Sectors

The regime decides what evidence you owe

The four layers are constant. What changes by sector is which failures are reportable, who examines you, and what artifact satisfies them.

Where model risk management meets systems that act.

2026 interagency model risk guidance (OCC 2026-13) →

The supervisor has already named the problem. Most firms have not answered it.

FINRA 2026 Regulatory Oversight Report →

Agents are spending money. No rulebook defines what an agent is.

Nacha fraud-monitoring rules (phased 2026) →

Claims and underwriting decisions an agent can now make alone.

NAIC model bulletin on AI use →

Agents touching patient records, clinical workflow and regulated submissions.

HIPAA Security & Privacy Rules →

National platforms, public data estates, and residency that is not negotiable.

India DPDP Act →

Central-bank expectations translated into evidence a reviewer can inspect.

CBUAE AI/ML Guidance Note — issued 11 February 2026 →

Next step

If any of this is live for you

The fastest route is a conversation. Bring the architecture you are worried about — the first useful thing usually surfaces inside twenty minutes.