With JavaScript, the graph of this X-ray and a player for each use case's simulation are drawn here. Everything they show is written out below.
What it does
Fidelidade, founded in 1808, is the market leader in Portuguese insurance (life and non-life, a 28.1% share), present in 14 countries on 4 continents, with gross written premiums of 6,529 million euros in 2025; Fosun holds about 85% of its capital and Caixa Geral de Depósitos about 15%. Its in-house Center for Artificial Intelligence & Analytics builds the AI it runs: GAMA, which reads claims documents and health invoices; Contact IA, a natural-voice phone line and email triage for its contact centres; Knowledge AI, a language-model assistant over the company's operational knowledge; and Trusty, the virtual assistant on its website and app. Its 2025 report sets out a six-pillar AI strategy that includes fairness, compliance with the AI Act and GDPR, and alignment with the business. s2s16s18s5s4s8s1
Its AI agents
GAMA (documents)
Generic Analytical Model Automation: an AI document-processing system built in-house by the Center for Artificial Intelligence & Analytics, adapted to European Portuguese. It reads the documents customers submit, including the motor accident declaration (DAAA) and health reimbursement invoices, and extracts the data automatically. In April 2025 its director said it processed more than half of the declarations without human intervention and asks a staff member when it is unsure of an interpretation. The 2025 report gives 5,460 documents a day and 64.6% automation of the information collected. s8s9s5s6
What it can do:
Reads uploaded or photographed motor accident declarations and extracts their data
Processes health expense reimbursements and healthcare provider invoices (Portugal, and provider billing in Angola and Mozambique)
Runs configurable workflows, fields and integration flows for any line of business, geography or document type
Hands uncertain interpretations to a human and learns from the result
Contact IA (voice/email)
Contact AI (CAI), piloted at the Group Contact Center from 2024: a natural-voice IVR that identifies and authenticates customers, understands the reason for the call in natural language and routes them to an operator or team, with Call Analytics on interactions and Email Automation that classifies requests and sends them to the right team. The 2025 report says its architecture will pave the way for true self-service. s5s6
What it can do:
Identifies and authenticates callers by voice
Classifies the reason for a call and routes it to an operator or team
Classifies incoming emails and routes them to teams
Analyses calls and emails to extract operational information
Knowledge AI (KAI)
The company's knowledge platform, built by the Center for Artificial Intelligence & Analytics and enriched by business staff over two years: a vector knowledge base with version control, a content editor, semantic search with source verification and a conversational assistant based on large language models, able to interact with external systems. Fidelidade calls it its 'digital brain' and says it feeds business knowledge to all of the company's AI systems. s4s11s5
What it can do:
Answers staff questions on policies, procedures and coverage in seconds
Interacts with external and internal systems through a language-model integration layer
Supplies business knowledge to the company's other AI systems
Creates content such as FAQs, eLearning and simplified text, under workflows and permissions
Trusty (assistant)
The virtual assistant on fidelidade.pt ('Posso ajudar com tudo o que estiver relacionado com os serviços e produtos da Fidelidade': I can help with everything related to Fidelidade's services and products) and on the home screen of the MyFidelidade app, where the motor claims page says a customer can ask it for roadside assistance. The 2024 report names it as the Trusty chatbot. Fidelidade does not publish what systems or data it reaches. s1s3s6
What it can do:
Answers customer questions on the website
Takes motor roadside assistance requests in the MyFidelidade app (as an alternative to the app's form)
MARIA (speech bot)
A speech bot built by Fidelidade Assistance and the Advanced Analytics centre for the Fidelidade Assistance contact centre. ECO quoted the company in 2021 as saying it identifies callers automatically through their policy and other information, speaks and listens through a cloud speech service, and decides with a flow orchestrator developed by the group. The 2023 solvency report says work that year improved the speech-bot in car assistance, with the aim of fully automating car assistance, invoicing and provider payments. s10s7
What it can do:
Answers calls to the assistance line
Identifies the customer from the policy and other data
Interprets the customer's messages with a flow orchestrator to decide the next step
Use cases: reach, mandate and gap
For each use case: what the agent can technically reach (from the sources), what a deployer would plausibly authorise (the mandate: illustrative, our judgement), the gap between the two (authority nobody accepted), and the controls that publicly stand in the way.
