Sector-Specific AI Compliance Requirements

Overview
Sector-Specific AI Compliance Requirements are the laws, regulations, standards and supervisory expectations that apply to AI systems because of the industry they operate in. Examples include healthcare, financial services, insurance, employment, education, critical infrastructure, transportation, energy, telecommunications, defense and the public sector. In the PMI-CPMAI (Cognitive Project Management for AI) framework, this topic sits within the domain Support Responsible and Trustworthy AI Efforts. An AI project manager must identify these obligations early and build them into every phase of the AI lifecycle.

Why It Is Important
1. Legal and financial exposure: Breaking sector rules can bring fines, license loss, product recalls, lawsuits and enforcement actions. Examples are HIPAA penalties, fair lending violations and FDA warning letters.
2. Project viability: An accurate model that cannot be legally deployed is a failed project. Compliance is a go/no-go criterion, not a nice-to-have.
3. Trust and reputation: Regulated sectors serve patients, borrowers, job applicants and citizens. Harm to these groups damages public trust quickly.
4. Higher risk stakes: Sector rules exist because errors in these domains can cause serious harm, such as misdiagnosis, discriminatory credit denial or safety failures.
5. Cost of late discovery: Finding a compliance gap after deployment can force rework, retraining, re-validation or even shutting the system down.
6. Layered obligations: Horizontal laws apply across all industries. Examples are the EU AI Act, GDPR and general consumer protection law. Sector rules add more specific duties on top. Managers must handle both.

What It Is: Key Sector Examples
Healthcare and Life Sciences

• HIPAA (US) protects patient health information (PHI). It requires de-identification, minimum-necessary use and business associate agreements.
• FDA rules cover Software as a Medical Device (SaMD) and AI/ML-enabled devices. Key elements are premarket review (510(k), De Novo, PMA), Good Machine Learning Practice and Predetermined Change Control Plans for models that learn or are updated.
• The EU Medical Device Regulation (MDR) and In Vitro Diagnostic Regulation (IVDR) apply in Europe. Under the EU AI Act, AI that is a safety component of a regulated medical device is generally treated as high-risk.
• Clinical validation, human oversight by clinicians and post-market surveillance are expected.

Financial Services and Banking

• Fair lending laws require that credit models do not discriminate against protected classes. In the US these include ECOA, Regulation B and the Fair Housing Act.
• Adverse action notices must give applicants specific reasons for denial. This makes explainability mandatory in practice.
• Model risk management guidance requires model inventory, independent validation, documentation, ongoing monitoring and governance. In the US this is SR 11-7 / OCC 2011-12.
• The Fair Credit Reporting Act (FCRA), anti-money laundering (AML/KYC) rules and Basel principles also apply.
• The EU AI Act lists creditworthiness assessment of individuals as high-risk.

Insurance

• State insurance regulators prohibit unfair discrimination in underwriting and pricing. Examples include the NAIC Model Bulletin on AI and Colorado's AI governance rules for life insurers.
• The EU AI Act lists risk assessment and pricing for life and health insurance as high-risk.

Employment and HR

• Anti-discrimination law applies to hiring algorithms. In the US this includes Title VII and EEOC guidance on adverse impact, such as the four-fifths rule.
• New York City Local Law 144 requires bias audits and notices for automated employment decision tools.
• The EU AI Act lists recruitment and worker management AI as high-risk.

Education

• FERPA (US) protects student records. COPPA applies to children under 13.
• The EU AI Act lists admissions, grading and proctoring AI as high-risk.

Critical Infrastructure, Transportation and Energy

• Safety standards apply, such as ISO 26262 and UL 4600 for autonomous vehicles, and DO-178C and EASA/FAA guidance for aviation.
• NERC CIP sets cybersecurity requirements for the power grid.
• These sectors emphasize functional safety, robustness, fail-safe design and certification.

