Why Sector Context Determines Compliance Architecture

Cross-jurisdictional frameworks like GDPR, the EU AI Act, and FATF AML standards create baseline obligations. But sector-specific regulation imposes additional and often more demanding requirements that sit on top of these baselines. For most enterprises, the binding compliance floor is set by the combination of the most demanding cross-jurisdictional framework and the most demanding sector-specific framework that applies.

Three ways sector regulation adds to the cross-jurisdictional baseline

• Prescriptive controls: Sector regulators specify not just outcomes but the controls that must be in place — data retention periods, audit trail standards, model validation requirements, and incident reporting timelines.
• Senior accountability: Sector regulation increasingly assigns personal accountability to named senior individuals for compliance failures — the UK’s Senior Managers and Certification Regime (SMCR), Ireland’s Individual Accountability Framework, and Singapore’s FI accountability guidance all create individual liability that cross-jurisdictional frameworks do not.
• Third-party accountability: Sector regulators extend their reach to vendors and service providers. DORA requires financial entities to manage ICT third-party risk. The FDA’s AI/ML guidance requires sponsors to maintain oversight of software-as-a-medical-device (SaMD) vendors. NERC CIP requires utilities to assess supply chain cybersecurity risk.

Financial Services: The Highest-Compliance Vertical FS

Financial services is the most regulated vertical for enterprise AI and third-party risk. Banks, insurers, asset managers, payment firms, and market infrastructure operators face overlapping regulatory obligations from prudential regulators, conduct regulators, and central banks across every jurisdiction in which they operate.

Core regulatory layer

AI governance in financial services

AI deployment in financial services touches credit decisioning, fraud detection, algorithmic trading, customer risk scoring, and AML transaction monitoring. Regulators have issued specific expectations: the FCA expects firms to demonstrate that AI models are explainable, auditable, and subject to ongoing performance monitoring. The ECB and EBA have published supervisory expectations for IRB model governance that extend to AI/ML credit models. The MAS Model Risk Management guidelines require documented model validation for all models used in risk decisions.

The EU AI Act classifies AI systems used in credit assessment, insurance pricing, and biometric identification as high-risk — requiring conformity assessments, human oversight mechanisms, and audit logs before deployment. For financial services firms, this adds an EU regulatory layer on top of existing national AI governance expectations. See our Enterprise AI Governance Guide for the full framework.

Third-party risk in financial services

DORA is the most demanding TPRM framework currently in force. It requires: a complete ICT third-party risk register; risk-tiered due diligence; contractual provisions covering audit rights, exit strategies, and incident reporting; and ongoing monitoring of critical ICT providers. For UAE-regulated institutions, the CBUAE ORM framework mandates equivalent provisions. For UK firms, FCA supplier risk guidance and SMCR accountability create parallel obligations.

For the TPRM framework: Enterprise TPRM Guide. For UAE-specific operational risk: UAE Banks: New Operational Risk Rulebook. For federal contracting: Federal TPRM: Vendor Risk in Government Contracts.

Financial crime compliance

AML, sanctions screening, and beneficial ownership verification are baseline obligations across every jurisdiction. For AI in financial crime detection, regulators expect documented model governance — how the model was trained, validated, and monitored; what the false positive and false negative rates are; how alerts are reviewed and escalated. For the full AML framework: AML Beneficial Ownership: Beyond Customer Identity.

Healthcare & Life Sciences HC

Healthcare is unique in that its AI governance requirements derive from patient safety regulation — not financial stability regulation. The stakes are different: a poorly governed AI system in credit scoring creates financial harm; a poorly governed AI system in clinical decision support creates patient harm. This drives more prescriptive control requirements, particularly around validation, explainability, and human oversight.

Core regulatory layer

AI governance in healthcare

The FDA’s AI/ML-based Software as a Medical Device (SaMD) guidance applies to AI systems that provide clinical recommendations, diagnose conditions, or inform treatment decisions. It requires: a predetermined change control plan (PCCP) defining what changes are permitted without re-submission; post-market performance monitoring; and transparency about training data, intended use, and performance limitations. Vendors supplying AI tools to healthcare enterprises are subject to equivalent obligations as medical device manufacturers.

The EU MDR and the EU AI Act create overlapping obligations for healthcare AI in Europe: a clinical decision support system that crosses the medical device threshold requires conformity assessment under MDR plus compliance with EU AI Act high-risk provisions. Healthcare enterprises deploying AI from vendors must verify that vendor AI has completed the required regulatory pathway — a contractual warranty is insufficient without documentary evidence.

