Sector-Specific AI Requirements

1. Why Sector-Specific AI Requirements Matter

Artificial intelligence does not operate in a regulatory vacuum. A credit-scoring model deployed by a bank, a diagnostic algorithm used in a hospital, a resume-screening tool used by an employer, and a predictive-maintenance model running in a power plant are all AI systems, yet each is governed by a very different set of legal, regulatory, and ethical obligations. Horizontal AI frameworks such as the NIST AI Risk Management Framework (AI RMF), ISO/IEC 42001, and the EU AI Act set a baseline, but the sector in which the AI operates determines the specific controls, documentation, approvals, and oversight that an organization must demonstrate.

For an AI risk professional, this matters for several reasons:

Regulatory exposure: Sector regulators (financial supervisors, health authorities, labor agencies, utility commissions) have enforcement powers, licensing authority, and the ability to issue fines, consent orders, or product recalls. Failing to map AI risks to sector obligations creates material compliance risk.

Harm magnitude: Sectors are regulated precisely because errors cause severe harm to individuals or society (loss of life, financial exclusion, discrimination, infrastructure failure). AI amplifies these harms through scale, speed, and opacity.

Framework integration: ISACA emphasizes that AI governance should not be bolted on as a separate silo. It must be integrated into existing enterprise risk management (ERM), model risk management, information security, privacy, and compliance programs, many of which are already sector-driven.

Trust and market access: Demonstrating sector compliance (e.g., FDA clearance, conformity assessment under the EU AI Act, or adherence to supervisory model-risk guidance) is often a precondition to deploying AI at all.

In the AAIR body of knowledge, this topic sits within the AI Risk Governance and Framework Integration domain because the central skill being tested is the ability to recognize that a general AI control framework must be tailored and layered with sector-specific obligations, and to know what those obligations typically look like.


2. What Sector-Specific AI Requirements Are

Sector-specific AI requirements are the laws, regulations, supervisory guidance, industry standards, and professional codes that apply to AI systems because of the industry, use case, or population they affect. They can be:

• Explicit AI rules written specifically for AI or automated decision-making in a sector (e.g., New York City Local Law 144 on automated employment decision tools; the NAIC Model Bulletin on the Use of AI by Insurers; FDA guidance on AI/ML-enabled medical devices).
• Existing sector rules that implicitly cover AI (e.g., fair lending laws such as ECOA and the Fair Housing Act apply to algorithmic credit decisions; HIPAA applies to AI that processes protected health information; the Federal Reserve/OCC SR 11-7 model risk management guidance applies to AI models at banks).
• Horizontal AI laws with sector-triggered obligations (e.g., the EU AI Act classifies certain uses as high-risk based on sector or purpose: critical infrastructure, education, employment, essential services and credit, law enforcement, migration, and administration of justice are all Annex III high-risk categories; medical devices and vehicles are high-risk via Annex I harmonization legislation).
• Voluntary industry standards and codes (e.g., ISO 14971 for medical device risk, ISO/SAE 21434 and ISO 26262 for automotive, IEC 62443 for industrial control systems) that regulators expect to see used as evidence of due care.

Key distinction tested on the exam: A horizontal framework (NIST AI RMF, ISO/IEC 42001, OECD AI Principles) applies across all sectors and provides the governance structure. A vertical or sector-specific requirement applies because of where and how the AI is used. Strong governance integrates both: the horizontal framework supplies the process (Govern, Map, Measure, Manage), and the sector rules supply the specific thresholds, documentation, and approvals that process must satisfy.


3. Major Sectors and Their Typical AI Requirements

3.1 Financial Services and Banking
• Model Risk Management (MRM): U.S. supervisory guidance SR 11-7 / OCC 2011-12 requires model inventory, independent validation, conceptual soundness review, ongoing monitoring, outcomes analysis, and clear model ownership. AI/ML models fall within scope, and regulators expect validation to address explainability, data drift, and overfitting.
• Fair lending and anti-discrimination: ECOA/Regulation B and the Fair Housing Act prohibit discriminatory outcomes; adverse action notices must give specific and accurate reasons, which the CFPB has stated applies even when a complex algorithm is used (no black-box excuse).
• Consumer protection: UDAAP (unfair, deceptive, or abusive acts or practices) applies to AI-driven marketing, pricing, and collections.
• Operational resilience: EU DORA (Digital Operational Resilience Act) imposes ICT risk, third-party, and incident-reporting obligations that capture AI vendors and cloud-hosted models.
• Capital and prudential rules: Basel guidance on operational risk and model use; EBA and ECB expectations on ML in internal ratings-based models.
• Securities and markets: SEC and FINRA scrutiny of robo-advisors, algorithmic trading, predictive data analytics, and conflicts of interest.
• Key controls: model inventory, tiering by materiality, independent validation, disparate-impact testing, explainability sufficient for adverse action, documentation, champion/challenger monitoring, and board reporting.

