← All posts

Industry Verticals

227 posts on industry verticals.

B2B SaaS with AI Features: How Enterprise Security Reviews Now Block the Deal

B2B SaaS vendors that added AI features in the last twelve months are now meeting an enterprise security review process that did not exist when the product was scoped. Buyers ask about identity context at the model API call, per-decision audit records, prompt-level data classification, and the deployment regime under the EU AI Act. Sales cycles stall on questions the engineering team did not anticipate. This piece walks through what enterprise security reviews now ask of SaaS-with-AI vendors, where most product architectures are exposed, and the inspection layer that closes the gap before procurement does.

b2b-saasai-compliancesecurity-revieweu-ai-actenterpriseaudit
Read post →

AI Credit Scoring Under Annex III Point 5(b): What High-Risk Classification Requires of Banks

Annex III point 5(b) of the EU AI Act classifies AI used to evaluate the creditworthiness of natural persons or establish a credit score as high-risk. From August 2, 2026 the deployer obligations under Article 26 and the provider obligations under Articles 8 through 17 apply. The text exempts AI used only for the detection of financial fraud. Most bank credit deployments today combine scoring, fraud detection, and bureau enrichment in a single pipeline that triggers high-risk classification end-to-end. This piece walks through what the classification means, where bank pipelines blur the fraud-vs-scoring line, and the architecture that produces audit records the supervisor will accept.

eu-ai-actcredit-scoringbankingai-complianceauditannex-iii
Read post →

Finance AI and Pre-Announcement Earnings Exposure: How AI Tools Create MNPI Leakage

Pre-announcement earnings exposure inside finance teams now flows through AI tools that finance teams use for drafting, modeling, and summarization. The exposure is functionally a material non-public information leak when an employee pastes a draft press release, a working forecast, or a board-pack excerpt into an unauthorized AI tool. SEC Regulation FD, insider trading regimes, and individual market-abuse regulations in the EU and the UK reach the conduct regardless of whether the leak was intentional. This piece walks through where the AI exposure sits inside the financial close and earnings preparation cycle, what controls regulators expect, and the inspection architecture that prevents MNPI from leaving the perimeter.

mnpireg-fdfinanceai-securityshadow-aimarket-abuse
Read post →

AI in OT Environments: What IEC 62443 and NIS2 Require When LLMs Touch Industrial Control Systems

Manufacturing OT environments now host AI tools for predictive maintenance, anomaly detection, work-instruction generation, quality inspection, and operator copilots. The AI calls cross zones that IEC 62443 was designed to segment and bring NIS2 incident reporting and supply chain obligations into the operational technology footprint. Most OT deployments use AI through cloud APIs that violate the segmentation assumptions of the IEC 62443 reference model. This piece walks through where AI sits in modern OT, what IEC 62443 and NIS2 require for the AI traffic, and the inspection architecture that produces records the regulator and the customer auditor will accept.

ot-securitymanufacturingiec-62443nis2ai-securityindustrial-control
Read post →

AI Security for Legal Discovery: The Identity, Privilege, and Audit Controls a Production Deployment Has To Run

Legal discovery copilots read into the document repository, the case management system, and the email archive. The data the copilot reads at request time crosses attorney-client privilege, work-product doctrine, and the protective-order terms specific to each matter. This piece walks through the identity-aware policy decisions a legal discovery deployment has to commit at the request boundary, the audit record format that survives Rule 26 disclosure and a privilege challenge, and the architectural pattern that closes the gap.

legal-discoveryattorney-client-privilegework-productai-securityidentity-awareaudit-logs
Read post →

AI Security for HR Recruiting: The Identity, Bias, and Audit Controls a Production Deployment Has To Run

HR recruiting copilots reach across the ATS, the resume corpus, the assessment vendor data, and the interview transcripts. The decisions the copilot supports fall inside the EU AI Act Annex III high-risk classification for employment, the EEOC enforcement perimeter, and state employment-screening statutes like NYC LL 144 and Illinois AIVIA. This piece walks through the identity-aware policy decisions an HR recruiting deployment has to commit at the request boundary, the audit record format that survives an EEOC complaint and an EU AI Act review, and the architectural pattern that closes the gap.

