Governance

Financial institutions deploying AI must apply privacy and safeguards obligations to every AI component that touches nonpublic personal information. This guide covers data limits in prompts and retrieval, service provider oversight of AI vendors, security program controls for AI, risk assessments, notices, and incident response.

AI vendors and model providers that process protected health information are business associates, and the agreement must be in place before PHI reaches them. This guide covers when a BAA is required, what it must cover, model provider tiers and configuration, subcontractor flow-down, safeguards, and the mistakes that create violations.

DORA makes operational resilience a supervised obligation for financial entities, and AI systems and their providers sit squarely inside it. This guide covers third-party oversight, testing, and the register duties.

ESG disclosure obligations reach AI in two directions: AI systems consume energy that may need reporting, and AI helps produce disclosures that must be assurance-ready. This guide covers both.

AI incidents do not map neatly onto existing insurance categories, which leaves gaps organisations find at claim time. This guide covers which policies respond, common exclusions, and what to check now.

NIS2 raises cybersecurity obligations for essential and important entities, and AI systems sit inside that scope. This guide covers risk management measures, supply chain duties, and the reporting timelines.

AI interfaces create accessibility questions that traditional pages do not, from streaming output to unlabelled dynamic content. This guide covers what conformance requires and where AI helps rather than hinders.

CLIA governs laboratory testing on human specimens, and AI systems that influence results enter that scope. This guide covers where AI fits, what validation involves, and how to keep the reporting judgement qualified.

Children's privacy rules reach AI systems that knowingly collect data from children, and AI makes age signals both easier to detect and harder to ignore. This guide covers what applies and how to design for it.

Copyright questions around AI remain unsettled in several respects, which makes practical risk reduction more useful than a definitive answer. This guide covers training data, output similarity, and ownership.

Employment law reaches AI through the decisions it influences rather than through the technology. This guide covers discrimination exposure, monitoring limits, notice duties, and the evidence that defends a decision.

Product liability increasingly reaches software and AI, which changes who answers when a system causes harm. This guide covers how defect concepts apply, what the EU regime changed, and what reduces exposure.

Trade secret protection depends on reasonable measures to keep information secret, and prompts sent to external services test that directly. This guide covers what to control and how to preserve protection.

Model risk frameworks in banking were built for models that can be specified and validated. AI systems strain that in specific ways. This guide covers what validation means for them and how to keep frameworks workable.

Whether AI software is a regulated medical device turns on its intended use and the clinician's ability to review the basis of its output. This guide covers the boundary, the pathways, and change control for learning systems.

GxP validation assumes systems behave consistently, which AI complicates. This guide covers a risk-based approach to qualifying AI systems, data integrity expectations, and how to handle model change in a validated state.

AI in investment services runs into suitability, best execution, and record-keeping obligations that were written for human processes. This guide covers where AI fits, where it does not, and what evidence is needed.

SOC 2 Type 2 tests whether controls operated effectively over a period, which makes AI systems an evidence problem rather than a design one. This guide covers the criteria they touch and what auditors examine.

Solvency II reaches AI in insurance through governance, risk management, and outsourcing requirements rather than through AI-specific rules. This guide covers where AI systems fit and what supervisors expect to see.

CMMC turns on where controlled unclassified information flows, which makes external model providers the central question for AI systems. This guide covers scope, the practical options, and the evidence assessors expect.

India's data protection legislation reaches AI systems through notice, consent, and fiduciary duties, with additional obligations for significant data fiduciaries. This guide covers what applies and what to design in.

Adding AI to a FedRAMP authorised service raises hard boundary and dependency questions, particularly where a model runs outside the authorisation. This guide covers what to decide early and where programmes stall.

HITRUST certification is a common requirement for handling health data, and adding an AI system to a certified scope raises specific questions. This guide covers scope, inherited controls, and what assessors ask about.

AI systems fit an established ISMS more easily than teams expect, provided scope, supplier relationships, and new risk types are handled explicitly. This guide covers what changes and what an auditor will ask.