. Unstructured data used in AI models falls under the same expectations as anything else.

In practice, both point to the same need: a clear, exportable record of every file, label, reviewer and data version behind a model. Teams that build that record as they go will find audits much easier than teams trying to piece it together afterwards.

How to choose an unstructured data platform: a buyer’s checklist

If you're comparing platforms, these are the 7 areas worth digging into, along with the questions we'd suggest putting to any vendor, including us.

1. Runs securely in your own environment

Your files should never leave your storage, and the platform should be able to run in your private cloud or fully on-premises if needed. Setup also shouldn't take months of approvals (Encord docs).

Questions to ask:

• Where does our data sit, and do your servers ever touch it?
• Can you run inside our own cloud account?
• Can we keep separate setups for data with different sensitivity levels?
• How long does a typical bank or insurer deployment take?

2. Handles every file type

Documents, scanned forms, call audio, transcripts, images and video should all live in one platform. Otherwise, you end up buying and managing a separate tool for each data type.

Questions to ask:

• Can we label inside the original PDF, including tables, checkboxes and linked line items?
• Can we view a call recording next to its transcript and the customer's file?
• Does it handle the languages our customers speak?

3. Supports expert review

AI should do the first pass, with experts reviewing and correcting. Each task should reach the right person based on business line and access level.

Questions to ask:

• Can our own staff and an outside labelling team work in the same workflow with different permissions?
• Can we plug in our own models for the first pass?

4. Tracks quality

Agreement between experts should be measured, not assumed. Labels should be reviewed before they're final, and quality tracked by person and by label type over time.

Questions to ask:

• Can we send the same item to several experts and see where they disagree?
• Can we test labellers against a gold standard set?
• Do the quality dashboards work for text and audio as well as documents?

5. Keeps audit logs

You need a record of who labelled and approved what, and when, plus a saved version of the exact data behind each model.

Questions to ask:

• Can we export the logs for our model risk team?
• Can we recreate the training set for a model we built six months ago?
• Which certifications do you hold, for example, SOC 2 Type II and GDPR?

6. Connects to your existing systems

The platform should plug into the cloud storage, sign-in and ML tools you already use, through an API and Python SDK, and export labels in standard formats.

Questions to ask:

• Does it work with our storage, whether that's AWS, Azure, GCP or on-premises S3-compatible storage?
• Does it work with our single sign-on?
• Can we trigger work from our own pipelines?

7. Doesn't lock you in

You should own your data and labels, be able to export them at any time, and be free to bring your own models. Large banks are understandably wary of building sticky dependencies into their AI stack.

Questions to ask:

• Who owns the labels, metadata and any models we train on your platform?
• Can we export everything in standard formats, at any time, without paying a fee?
• Can we use our own or open-weight models instead of yours?
• What happens to our data if we leave, and how quickly is it deleted?

Example workflow: from a pile of claim files to a tested model

To make this concrete, here's how an insurer might take a backlog of motor claims and turn it into a model that flags claims for fast-track settlement.

1. Connect the claims archive. The team links its existing cloud bucket of claim forms, adjuster notes and damage photos. Nothing is copied or moved, and new claims sync in as they arrive.
2. Filter and tidy. They tag files by claim type, region and year, remove duplicate submissions, and drop claims handled under an old process. The result is a versioned set of 5,000 claims ready for labelling.
3. Pre-label with AI. A model pulls out key fields such as policy number, incident date, estimated repair cost and whether liability was accepted, directly on the original forms and photos.
4. Expert review. Claims handlers check and correct each pre-label inside the original document. Complex injury claims are routed to a smaller group of senior handlers.
5. Check agreement. A sample of claims goes to three handlers independently. Where they disagree, a lead settles the case and the labelling guidelines are updated.
6. Freeze and train. The approved labels are saved as a fixed version, the model is trained and tested on it, and the full audit trail is exported for the model risk team.

Key takeaways

Banks and insurers already hold the data that could set their AI apart. What's usually missing is the work that turns stored files into labelled, checked and traceable training data.

• Storing documents well is a starting point. AI also needs to know what's in each file, whether it's labelled correctly, and where it came from.
• The five jobs are finding and organising data, protecting it, labelling it with experts, checking quality, and keeping a full history.
• Expert time is the most expensive part, so curate before you label and let AI handle the first pass.
• Regulators on both sides of the Atlantic expect a clear record of the data behind each model, and the EU AI Act's high-risk rules apply from December 2027.