3.2 Healthcare and Life Sciences
• Medical device regulation: AI used for diagnosis, treatment, or clinical decision support may be Software as a Medical Device (SaMD) regulated by the U.S. FDA (510(k), De Novo, PMA pathways; Predetermined Change Control Plans for adaptive algorithms), the EU MDR/IVDR, and classified as high-risk under the EU AI Act.
• Privacy: HIPAA Privacy and Security Rules in the U.S.; GDPR special-category data rules in the EU; de-identification standards for training data.
• Clinical validation and safety: requirements for clinical evidence, performance across patient subpopulations (to avoid bias), human oversight by clinicians, post-market surveillance, and adverse event reporting.
• Transparency: ONC HTI-1 rule in the U.S. requires transparency (source attributes) for predictive decision-support interventions in certified health IT.
• Key controls: good machine learning practice (GMLP), change management for model updates, bias testing across demographics, clinician-in-the-loop, incident reporting, and robust data governance for PHI.

3.3 Insurance
• NAIC Model Bulletin on the Use of AI Systems by Insurers requires a written AIS program, governance, risk management, internal controls, and third-party oversight.
• Colorado SB 21-169 and its implementing regulations prohibit unfair discrimination from external consumer data and algorithms; require governance frameworks, testing, and reporting for life insurers.
• Actuarial standards and rate-filing rules require explainability of rating factors.
• Key controls: proxy discrimination testing, documentation of data sources, actuarial justification, vendor due diligence.

3.4 Employment and Human Resources
• NYC Local Law 144 requires annual independent bias audits and candidate notice for automated employment decision tools.
• EEOC guidance applies Title VII disparate impact analysis (including the four-fifths rule as a screening heuristic) and ADA accommodation requirements to AI hiring tools.
• Illinois AI Video Interview Act requires notice and consent.
• EU AI Act classifies employment, worker management, and recruitment AI as high-risk.
• Key controls: adverse-impact testing, notice and opt-out, human review, accessibility, vendor contractual rights to audit.

3.5 Critical Infrastructure, Energy, and Utilities
• NERC CIP standards for bulk electric systems; IEC 62443 for industrial automation cybersecurity; TSA security directives for pipelines and rail.
• EU AI Act treats safety components of critical infrastructure as high-risk; the EU NIS2 Directive imposes cybersecurity and incident-reporting duties.
• Key controls: safety-case documentation, fail-safe and fallback modes, adversarial robustness, segregation of OT and IT, human override, and resilience testing.

3.6 Automotive and Transportation
• ISO 26262 (functional safety), ISO 21448 (SOTIF: safety of the intended functionality), ISO/SAE 21434 (cybersecurity), UNECE regulations on automated lane keeping and software updates, NHTSA reporting on crashes involving automated driving systems.
• Key controls: hazard analysis, simulation and scenario validation, over-the-air update governance, event data recording.

3.7 Public Sector, Law Enforcement, and Justice
• OMB memoranda (e.g., M-24-10 and successors) requiring U.S. federal agencies to inventory AI, designate Chief AI Officers, and apply minimum risk-management practices for rights-impacting and safety-impacting AI.
• EU AI Act prohibits certain practices (social scoring, some biometric categorization, untargeted facial-image scraping) and classifies law enforcement and justice uses as high-risk.
• Due process and administrative law requirements for explainability and appeal of automated decisions in benefits eligibility.
• Key controls: impact assessments, public transparency, human review, appeal mechanisms, strict controls on biometrics.

3.8 Education
• FERPA and COPPA (U.S.) for student and child data; EU AI Act classifies admissions, assessment, and proctoring AI as high-risk.
• Key controls: parental/student notice, bias testing of grading and proctoring tools, data minimization.

3.9 Telecommunications, Media, and Consumer Technology
• FCC rules on AI-generated robocalls (TCPA); EU Digital Services Act transparency for recommender systems; deepfake and synthetic media labeling laws.
• Key controls: content provenance, watermarking, user disclosure.