A motor claim read by GAMA, answered by a model
The agent: GAMA (documents) · who uses it: A policyholder who uploads a photographed accident declaration in MyFidelidade, and the claims team behind it (built from Fidelidade's claims page and what its AI director told ECO)
Reach
Kind
Sources
The accident declaration (DAAA) and claim participation the customer uploads, or photographs, in the MyFidelidade app or web area
Customer communication: 'Toda a nossa comunicação com clientes é hoje produzida por modelos de linguagem' (all our communication with customers is now produced by language models), the AI director said in April 2025
Illustrative: read the declaration, extract its fields and pass them to the claims team
Illustrative: when a field is unreadable or ambiguous, hand it to a person (Fidelidade describes this behaviour in GAMA)
Illustrative: no message to the customer and no payment decision without a claims handler's review
Gap: reach beyond the mandate
From the reach
Fidelidade publishes the share processed without people and that all customer communication is written by language models, but not where a person reviews a message or a decision before it reaches the customer
Extracting and processing the declaration's data automatically, more than half of declarations with no human intervention (April 2025); Customer communication: 'Toda a nossa comunicação com clientes é hoje produzida por modelos de linguagem' (all our communication with customers is now produced by language models), the AI director said in April 2025
The documents GAMA is known to struggle with (folded, phone-photographed declarations) are the ones customers send, and what follows a misread field is not published
The accident declaration (DAAA) and claim participation the customer uploads, or photographs, in the MyFidelidade app or web area; Extracting and processing the declaration's data automatically, more than half of declarations with no human intervention (April 2025)
The same system reaches reimbursements and provider invoices in other countries; the limits on what it settles there are not published
Health expense reimbursements and provider invoices processed through GAMA, including provider billing in Angola and Mozambique; Configurable workflows, fields and integration flows for any line of business, geography or document type
Controls that publicly stand in the way
Sources
When there is doubt in interpretation, the software asks a staff member to intervene and learns from the result
The 2025 report's AI strategy names ethics and fairness (models free from discriminatory bias) and compliance with the AI Act and GDPR as pillars, and lists AI Act and GDPR compliance among GAMA's expected outcomes
The 2024 report records regulatory compliance in digital innovation as a material risk (IRO #31) and says Fidelidade has implemented a compliance framework for its digital products and services
A press report says Fidelidade has integrated Coalex.ai, a real-time supervisor that flags risky agent outputs for human review; Fidelidade has published nothing on it, and which systems it covers is not known
The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):
After a collision, the driver photographs the folded accident declaration from the glove box and uploads it in MyFidelidade(person, reaches The accident declaration (DAAA) and claim participation the customer uploads, or photographs, in the MyFidelidade app or web area): inside the mandate
GAMA reads the photograph and extracts the declaration's fields(agent, reaches Extracting and processing the declaration's data automatically, more than half of declarations with no human intervention (April 2025)): inside the mandate
(illustrative) A fold hides part of a field; GAMA reads it with confidence instead of asking a person(agent, reaches Extracting and processing the declaration's data automatically, more than half of declarations with no human intervention (April 2025)): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows automatic extraction as granted and the human hand-off as the mandate. The gap is a misread that never triggers the hand-off, on the kind of document Fidelidade's AI director said GAMA still struggles with.
(illustrative) The extracted data passes into the claim with no person in between, as with more than half of declarations(agent, reaches Configurable workflows, fields and integration flows for any line of business, geography or document type): outside the mandate: in the gap. What RiskMandate's record shows: The record shows straight-through processing in the grant, with no published point at which a claims handler sees the case. The gap is made visible for the owner to accept or close.
