Physical climate & natural-catastrophe risk assessment for assets & portfolios

Floods, storms, hail, wildfire, heat and drought are damaging more buildings, plants and loan collateral, and regulators now expect firms to quantify this forward-looking risk per location. AI and catastrophe-model software combine downscaled climate scenarios, hazard maps, satellite and terrain data and building attributes to give each address a risk score and an expected loss, aggregated across the portfolio. It supports underwriting and accumulation control, collateral valuation, supervisory stress tests, CSRD/ESRS disclosure and municipal adaptation planning.

Problem & value

• Today: insurers rely on postcode or zone-based pricing and legacy cat models; banks and property owners often hold only an address list and a few flood-zone lookups; corporates must answer physical-risk questions from lenders, insurers and auditors without a method. Climate change moves hazard distributions, so historic loss records alone under-state future risk.
• Context: the EU's first European Climate Risk Assessment (EUCRA, 2024) states that Europe is the fastest-warming continent and that many climate risks, including to infrastructure and financial stability, have already reached critical levels [3].
• AI value: consistent per-asset scoring for thousands to millions of locations, scenario and horizon comparison, ML-based downscaling and vulnerability calibration against claims, and LLM assistance that turns model output into disclosure text and answers auditor questions.
• Regulatory pull: CSRD/ESRS E1 (physical risk and adaptation), the EU Taxonomy "do no significant harm" climate-risk assessment, ECB/EBA/EIOPA supervisory expectations and stress tests, and Solvency II own-risk and solvency assessment (ORSA) all call for forward-looking physical-risk analysis. The scope of CSRD reporting is being reduced and simplified by the EU "omnibus" process (simplified ESRS in preparation at EFRAG [4]), so confirm which duties apply to your firm; the lender and insurer demand for the data persists regardless.
• No universal benefit figure exists; value is measured against own loss ratios, pricing adequacy and avoided concentration, so treat vendor claims as unverified until back-tested.

Variants

• Insurance: property/engineering underwriting, accumulation control, reinsurance purchasing, parametric trigger design. Residential pricing overlaps with PRED-010.
• Banking: collateral and mortgage physical-risk flags, climate stress testing, sectoral portfolio heat maps; links to valuation in PRED-015.
• Corporates / SMB: site-level risk for plants, warehouses, shops and supply-chain nodes, used for insurance negotiation, business-continuity planning and ESRS E1 disclosure.
• Real estate and infrastructure funds: asset-level climate value-at-risk, retrofit and adaptation prioritisation (see PRED-048 for energy, PRED-046 for structural monitoring).
• Public sector / municipalities: city heat, pluvial-flood and drought hot-spot mapping, adaptation investment planning, risk communication to citizens.
• Private: address-level flood/heat look-ups from national portals or insurers when buying, renting or insuring a home (self-service, informational only).
• Merged candidates: the research sweep listed this scope under several wordings (industry healthcare, hyperscaler and research catalogues); all describe the same pipeline and are covered here. Healthcare is simply a site-risk portfolio (hospitals, clinics) and needs no separate method.

How it works

1. asset register (address/coordinates, type, value)
2. geocoding & exposure enrichment
3. hazard layers (flood, wind, hail, wildfire, heat, drought, subsidence) per scenario & horizon
4. vulnerability / damage functions (building type, elevation, construction year)
5. loss calculation (event sets, Monte Carlo)
6. expected annual loss, loss curves
7. portfolio aggregation (accumulation, PML, climate VaR)
8. disclosure & decision outputs
9. expert review, back-test against claims, documented assumptions

• Hazard layer: physical simulation and statistical models (hydraulic flood models, tropical and extratropical storm sets, wildfire spread), increasingly supplemented by ML-based emulators and AI weather/climate foundation models for downscaling and fast scenario runs.
• Exposure enrichment: geocoding, building footprints, remote-sensing models and VLMs read elevation, roof type, basements or vegetation from imagery to fill missing attributes.
• Loss layer: vulnerability curves and gradient-boosting models calibrated on claims.
• LLM layer: drafts disclosure text, queries the results through a tool-calling agent and explains scores; it never computes losses itself.
• Human-in-the-loop: risk engineers approve scenario choices, vulnerability assumptions and overrides; underwriting and credit decisions stay with named humans.

Data preparation

Needed are asset lists with exact addresses or coordinates, construction year, use, values and sums insured, plus external hazard maps, climate projections, elevation and building footprints, and historic loss data. Internally these sit in ERP or real-estate systems, policy and collateral systems, facility lists in Excel, and scanned property documents.

Typical gaps: addresses that cannot be geocoded, missing coordinates or construction years, duplicate sites after mergers, values outdated, building characteristics only in PDFs, and unclear licences for hazard data.

Concrete steps: consolidate the asset register from all systems (PREP-005, PREP-003); tidy spreadsheets (PREP-011); geocode and deduplicate addresses; extract building attributes from scanned documents with OCR and an LLM (PREP-006, DOC-018); define metrics and scenario definitions in a glossary (PREP-012); harvest claims history as validation labels (PREP-020). Tools: a geocoding service, QGIS or PostGIS, Python. Expect roughly 30-40 % of effort. See GUIDE-003.

