The regime decides what evidence you owe
The four layers are constant. What changes by sector is which failures are reportable, who examines you, and what artifact satisfies them.
Banking
Where model risk management meets systems that act.
2026 interagency model risk guidance (OCC 2026-13)Internal audit & effective challenge
Operational resilience
Capital markets & investment advisers
The supervisor has already named the problem. Most firms have not answered it.
FINRA 2026 Regulatory Oversight ReportSEC examination priorities
Books and records · supervisory procedures
SEBI Regulation 16C (India)
Payments & agentic commerce
Agents are spending money. No rulebook defines what an agent is.
Nacha fraud-monitoring rules (phased 2026)PCI DSS · card network rules
Reg E authorization questions
Card-network agent protocols
Insurance
Claims and underwriting decisions an agent can now make alone.
NAIC model bulletin on AI useState DOI expectations
Professional liability exposure
Healthcare & life sciences
Agents touching patient records, clinical workflow and regulated submissions.
HIPAA Security & Privacy RulesClinical decision support boundaries
21 CFR Part 11 for regulated records
Sovereign & critical infrastructure
National platforms, public data estates, and residency that is not negotiable.
India DPDP ActData residency & localization
Sectoral critical-infrastructure rules
Gulf financial institutions
Central-bank expectations translated into evidence a reviewer can inspect.
CBUAE AI/ML Guidance Note — issued 11 February 2026CBUAE Model Management Standards
Institution-specific outsourcing and data requirements
If any of this is live for you
The fastest route is a conversation. Bring the architecture you are worried about — the first useful thing usually surfaces inside twenty minutes.