← All posts

Industry Verticals

73 posts on industry verticals.

AI and HIPAA Compliance: What the Security Rule Requires of Any System Touching PHI

HIPAA does not have an AI section, and the Security Rule and Privacy Rule already govern any AI system that touches protected health information. This article walks the three obligations that bind an LLM deployment: access control and audit controls under 45 CFR 164.312, the minimum necessary standard, and the business associate agreement a third-party model provider triggers. It then marks where most deployments leave those obligations unmet at the request layer.

hipaahealthcareai-compliancephiaudit-trailidentity-and-authorization
Read post →

AI Compliance in Banking: The Regulatory Map for a Bank Running LLMs

A bank running LLMs answers to model risk guidance, operational resilience rules, fair lending law, and data protection statutes at the same time. This article maps the regimes a bank compliance officer has to satisfy at once, SR 11-7, DORA, the ECB AI cyber letter, ECOA, and the EU AI Act, points to the deep dive on each, and shows the operational thread that runs through all of them at the AI request layer.

bankingfinanceai-compliancemodel-riskaudit-trailregulatory-compliance
Read post →

Banking AI Model Risk: Applying SR 11-7 to LLMs and Agents

SR 11-7 defines a model as any quantitative method that produces output to inform a decision, which puts LLMs and AI agents squarely in scope for a bank. This article walks the three pillars of the guidance, sound development, independent validation, and governance, and shows why the validation team cannot challenge an opaque non-deterministic vendor model without production telemetry on what the model was actually asked and what it returned.

bankingfinancemodel-riskai-compliancemodel-validationaudit-trail
Read post →

EdTech AI and Student Data Privacy: FERPA, COPPA, and the PII-in-Prompts Problem

When an edtech tutoring bot or grading assistant sends student work to a language model, the student record travels inside the prompt, and three privacy regimes attach: FERPA on education records, COPPA on data from children under 13, and state laws like California SOPIPA. This article walks what each regime requires of that data flow and shows where the exposure actually happens, in the prompt payload heading for a third-party model.

edtechstudent-privacyferpaai-compliancedata-protectionpii
Read post →

DORA AI Inference Controls: ICT Risk Requirements at the AI Request Layer

DORA is read as a third-party register exercise, and its ICT risk management and testing chapters also reach the runtime AI request path. This article walks the DORA obligations that land on inference itself, protection and detection under Articles 9 and 10, incident reconstruction under Article 17, and threat-led testing under Articles 24 to 27, and shows what a financial entity has to enforce and record on its live AI traffic to meet them.

financedoraict-riskai-complianceoperational-resilienceaudit-trail
Read post →

Fintech AI Fraud Model Governance: Controlling Adaptive Detection Models in Production

A fintech fraud model makes a real-time decision on every transaction, and when it declines a legitimate customer it creates an adverse-action obligation and a fair-lending exposure. This article walks the governance a fraud model needs in production: version control on the live decision, drift monitoring as fraud patterns shift, and a per-decision record that reconstructs why a specific transaction was blocked, so a dispute or a regulator can be answered.

fintechfinancefraud-detectionmodel-governanceai-complianceaudit-trail
Read post →

Government FedRAMP and AI Compliance: Authorizing LLM Services for Federal Use

A federal agency that wants to use an LLM inherits FedRAMP, and the question that decides compliance is where the agency data goes when a prompt leaves the authorized boundary. This article walks the authorization boundary problem, the NIST SP 800-53 audit and access-control families that AI traffic has to satisfy, and why keeping agency prompts inside the authorized estate is an enforcement problem on the request path, not a policy statement.

governmentfedrampai-compliancenist-800-53public-sectoraudit-trail
Read post →

Healthcare AI Agents and HIPAA: Attribution and Minimum Necessary for Autonomous Actions

A healthcare AI agent chains several PHI accesses to complete one task, and HIPAA still asks who accessed what and whether the access was the minimum necessary. This article walks the two obligations agents strain hardest, attribution under the audit-control standard and minimum necessary applied per action rather than per session, and shows why a shared agent credential and session-level logging leave both unmet at the request layer.

healthcarehipaaai-agentsphiaudit-trailidentity-and-authorization
Read post →

AI Medical Scribes and HIPAA: The PHI Leaves With the Prompt

An AI medical scribe listens to a patient encounter and drafts the clinical note, which means protected health information flows into an LLM on every visit. HIPAA compliance for that workflow turns on three things a policy gateway can enforce on the AI request path: a Business Associate Agreement covering the model endpoint, minimum-necessary control over what PHI is sent, and an audit record of every call.

healthcare-aihipaaphiai-audit-trailai-egress
Read post →

Illinois AI Employment Law: The Notice and Non-Discrimination Duties Need a Record

Illinois House Bill 3773 amended the Illinois Human Rights Act, effective January 1, 2026, to make it a civil-rights violation for an employer to use AI that discriminates in employment decisions, and to require notice when AI is used. Both duties turn on evidence: proving what the AI was asked and what it returned. This article shows where that record gets written.

illinois-ai-lawai-employmentai-audit-trailcompliancestate-ai-law
Read post →

HR Hiring AI Under the EU AI Act: The Bias Question Becomes a Logging Question

The EU AI Act classifies AI used to screen and evaluate job candidates as high-risk under Annex III, which brings record-keeping, logging, and human-oversight duties. Bias mitigation is model and data work, but proving a hiring decision was accountable is a logging problem. This article separates the two and shows which obligations a policy gateway produces evidence for on the AI request path.

eu-ai-acthr-aihigh-risk-aiai-audit-trailcompliance
Read post →

Protecting Attorney-Client Privilege When Lawyers Use AI: Control the Disclosure, Keep the Record

When a lawyer pastes privileged material into an external AI tool, the concern is disclosure to a third party and the risk that raises to attorney-client privilege and work-product protection. Privilege determinations belong to courts and counsel. What a firm controls is which privileged content reaches which model endpoint, and whether there is a record of it. Both are decisions on the AI request path.

legal-aiattorney-client-privilegeai-egressai-audit-traildata-protection
Read post →