Implementation paths

Which path for whom

• smb: A - certified climate-risk and hazard-score services with address lookup exist at SMB prices, and the use (disclosure, site screening) is standard.
• enterprise: B - insurers, banks and large owners need to combine hazard data with their own exposure, claims and collateral data and embed results in risk models, which a closed tool rarely allows.
• public: B - municipalities build on sovereign EU/German cloud with public hazard and climate data to meet procurement and sovereignty requirements.
• developer: C - open climate datasets and open-source hazard and geospatial tooling run on HW2 and give full transparency of the model chain.

Path A — Buy (recommended for most firms)

• Cat-model and location-risk platforms: Munich Re Location Risk Intelligence (DE), Swiss Re CatNet (CH), Moody's RMS (including the former Four Twenty Seven climate analytics), Verisk, Jupiter Intelligence, Climate X (UK), plus ESG-data suites such as MSCI Climate and S&P Global (Trucost) for investors. Flood specialists: Fathom (UK) offers global flood maps, risk scores and a flood cat model for any climate scenario to 2100 [5]; JBA Risk Management (UK) offers global flood maps and climate-risk analytics [6]. In Germany, insurers use the GDV's ZÜRS Geo hazard zoning for flood, heavy rain and storm.
• Choose A when: you need defensible, regulator-recognised output within weeks, have fewer than a few hundred thousand locations and lack in-house cat-modelling staff.
• Check: scenario coverage (SSPs, horizons), resolution in your geography, data licensing for disclosure use, documentation for model validation, EU hosting and API/batch access.

Path B — Build on cloud APIs

• Data and hazard feeds: Copernicus Climate Data Store (C3S) with its API and earthkit tools for reanalysis and climate projections [7]; ECMWF's Destination Earth Climate Change Adaptation digital twin as it comes online (the programme lists climate digital-twin updates through September 2026) [2]; hazard APIs of the vendors above.
• Compute: batch jobs on an EU cloud region; geospatial stack (GeoPandas, xarray, H3 or similar), ML with LightGBM or a tabular foundation model for loss calibration.
• LLM layer: a frontier model on an EU region with tool calls into the loss engine for explanations and disclosure drafts, with structured outputs and source citations.
• Choose B when: you need custom indices (for example customer-specific damage functions) but have no data-sovereignty constraint on asset addresses.

Path C — Self-host (open source)

• CLIMADA (ETH Zurich, GPL-3.0): open framework for climate risk and adaptation appraisal with hazard modules (e.g. tropical cyclones) and a data API covering global hazards at about 4x4 km; the current release on GitHub is v6.1.0 [1][8].
• physrisk (OS-Climate, now moving under FINOS governance; Apache-2.0): bottom-up engine for large numbers of assets, with hazard indicators from CMIP/CORDEX and public sources and vulnerability models; installable with pip install physrisk-lib [9].
• Further open tools: Oasis Loss Modelling Framework for open cat-model execution, plus the LISFLOOD/GloFAS flood models of the EU's Copernicus Emergency Management Service.
• Hardware: HW2 is enough for scoring up to millions of assets from precomputed hazard rasters; storing hazard rasters needs terabytes of disk; HW3/HW4 is only needed for running own hydraulic or ML downscaling models. Operating effort is high because hazard data needs refreshing.

Path D — Custom training

Worth it for insurers and banks with large claims histories: train damage and vulnerability models on claims plus hazard intensity (gradient boosting, calibrated GLMs), ML downscaling or emulators of regional climate models, and CNN/transformer models on imagery for building attributes. Needs several years of geocoded claims and exposure data and cat-modelling or climate-science staff. Always keep a physical cat model as benchmark; do not replace it with a black box.

State of the art (2026)

• Cat models plus climate scenarios are now standard commercial products: flood, tropical and extratropical cyclone, hail, wildfire and heat at address level under SSP scenarios [5][6].
• AI weather and climate models (see PRED-017) provide faster ensembles; Destination Earth builds km-scale climate simulations with several coupled models (ICON, IFS-FESOM, IFS-NEMO) and delivers impact-sector data [2].
• Open tooling matured: CLIMADA v6.x and physrisk offer reproducible, auditable pipelines that financial institutions can adopt without licence fees [1][9].
• Limits and failure modes: climate-model uncertainty grows with horizon; hazard maps differ strongly between vendors for the same address, so use multiple sources and show ranges. Resolution may miss local flood defences, drainage and building-level adaptation. Compound events and secondary perils (hail, convective storm, subsidence, wildfire in Europe) are weakly modelled. Tail risks and tipping points are not captured. Scores must not be presented as forecasts of single events. Missing or wrongly geocoded addresses are the commonest data error.