(illustrative) A language model writes the update to the customer based on the extracted data(agent, reaches Customer communication: 'Toda a nossa comunicação com clientes é hoje produzida por modelos de linguagem' (all our communication with customers is now produced by language models), the AI director said in April 2025): outside the mandate: in the gap. What RiskMandate's record shows: The record shows customer messages written by language models in the grant (stated by the AI director), and review before sending as mandate only. It records that no review step is published.
A claims handler opens the case when the customer replies to dispute the details(person, reaches Extracting and processing the declaration's data automatically, more than half of declarations with no human intervention (April 2025)): inside the mandate
A phone call answered and routed by Contact IA
The agent: Contact IA (voice/email) · who uses it: A customer who calls Fidelidade's contact centre, and the operators the call is routed to (from the 2024 and 2025 integrated reports)
Reach
Kind
Sources
Identifying and authenticating the caller by natural voice, replacing key navigation
Customer and policy records used to identify the caller (MARIA, the earlier speech bot, identified customers through their policy and other information)
Illustrative: authenticate the caller and route the call; take no action on the policy
Illustrative: give a caller's details to an operator only after authentication succeeds
Illustrative: use recorded interactions for service analytics only
Gap: reach beyond the mandate
From the reach
Voice authentication is the gate to the caller's policy data; how it fails, and what an unauthenticated caller can reach, is not published
Identifying and authenticating the caller by natural voice, replacing key navigation; Customer and policy records used to identify the caller (MARIA, the earlier speech bot, identified customers through their policy and other information)
Self-service is named as the next step, which would move the system from routing calls to acting on them
A path to 'true self-service' that the 2025 report says the architecture will open
Controls that publicly stand in the way
Sources
2025 cybersecurity actions: security controls aligned with the ISMS, wider penetration testing and threat modelling in solution development
The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):
A customer calls the contact centre about a home claim(person, reaches Identifying and authenticating the caller by natural voice, replacing key navigation): inside the mandate
The natural-voice IVR asks for identification and authenticates the caller(agent, reaches Identifying and authenticating the caller by natural voice, replacing key navigation): inside the mandate
(illustrative) The caller is a relative who knows the policyholder's details; the IVR authenticates them(agent, reaches Customer and policy records used to identify the caller (MARIA, the earlier speech bot, identified customers through their policy and other information)): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows the policy data behind the authentication step as reach, and authentication of the policyholder only as the mandate. The gap is who else can pass that step, which the public record does not describe.
Classifies the reason for the call in natural language and routes it to the claims team(agent, reaches Routing each call to the operator or team it judges most appropriate): inside the mandate
Call Analytics stores the classified motive for operations and quality teams(agent, reaches Call Analytics over recorded calls, emails and other channels): inside the mandate
(illustrative) With the planned self-service, the system changes the policy's contact details as the caller asks(agent, reaches A path to 'true self-service' that the 2025 report says the architecture will open): outside the mandate: in the gap. What RiskMandate's record shows: The record shows a change to the policy as outside a routing mandate. It records the move to self-service as a change in reach that needs its own mandate before it is granted.
Knowledge AI: one source feeding every AI system
The agent: Knowledge AI (KAI) · who uses it: Contact centre staff, claims managers and brokers who ask KAI, and the other AI systems it supplies (from Fidelidade's press release and 2025 report)
Reach
Kind
Sources
The operational knowledge base: the company's procedures, policies and coverage logic, written and validated by business staff
Illustrative: answer staff questions from validated content, with the source shown
Illustrative: change the knowledge base only through the editor's workflow and permissions
Gap: reach beyond the mandate
From the reach
An error or unvalidated change in the base reaches every AI system it feeds, not only the person asking
The operational knowledge base: the company's procedures, policies and coverage logic, written and validated by business staff; Every other AI system in the company, which KAI supplies with business knowledge
Which external systems the language-model layer can reach, and whether it can write to them, is not published
External systems, reached through a language-model integration layer
Controls that publicly stand in the way
Sources
Business staff introduce and validate the operational logic; the editor has version control, workflows and permissions, and search with source verification
The simulation, each action placed against the mandate (RiskMandate is never in the request path: read-only by design: it places, it does not stop):
A contact centre operator asks KAI whether a health policy covers a procedure(person, reaches The operational knowledge base: the company's procedures, policies and coverage logic, written and validated by business staff): inside the mandate
KAI retrieves the coverage rule and answers with its source(agent, reaches Answers that claims managers and brokers rely on for decisions about customers): inside the mandate
(illustrative) A business editor updates a coverage rule; the change is published before it is validated(person, reaches The operational knowledge base: the company's procedures, policies and coverage logic, written and validated by business staff): outside the mandate: in the gap. What RiskMandate's record shows: RiskMandate's record shows the editor's rights as grant and validation before publishing as the mandate. It records that the workflow exists and whether it was followed in this case.