Third-party risk in healthcare

HIPAA’s Business Associate Agreement (BAA) requirement extends data protection obligations to every vendor that creates, receives, maintains, or transmits protected health information (PHI). Healthcare enterprises must: maintain a complete inventory of all BAAs; verify vendor compliance with HIPAA Security Rule safeguards; and ensure BAAs include breach notification obligations that satisfy the enterprise’s own regulatory reporting timelines.

For agentic AI systems processing patient data, the vendor assessment must cover: data minimisation practices, model training data governance, output audit trails, and incident response capabilities. For the agentic vendor risk framework: Agentic Vendor Risk Assessment: How It Works.

Technology & SaaS TECH

Technology companies occupy a unique dual position: they are both subject to sector-applicable regulation and — as vendors to regulated industries — they are increasingly required to meet the compliance obligations of their customers’ sectors. A SaaS platform serving financial services firms must satisfy DORA ICT provider requirements. A health technology company must comply with HIPAA as a business associate. A cloud provider serving critical infrastructure must meet NERC CIP supply chain risk standards.

The regulated-vendor obligation

As regulated industries extend compliance obligations to their supply chains, technology companies serving those industries face a growing compliance burden that is driven not by their own sector regulation but by their customers’ sector regulation. Key obligations include:

• DORA ICT provider obligations: Critical ICT third-party providers to EU financial services entities face direct oversight by EU financial supervisors, including information requests, inspections, and binding recommendations.
• HIPAA Business Associate obligations: SaaS vendors processing PHI for healthcare customers are directly liable for HIPAA Security Rule compliance, not merely by contract.
• EU AI Act provider obligations: Technology companies that develop or deploy high-risk AI systems are subject to EU AI Act conformity assessment requirements regardless of whether they are themselves regulated by a financial or sector regulator.
• GDPR data processor obligations: Article 28 creates direct obligations for technology vendors processing personal data on behalf of controllers, including data minimisation, security requirements, and breach notification.

AI governance for technology companies

Technology companies deploying AI into regulated verticals face the highest compliance burden under the EU AI Act. Systems used in credit, employment, biometrics, critical infrastructure, and education are classified as high-risk, triggering conformity assessment, technical documentation, and human oversight requirements. The EU AI Act’s provider obligations apply from the point of placing the system on the EU market — technology companies cannot rely on their customers’ compliance programmes to satisfy provider-level obligations.

ISO 42001 provides a management system framework for AI governance that aligns with EU AI Act requirements and is increasingly referenced by customers in vendor due diligence. Technology companies seeking to demonstrate AI governance posture should consider ISO 42001 as a baseline framework. See our Enterprise AI Governance Guide for implementation detail.

Vendor access and recertification

Technology companies that provide platform or integration access to their own customers face a specific compliance obligation around access governance: ensuring that customer access rights are scoped to legitimate business purpose, reviewed on a defined cycle, and revoked promptly when purpose changes. For the continuous control model: Permission Reviews Are Becoming Continuous Controls.

Energy & Critical Infrastructure ENERGY

Energy and critical infrastructure operators face cybersecurity-led compliance frameworks that directly govern vendor and supply chain risk. The consequences of compliance failure are operational resilience failures — power outages, pipeline disruptions, grid instability — rather than financial penalties alone. This creates a risk profile that drives more prescriptive operational technology (OT) security and supply chain risk requirements than most other verticals.

Core regulatory layer

AI governance in energy and critical infrastructure

AI systems used in critical infrastructure — predictive maintenance, grid optimisation, anomaly detection in operational technology, demand forecasting — are classified as high-risk under the EU AI Act. This creates conformity assessment obligations for operators deploying such systems. The overlap between IT and OT environments in energy creates a specific challenge: AI systems that process both operational data and personal data trigger both EU AI Act high-risk provisions and GDPR obligations simultaneously.

For energy operators, the AI governance programme must cover: inventory of AI systems in OT and IT environments; risk classification against EU AI Act criteria; vendor AI due diligence for systems integrated into operational processes; and incident response procedures for AI system failures that have operational consequences.

Supply chain risk in energy

NERC CIP-013 requires bulk electric utility operators to implement a supply chain risk management plan covering software integrity verification, vendor remote access controls, and notification of vendor-identified cybersecurity vulnerabilities. NIS2 imposes equivalent supply chain security measures on EU critical infrastructure operators, including contractual security requirements for ICT vendors.

For energy operators, the TPRM programme must extend to OT vendors — industrial control system (ICS) suppliers, SCADA software providers, and remote monitoring services — whose access to operational systems creates direct cyber-physical risk. For the broader TPRM framework: Enterprise TPRM Guide.

Manufacturing & Supply Chain MFG

Manufacturing faces the most complex supply chain compliance environment of any sector. CSDDD, LkSG, UK Modern Slavery Act, and US conflict minerals rules all impose due diligence obligations that extend through multiple tiers of the supply chain — covering human rights, environmental standards, and responsible sourcing. AI is increasingly used in supply chain risk management itself, creating a governance obligation for the tools used to manage compliance.

