We Already Speak Your Regulatory Language
Since 2012 we’ve worked inside the frameworks that govern healthcare, life sciences, financial services, and insurance. You don’t have to teach us your regulatory world before we can be useful.
Four Industries, One Method
Healthcare & Healthtech
PHI is the highest-stakes data in the economy, and HIPAA and HITRUST CSF leave little room for interpretation. AI promises real gains in clinical and operational workflows, but only for organizations that can show what the model touches and who signed off.
Life Sciences & Medical Devices
Data integrity, GDPR exposure in European and UK markets, and quality expectations that reach into product design. When AI is inside the product, the regulator’s question isn’t whether you tested it once.
Financial Services & Fintech
GLBA and the Safeguards Rule, FFIEC guidance, NYDFS 23 NYCRR 500, SOX IT general controls, SEC cyber-disclosure rules, PCI DSS. Model risk governance was a discipline here before anyone called it AI governance.
Professional & Creative Services
Law firms, agencies, design and consulting practices: your core asset is other people’s confidential material, and your teams adopted AI faster than any policy could follow. There is often no regulator to make the rules for you, which sounds like freedom until a client’s procurement team asks how their material is handled, or whether a model was trained on it.
Insurance
The NAIC Model Bulletin now expects insurers to run a written AI Systems Program, and market-conduct exams will ask for it. We build that program, and because we train underwriters on AI risk, we also prepare the enterprises they underwrite.
The Frameworks We Work in, by Industry
| Industry | HIPAA | HITRUST | SOC 2 | GDPR | GLBA / FFIEC | NYDFS 500 | NAIC AIS | ISO/IEC 42001 |
|---|---|---|---|---|---|---|---|---|
| Healthcare & healthtech | ✓ | ✓ | ✓ | ✓ | ✓ | |||
| Life sciences & devices | ✓ | ✓ | ✓ | ✓ | ||||
| Financial services | ✓ | ✓ | ✓ | ✓ | ✓ | |||
| Professional & creative services | ✓ | ✓ | ✓ | |||||
| Insurance | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
✓ = engagements delivered · (blank) = not a framework we lead on.
Everyone Is Regulated Now, Whatever the Industry
California, Colorado, Illinois, New York, and Connecticut have enacted AI or automated-decision rules, and more are moving. If you use AI to make or support decisions about people, hiring, pricing, eligibility, service, the rules already reach you, whatever your industry.
Not in a Regulated Industry?
You still have to stay insurable, meet state and federal baselines, and answer customer security questionnaires. The forcing function is usually a carrier at renewal or a customer’s procurement team, not a regulator. Same rigor, sized to your stage.