Shared resources & combinations

• Same building blocks (simulation + scientific-fm + remote-sensing + tabular-ml): PRED-017 (weather AI and forecast data), PRED-027 (flood forecasting and early warning, same hydrology data), SCI-010 (climate modelling), PRED-042 (air quality) share ERA5/Copernicus data pipelines and GPU-based geospatial inference.
• Downstream decisions: PRED-010 (insurance pricing and underwriting), PRED-015 (property valuation, climate-adjusted), PRED-009 (credit risk with collateral flags), PRED-048 (energy retrofit roadmaps, same building data), PRED-046 (structural monitoring).
• Reporting: DATA-012 (CSRD data collection and reporting), LANG-037 (investor ESG, EU Taxonomy and SFDR analytics) consume the asset-level scores.
• Shared infrastructure: one geospatial data lake (hazard rasters, building footprints, elevation), a geocoding service and an HW2/HW3 GPU node serve all of these use cases.

Effort, cost & KPIs

• Path A: weeks to a few months to onboard; licence typically priced by number of locations, hazards and data volume, or by API calls.
• Path B: 3-6 months for a production pipeline with data governance and validation.
• Path C: 6-12 months including hazard-data operations and model validation; mainly staff cost.
• Path D: 12+ months, specialised team, years of claims history.
• KPIs: geocoding match rate, share of portfolio scored, back-test calibration against realised losses (loss ratio by risk band), agreement between vendors, accumulation hot spots identified and mitigated, time to produce disclosures or stress-test submissions.

People & change

Involve management (strategy, disclosure obligations), the department lead for risk, underwriting or facility management, IT and the owners of asset and policy data, and legal/compliance for ESRS, taxonomy and supervisory expectations. Data and model vendors are partners; check their methodology documentation and exit options (GUIDE-010).

Works council: normally no under §87(1) no. 6 BetrVG, as the system assesses assets and not staff; inform it under §90(1) no. 3 if underwriting or planning work processes change. Personal data: addresses of private homeowners or tenants in insurance and credit portfolios are personal, so involve the DPO, sign an AVV with every data provider and check whether a DPIA is needed; for corporate sites usually not.

AI literacy: support staff with training on scenario uncertainty and the difference between hazard, exposure and loss (GUIDE-006). Pilot on one portfolio or region and compare with existing assessments. Typical concern: "false precision" - present ranges and scenario spreads and let experts override scores, documenting reasons. See GUIDE-008 and GUIDE-009.

Risks, regulation & compliance

• EU AI Act: depends on use. Scoring property, plant and municipal assets is generally not an Annex III category (minimal risk). Risk assessment and pricing for natural persons in life and health insurance, and creditworthiness scoring of natural persons, are Annex III high-risk (point 5); a flood score used as an input to a consumer credit or personal insurance decision can bring the whole system in scope [10]. Art. 4 AI literacy applies throughout.
• GDPR: addresses of private homes are personal data when linked to a person; a risk score per household needs a legal basis, transparency, and Art. 22 safeguards if decisions are automated. Aggregation to postcode or grid level reduces exposure. Corporate sites are mostly non-personal.
• Sector law: Solvency II/ORSA and EIOPA expectations (insurers), CRR/CRD and EBA ESG-risk guidelines plus ECB climate expectations (banks), DORA for ICT third-party risk when using vendors, CSRD/ESRS E1 and EU Taxonomy DNSH for disclosure. Model-risk management (validation, documentation) applies to internal models.
• Social risk: risk scores can cause redlining or loss of insurance and credit for flood-prone neighbourhoods; use affordability and fairness reviews and clear communication.
• Mitigations: multi-source hazard data, uncertainty ranges, back-testing, human sign-off, versioned scenarios and assumptions, audit trail from data to disclosure.

Getting started

1. Clean your asset register: geocode all locations, add construction year, use, value, elevation.
2. Pick scenarios and horizons required by your regulator or lender (e.g. SSP2-4.5 and SSP5-8.5, 2030/2050) and agree the hazard list with risk and finance teams.
3. Pilot one commercial provider and one open tool (CLIMADA or physrisk) on 1,000 locations and compare scores for a sample of known loss sites.
4. Back-test against your own claims or incident history; document the vulnerability assumptions.
5. Automate the pipeline, connect results to underwriting, credit or CSRD reporting, and review annually.

Sources

1. CLIMADA project (ETH Zurich) — https://github.com/CLIMADA-project/climada_python
2. ECMWF Destination Earth — https://destine.ecmwf.int/
3. European Environment Agency — European Climate Risk Assessment (EUCRA) — https://climate-adapt.eea.europa.eu/en/metadata/publications/european-climate-risk-assessment
4. EFRAG — Sustainability reporting and simplified ESRS — https://www.efrag.org/en/sustainability-reporting
5. Fathom — global flood maps and cat model — https://www.fathom.global/
6. JBA Risk Management — flood maps and climate risk analytics — https://www.jbarisk.com/
7. Copernicus Climate Data Store — https://cds.climate.copernicus.eu/
8. CLIMADA releases (v6.1.0) — https://github.com/CLIMADA-project/climada_python/releases
9. OS-Climate physrisk — https://github.com/os-climate/physrisk
10. Regulation (EU) 2024/1689 (AI Act) — https://eur-lex.europa.eu/eli/reg/2024/1689/oj