hr-recruitingeu-ai-act-annex-iiieeocnyc-ll-144ai-securityaudit-logs
Read post →

AI Security for Finance Back Office: The Identity, Data, and Audit Controls a Production Deployment Has To Run

Finance back-office copilots reach across the GL, the close calendar, the vendor master, and the pre-announcement earnings detail. The data the copilot reads at request time crosses MNPI thresholds, vendor confidentiality contracts, and SOX 302 attestation territory. This piece walks through the identity-aware policy decisions a finance back-office deployment has to commit at the request boundary, the audit record format that survives SOX and SEC review, and the architectural pattern that closes the gap.

finance-back-officemnpisoxai-securityidentity-awareaudit-logs
Read post →

Shadow AI for Healthcare: PHI, HIPAA, and the BAA Gap

Cloud Radix found that 57% of healthcare professionals use unauthorized AI tools to process PHI - SOAP notes, diagnostic plans, prior authorization summaries - without a Business Associate Agreement in place. The Office for Civil Rights treats unauthorized PHI disclosure as a HIPAA violation regardless of intent. This piece walks through how shadow AI shows up in clinical settings, why traditional DLP fails to catch it, and what the architecture for HIPAA-compliant AI usage actually requires.

shadow-aihealthcarehipaaphicomplianceai-security
Read post →

Shadow AI for Finance: MNPI, DORA, and the Audit Gap

Financial services firms face a compounding shadow AI exposure: material non-public information moving into unauthorized models, DORA Article 28 third-party AI risk obligations, and SEC enforcement under existing books-and-records rules. The historical DLP and surveillance stack was built for email and chat, not for AI prompts. This piece walks through how shadow AI surfaces in trading, research, and operations, and what the architectural fix actually requires under DORA, SR 11-7, and the EU AI Act.

shadow-aifinancedoramnpicomplianceai-security
Read post →

Shadow AI for Legal: Privilege, Confidentiality, and the ABA Opinion 512

Law firms and in-house legal teams face a sharper version of the shadow AI problem. Client confidences pasted into a model can break attorney-client privilege under the inadvertent disclosure doctrine. ABA Formal Opinion 512, issued in July 2024, sets out the duties of competence, confidentiality, and supervision that apply to lawyer use of generative AI. This piece walks through where shadow AI surfaces in legal work, what Opinion 512 actually requires, and what the architectural fix looks like.

shadow-ailegalprivilegeconfidentialityabaai-security
Read post →

Shadow AI for Government: FedRAMP, CUI, and the OMB M-24-10 Mandate

Federal agencies and government contractors face a shadow AI exposure that compounds across FedRAMP boundary controls, CUI protection under NIST SP 800-171, and the OMB M-24-10 AI governance memo. Pasting controlled unclassified information into a non-FedRAMP-authorized model violates the boundary by definition. This piece walks through where shadow AI surfaces in agency work, what M-24-10 actually requires, and what the architecture for compliant AI use looks like.

shadow-aigovernmentfedrampcuiombai-security
Read post →

Colorado SB 26-189: Why HIPAA-Covered AI Deployers Lost Their Exemption

On May 14, 2026, Governor Jared Polis signed SB 26-189 into law, scaling back the Colorado AI Act ahead of its February 2026 effective date. The revised statute drops the broad HIPAA covered-entity exemption that the original act carried and replaces it with a narrower carve-out tied to a specific "consequential decision" test. Clinical AI deployers in Colorado who assumed they were out of scope now have to map the systems that influence diagnosis, treatment selection, or coverage decisions against the new criteria. The effective date moves to January 1, 2027, with a 60-day Attorney General cure period. This article walks through what changed, which clinical AI systems pick up new obligations, and the per-decision evidence the new regime will expect.

colorado-ai-acthealthcare-aihipaastate-regulationclinical-aicompliance
Read post →