4. How It Works: Integrating Sector Requirements into AI Risk Governance

The exam expects you to understand a repeatable process rather than memorize every law. The typical lifecycle is:

Step 1 – Inventory and classify AI use cases. Maintain an AI system inventory capturing purpose, sector, data types, affected populations, decision impact, and degree of autonomy. This is the foundation for determining which sector rules apply.

Step 2 – Perform regulatory and jurisdictional mapping. For each use case, identify applicable horizontal laws (EU AI Act, GDPR, state privacy laws), sector laws (HIPAA, ECOA, SR 11-7), and standards. Consider all jurisdictions where the system is deployed or where affected persons reside. Legal and compliance functions should own this mapping with input from the AI risk team.

Step 3 – Risk-tier the system. Use the sector lens to set risk tiers: a high-risk classification under the EU AI Act, a Tier 1 model under bank MRM, or a Class II/III medical device each triggers heightened controls. Risk tiering drives the depth of validation, documentation, and approval required.

Step 4 – Perform a crosswalk and gap analysis. Map existing enterprise controls (from NIST AI RMF, ISO/IEC 42001, COBIT, ISO 27001, privacy program) against sector requirements. Identify gaps such as missing bias audits, lack of adverse-action explainability, or absent post-market surveillance. The goal is a unified control framework where one control can satisfy multiple obligations, avoiding duplicative silos.

Step 5 – Design and implement tailored controls. Examples include independent model validation (finance), clinical validation and change-control plans (healthcare), bias audits and notices (employment), safety cases (critical infrastructure), and human-oversight mechanisms (all high-risk uses).

Step 6 – Engage stakeholders and define accountability. Sector requirements often prescribe roles: a Chief Model Risk Officer or validation unit, a Data Protection Officer, a designated clinical safety officer, or a Chief AI Officer. Board and senior management must be informed and accountable. Three-lines model: first line owns the AI, second line (risk/compliance) sets policy and challenges, third line (internal audit) provides independent assurance.

Step 7 – Manage third parties. Many sector rules (DORA, NAIC bulletin, OCC third-party guidance, HIPAA business associate rules) explicitly require oversight of AI vendors: due diligence, contractual audit rights, model documentation, incident notification, and exit strategies.

Step 8 – Monitor, report, and respond. Ongoing monitoring for drift, bias, and performance; incident and adverse event reporting to regulators where required; periodic reassessment when the model, data, use case, or law changes. Document everything to demonstrate compliance to supervisors and auditors.

Step 9 – Track regulatory change. AI regulation is evolving rapidly. A horizon-scanning process ensures new sector rules (state insurance regulations, FDA guidance updates, EU AI Act implementing acts and harmonized standards) are incorporated.


5. Common Themes Across Sectors

Although details differ, regulators across sectors converge on similar expectations, and the exam frequently tests these shared principles:

• Risk-based proportionality: higher impact means stronger controls.
• Human oversight: meaningful human review for consequential decisions.
• Explainability and transparency: ability to explain decisions to regulators and affected individuals.
• Fairness and non-discrimination: testing for disparate impact and proxy discrimination.
• Data governance: lawful basis, quality, provenance, minimization, and protection of sensitive data.
• Validation and ongoing monitoring: pre-deployment testing and post-deployment surveillance.
• Documentation and auditability: technical documentation, logs, and records sufficient for regulatory inspection.
• Accountability: defined roles, board oversight, and independent assurance.
• Third-party risk: the deploying organization remains accountable even when the model is purchased.
• Incident management: reporting of serious incidents, malfunctions, or breaches.


6. Exam Tips: Answering Questions on Sector-Specific AI Requirements

Tip 1 – Identify the sector cue first. Exam scenarios will often mention a bank, hospital, insurer, employer, or utility. That word is the key to the answer. Immediately ask: what regulator and what body of rules govern this industry, and how would they view this AI use?

Tip 2 – Prefer answers that integrate rather than duplicate. ISACA strongly favors integrating AI risk into existing governance (ERM, MRM, privacy, security) rather than creating standalone, disconnected AI programs. If an option says to build a separate parallel framework ignoring existing controls, it is usually wrong.

Tip 3 – Think risk-based and proportional. When asked which control is most appropriate, choose the option that aligns the rigor of controls with the impact of the AI system and its regulatory classification (e.g., high-risk under the EU AI Act or a high-materiality model under MRM).

Tip 4 – Remember that existing laws apply to AI. A common distractor suggests that because no AI-specific law exists in a sector, no requirements apply. This is false: fair lending, anti-discrimination, privacy, consumer protection, and safety laws all apply to AI-driven decisions regardless of the technology used.