Core regulatory layer

AI governance in manufacturing

AI in manufacturing spans quality control, predictive maintenance, demand forecasting, and — increasingly — supply chain risk assessment itself. Where AI is used for safety-critical decisions in manufacturing processes, EU AI Act high-risk provisions may apply. More broadly, the use of AI in supply chain due diligence — natural language querying of supplier data, automated red flag detection — introduces a governance obligation: the AI system used to assess compliance must itself be fit for purpose and auditable.

For AI in supply chain due diligence: Supply Chain Due Diligence: From Data to Answers.

Supply chain due diligence programme

CSDDD requires large enterprises (and large non-EU companies with EU turnover above threshold) to implement a due diligence programme covering: risk identification across the value chain; preventive action for identified risks; remediation for actual adverse impacts; a complaints mechanism; and annual public reporting. Unlike earlier reporting-based laws, CSDDD includes civil liability provisions that allow affected parties to sue for damages.

For manufacturing enterprises already compliant with LkSG, the extension to CSDDD requires broadening due diligence from direct suppliers to the full value chain, and implementing a civil liability-compliant remediation process. For mid-market supplier cyber risk: Why Mid-Market Suppliers Are Your Cyber Weak Link.

Cross-Vertical Patterns: What Every Sector Shares

Despite their different regulatory drivers, all sectors are converging on the same operational requirements for AI governance and third-party risk. Enterprises that recognise these convergence points can build shared infrastructure rather than sector-siloed compliance programmes.

AI inventory and risk classification

Every regulated sector now requires — explicitly or implicitly — an inventory of AI systems in use, with risk classification that identifies systems subject to heightened governance obligations. The classification criteria differ (EU AI Act high-risk categories, FDA SaMD risk classification, NERC CIP BES cyber system classification) but the operational requirement is the same: know what AI you have and what rules apply to it.

Third-party AI due diligence

Every sector framework that imposes TPRM obligations now explicitly covers AI systems operated by vendors. DORA covers ICT third-party providers including AI platform vendors. HIPAA BAA requirements extend to vendors processing PHI using AI. NERC CIP-013 covers software supply chain risk including AI-enabled tools. The question regulators ask is no longer just “is your vendor compliant?” but “does your vendor’s AI system meet your governance standards?”

For the agentic vendor assessment framework: Agentic Vendor Risk Assessment: How It Works. For continuous monitoring of vendor AI compliance: Continuous Monitoring Is an AI Governance Requirement.

Audit trails and human oversight

Across financial services (BCBS 239, DORA), healthcare (FDA SaMD), energy (NERC CIP), and manufacturing (CSDDD), regulators require that AI-assisted decisions are auditable and subject to human oversight for high-stakes outcomes. The common pattern is: AI provides a recommendation or analysis; a human reviews and approves; the review is documented. The specific threshold for human review differs by sector and system risk, but the architecture is consistent. For AI audit trail requirements: AI Agent Audit Trails: The New ERP Assurance Gap.

Vendor questionnaire evolution

Traditional vendor questionnaires are inadequate for the current compliance environment. Point-in-time self-assessments do not provide real-time compliance status, cannot detect changes between assessment cycles, and create a false assurance of compliance. The direction of travel across all sectors is toward continuous risk intelligence — combining periodic assessments with ongoing signals monitoring. For the evolution of vendor questionnaires: Vendor Questionnaires Meet Continuous Risk Intelligence.

Key Resources in This Guide

• AI Governance for Enterprise: The Definitive GuideAI Governance
• Enterprise TPRM GuideTPRM
• Global Regulatory Compliance HubCompliance
• UAE Banks: New Operational Risk RulebookFinancial Services
• Federal TPRM: Vendor Risk in Government ContractsFinancial Services
• AML Beneficial Ownership: Beyond Customer IdentityFinancial Services
• Agentic Vendor Risk Assessment: How It WorksTPRM
• Vendor Questionnaires Meet Continuous Risk IntelligenceTPRM
• Permission Reviews Are Becoming Continuous ControlsAccess Governance
• Supply Chain Due Diligence: From Data to AnswersManufacturing
• Why Mid-Market Suppliers Are Your Cyber Weak LinkSupply Chain
• Continuous Monitoring Is an AI Governance RequirementMonitoring
• AI Agent Audit Trails: The New ERP Assurance GapAI Governance
• AI Compliance: From Documentation to EvidenceControls
• ACRA AI Audit RulebookSingapore
• India AI Governance: Build Before RegulationIndia

Frequently Asked Questions