← All posts

Industry Verticals

227 posts on industry verticals.

Protecting Attorney-Client Privilege When Lawyers Use AI: Control the Disclosure, Keep the Record

When a lawyer pastes privileged material into an external AI tool, the concern is disclosure to a third party and the risk that raises to attorney-client privilege and work-product protection. Privilege determinations belong to courts and counsel. What a firm controls is which privileged content reaches which model endpoint, and whether there is a record of it. Both are decisions on the AI request path.

legal-aiattorney-client-privilegeai-egressai-audit-traildata-protection
Read post →

AI Underwriting Under the EU AI Act: Life and Health Pricing Is High-Risk

The EU AI Act names AI used for risk assessment and pricing in life and health insurance as high-risk under Annex III. That brings automatic logging, human oversight, and traceability duties to underwriting models. This article walks the obligations, separates the actuarial fairness work from the record-keeping work, and shows which duties a policy gateway produces evidence for on the AI request path.

eu-ai-actinsurance-aiunderwritinghigh-risk-aiai-audit-trail
Read post →

Medical Device AI and FDA Compliance

FDA oversight of AI-enabled medical device software keeps widening, yet the audit trail for the LLM calls clinical software makes over HTTP is usually missing. This walks through what FDA expects, where on-device inference sits outside the boundary, and how identity-bound policy plus per-decision records close the gap.

ai-compliancecomplianceregulationai-governanceauditai-security
Read post →

The SaaS Guide to AI Security Questionnaires

Enterprise buyers now send SaaS vendors AI-specific security questionnaires about how AI features are governed, logged, and attributed. This walks through what they ask, why promises fail an auditor, and the architecture that lets a vendor answer with evidence.

ai-securityai-governanceai-compliancecomplianceauditshadow-ai
Read post →

Pharma GxP AI Compliance: Part 11 Audit Trails for AI

GxP pharma workflows are wiring LLM calls into validated systems, but 21 CFR Part 11 audit-trail and ALCOA+ data-integrity expectations do not stop at the application log. This walks through where AI calls sit under Part 11 and how an external per-decision record supplies attributable, tamper-evident evidence.

ai-compliancecomplianceregulationauditai-governanceai-security
Read post →

Telehealth AI and HIPAA Compliance

Telehealth platforms are wiring AI into visit summaries, triage, and scribing, which pushes PHI into LLM prompts that network DLP cannot read. This walks through the HIPAA obligations at the AI call boundary and the identity-aware policy and per-decision records that satisfy them.

hipaaai-compliancecomplianceregulationai-governanceaudit
Read post →

Wealth Management AI and FINRA Compliance

Broker-dealers and RIAs are wiring AI into research, client communications, and portfolio workflows, but FINRA supervision and books-and-records duties attach to the output. This walks through the obligations and the per-decision records that supply supervisory evidence.

ai-compliancecomplianceregulationai-governanceauditai-security
Read post →

AI Security for Clinical Documentation: Governing the PHI That Reaches the Model

Ambient scribes and note-generation tools turn a clinical encounter into text by sending the transcript to an LLM over HTTP. That request carries protected health information out of the environment, and HIPAA holds the covered entity responsible for what happens to it. This walks the security patterns for clinical documentation AI: binding each call to a clinician identity, classifying PHI in the prompt, minimum-necessary enforcement at the request layer, and the per-decision audit record HIPAA audit controls expect.

hipaaai-securitycomplianceidentity-and-authorizationauditshadow-ai
Read post →

AI Security for Data Teams: Governing What Analysts Send to the Model

Data analysts and scientists use AI to write SQL, explain query results, and draft analysis, which means schemas, sample rows, and sometimes regulated records travel to an LLM over HTTP. Legacy DLP runs underneath TLS and cannot read the prompt. This walks the security patterns for data teams: binding each call to an analyst identity, classifying regulated data in the prompt, egress control on the notebook and BI tiers, and a per-decision audit record of what left for the model.

ai-securitydata-loss-preventiondlpidentity-and-authorizationshadow-aicompliance
Read post →

AI Security for Code Review Bots: Governing the Source Code That Leaves for the Model

An AI code review bot reads a pull request and sends the diff, and often surrounding files, to an LLM over HTTP. That request carries proprietary source and whatever secrets the diff contains out of the environment. This walks the security patterns for code review bots: binding each call to a bot and repository identity, classifying source and secrets in the prompt, egress control that keeps the model call on one path, and a per-decision audit record of what the bot sent to which model.

ai-securityllm-securityidentity-and-authorizationpolicy-enforcementdevsecops
Read post →

AI Security for Financial Analysts: Governing What Reaches the Model

Financial analysts use AI to summarize research, check models, and draft memos, which sends holdings, client data, and sometimes material non-public information to an LLM over HTTP. Those calls sit inside a recordkeeping regime that expects the firm to know what was communicated and to retain it. This walks the security patterns for analyst AI use: binding each call to an analyst identity, classifying MNPI and client data in the prompt, egress control, and a per-decision audit record that serves the firm supervision obligation.

ai-securitycomplianceregulationidentity-and-authorizationauditshadow-ai
Read post →

AI Security for DevOps: Governing What Copilots Send to the Model

DevOps and SRE teams use AI to write infrastructure code, triage incidents, and read logs, which sends configs, log lines, and sometimes secrets and production data to an LLM over HTTP. This walks the security patterns for DevOps AI use: binding each call to an engineer identity, classifying secrets and production data in the prompt, egress control from the tooling tier, and a per-decision audit record of what an engineer sent to the model during a change or an incident.

ai-securitydevsecopsidentity-and-authorizationpolicy-enforcementcloud-securityshadow-ai
Read post →