Tip 5 – Know the signature requirement of each major sector. Finance = model risk management and fair lending/adverse action explainability. Healthcare = medical device regulation, clinical validation, and PHI privacy. Employment = bias audits and candidate notice. Insurance = unfair discrimination testing and AI governance programs. Critical infrastructure = safety and resilience, fail-safe design. Public sector = impact assessments, transparency, and due process. Pairing the sector with its signature requirement will resolve many questions quickly.

Tip 6 – Recognize who should do what. Questions about roles usually point to: legal/compliance for regulatory mapping, second-line risk for policy and challenge, independent validation for model review, internal audit for assurance, and the board for oversight. The first line (business/data science) should not be its own validator.

Tip 7 – Do not forget jurisdiction. If a scenario involves cross-border deployment or affected persons in multiple regions, the best answer accounts for the strictest applicable requirements and performs multi-jurisdictional mapping, rather than assuming home-country rules suffice.

Tip 8 – Third-party AI does not transfer accountability. If the scenario involves a vendor-supplied model, the correct answer will typically emphasize due diligence, contractual rights to documentation and audit, and ongoing monitoring by the deployer, because sector regulators hold the regulated entity accountable.

Tip 9 – Watch for the words BEST, MOST, FIRST, and PRIMARY. For FIRST, the answer is usually inventory, classification, or regulatory mapping. For BEST or MOST, the answer is usually the one that addresses the root governance issue (e.g., establishing a risk-tiered, integrated control framework) rather than a single technical fix.

Tip 10 – Eliminate absolute or technology-only answers. Options claiming that a particular algorithm, tool, or certification alone ensures compliance are typically distractors. Compliance is demonstrated through governance, documentation, testing, oversight, and continuous monitoring.

Tip 11 – Use the common-themes checklist. If unsure, test each option against the shared regulatory expectations: proportionality, human oversight, explainability, fairness, data governance, validation, documentation, accountability, third-party management, and incident reporting. The option covering the most relevant themes for the given sector is usually correct.

Tip 12 – Stay current but think in principles. The exam is unlikely to hinge on an obscure statute number; it is more likely to test whether you can recognize that a sector regulator will expect a specific category of control. Focus on understanding the reasoning behind sector rules so you can apply it to unfamiliar scenarios.


7. Sample Question Walkthroughs

Sample 1: A regional bank plans to deploy a machine learning model to approve small-business loans. Which action should the AI risk manager recommend FIRST?
A. Deploy with a pilot group and monitor outcomes. B. Add the model to the enterprise model inventory and determine its risk tier under the model risk management policy. C. Purchase an explainability tool. D. Train loan officers on AI.
Answer: B. Sector cue is a bank, which triggers model risk management expectations; inventory and tiering is the foundational FIRST step that determines all downstream validation and fair-lending testing.

Sample 2: A hospital uses a vendor-supplied AI tool that flags patients at risk of sepsis. Which is the MOST important governance consideration?
A. The vendor holds an ISO 27001 certificate. B. The tool has been validated for performance across the hospital patient population and clinicians retain decision authority with documented oversight. C. The model uses the latest deep learning architecture. D. The hospital IT department approved the integration.
Answer: B. Healthcare cue points to clinical validation, subpopulation performance, and human oversight; a security certificate alone is insufficient and technology sophistication is irrelevant.

Sample 3: An organization with a mature NIST AI RMF-based program expands into HR screening tools in New York City. The BEST approach is to:
A. Create a new, separate AI governance program for HR. B. Rely on the existing framework without changes. C. Perform a gap analysis mapping the existing framework to employment-specific requirements such as independent bias audits and candidate notices, and add controls where gaps exist. D. Discontinue the use of AI in HR.
Answer: C. Integration plus sector tailoring is the ISACA-preferred approach.


8. Key Takeaways

• Sector-specific AI requirements are the vertical layer that turns a general AI governance framework into a compliant, defensible program.
• Existing sector laws apply to AI even without AI-specific text; AI-specific rules are increasingly being added on top.
• The core process is inventory, regulatory mapping, risk tiering, crosswalk and gap analysis, tailored controls, accountability, third-party oversight, monitoring, and regulatory change tracking.
• Across sectors, regulators converge on proportionality, human oversight, explainability, fairness, data governance, validation, documentation, accountability, and incident reporting.
• On the exam, find the sector cue, pair it with its signature requirement, favor integrated and risk-based governance answers, and eliminate options that are purely technical, absolute, or that ignore existing law and accountability.