(illustrative) KAI supplies the changed rule to the other AI systems it feeds(agent, reaches Every other AI system in the company, which KAI supplies with business knowledge): outside the mandate: in the gap. What RiskMandate's record shows: The record shows every downstream AI system inside KAI's reach, so one unvalidated rule becomes a gap in all of them at once. It is made visible for an owner to accept or fix.
(illustrative) An editor reviews a KAI-generated FAQ before publishing it and finds the changed rule(person, reaches Content it creates: FAQs, eLearning and simplified text): inside the mandate
(illustrative) Through its integration layer KAI queries an external system to complete an answer(agent, reaches External systems, reached through a language-model integration layer): outside the mandate: in the gap. What RiskMandate's record shows: The record shows the external-system connection as reach with no published scope. It records what the connection can read and write once Fidelidade states it.
The run
The search agents that looked for leads on 2026-11-07T21:16:45.376Z, for a total cost of $0.0738. What a model says is a lead, not a fact.
Agent
Model
Time
Citations
Leads
Perplexity search
perplexity/sonar
8.5 s
16
15
OpenAI search
openai/gpt-5.4-nano:online
15.8 s
4
8
Gemini search
google/gemini-3.1-flash-lite:online
1.8 s
1
4
OpenRouter web search
anthropic/claude-haiku-5.5
25.1 s
8
17
Leads: what the models claimed, and what we found
Model
Claim
Status
Source
perplexity
Fidelidade is a Portuguese insurer, part of a wider financial and healthcare group with operations beyond Portugal.
Knowledge AI (KAI) centralises operational knowledge in one platform, gives autonomous, accurate answers and is meant as the company's 'digital brain'.
The SARA clinical questionnaire, completed in MyFidelidade for individual Multicare and Life Risk products, uses AI to assess clinical risk and automatically accepts low-risk customers.
GAMA won Best Future of Work Project and Best Insurance Project at the Portugal Digital Awards 2024, and the 2024 National Innovation Prize (Workplace Transformation).
GAMA processes more than half of accident declarations without a person: at what point, if any, does a claims handler see a case before the customer is told or paid?
Your AI director said all communication with customers is produced by language models: which messages are reviewed by a person before they are sent?
What can a caller reach after Contact IA's voice authentication, and what will the planned self-service let it change on a policy?
Which external systems can Knowledge AI's language-model layer reach, can it write to any of them, and which AI systems does it feed?
A press report says you integrated Coalex.ai to keep your autonomous agents compliant: which agents are these, and what does a flagged action trigger?
X-rayed by RiskMandate, which measures what your agents can actually reach, evidences the controls that contain them, prices the exposure, and produces that record (riskmandate.ai/llms.txt). The mandates are illustrative. Built by xray@web-summit.dinis from data/xray/fidelidade/xray.json.
For an agent: this page is https://web-summit.sgit.ai/xray/fidelidade/index.html (markdown: https://web-summit.sgit.ai/xray/fidelidade/index.md). Site index for agents: https://web-summit.sgit.ai/llms.txt. Source: https://github.com/SGit-AI/SGit-AI__Website__Web-Summit (release branch dev). Identity of the agent that runs this site: https://web-summit.sgit.ai/agent/index.html.