Public Sector and Government

• Requirements include algorithmic impact assessments, transparency registers, procurement rules and due process. Examples are US federal OMB AI memoranda and Canada's Directive on Automated Decision-Making.
• Law enforcement, biometric identification, migration and justice uses are high-risk or prohibited under the EU AI Act.

Cross-Cutting Overlays

• GDPR and similar privacy laws apply, including Article 22 rights on automated decision-making.
• The EU AI Act takes a risk-based approach with four tiers: unacceptable, high, limited and minimal risk.
• Voluntary frameworks such as the NIST AI RMF and ISO/IEC 42001 are often used to show due diligence.

How It Works: Managing Sector Compliance Across the CPMAI Lifecycle
CPMAI follows six iterative phases. Compliance activities map to each one.

Phase I: Business Understanding

• Identify the sector, the jurisdictions and the intended use. Classify the risk level, for example whether the use is high-risk under the EU AI Act.
• Engage legal, compliance, privacy, risk and domain regulatory experts early.
• Document regulatory requirements as project requirements and acceptance criteria.
• Run a go/no-go check. If the use is prohibited or compliance is infeasible, stop or redesign.
• Decide whether AI is even appropriate. Sometimes a rules-based or human process carries less regulatory burden.

Phase II: Data Understanding

• Check data provenance, consent, lawful basis and the presence of regulated data categories such as PHI, financial data or student records.
• Check for protected attributes and proxies that could produce discriminatory outcomes.
• Confirm data residency and cross-border transfer restrictions.

Phase III: Data Preparation

• Apply de-identification, anonymization, minimization, encryption and access controls.
• Maintain data lineage and documentation for auditability.
• Address representativeness and bias in the data.

Phase IV: Model Development

• Choose model types that meet explainability needs. A credit model may require interpretable reason codes.
• Run fairness testing. Document design choices using model cards or technical files.

Phase V: Model Evaluation

• Perform independent validation, as in banking model risk management.
• Perform clinical or safety validation and bias audits.
• Complete conformity assessments where required.
• Confirm that performance meets both regulatory thresholds and business thresholds.

Phase VI: Model Operationalization

• Obtain regulatory approvals or certifications before go-live.
• Set up human oversight, logging, incident reporting and post-market monitoring.
• Monitor for drift and manage model changes under change-control plans.
• Keep records for audit retention periods and plan for periodic re-validation.

Key Supporting Practices

• Regulatory requirements traceability matrix: links each obligation to controls, owners and evidence.
• Governance structure: an AI governance board, a RACI covering compliance roles and clear accountability.
• Documentation: datasheets, model cards, impact assessments, validation reports and audit trails.
• Risk register: logs regulatory risks with mitigations.
• Horizon scanning: tracks emerging regulations, because AI law changes fast.
• Third-party and vendor management: regulated organizations remain accountable for vendor AI.

Exam Tips: Answering Questions on Sector-Specific AI Compliance Requirements
1. Start early. When asked when to address compliance, the answer is almost always the beginning, during Business Understanding. Answers that defer compliance to deployment or post-launch are usually wrong.
2. Involve the experts. The best answer usually consults legal, compliance, privacy officers or regulatory affairs specialists. The project manager does not interpret complex law alone.
3. Match the regulation to the sector. Know the common pairings:

• HIPAA goes with healthcare data.
• FDA SaMD goes with medical AI.
• Fair lending laws and SR 11-7 go with banking.
• FERPA goes with education.
• EEOC and NYC LL144 go with hiring.
• GDPR goes with EU personal data.

4. Recognize high-risk triggers. Watch for AI used in credit, hiring, medical diagnosis, insurance pricing, education, law enforcement or critical infrastructure. These cues mean stronger obligations: documentation, human oversight, explainability, bias testing and conformity assessment.
5. Expect layered obligations. If a scenario involves an EU hospital, both the sector rules (MDR) and the horizontal rules (GDPR, EU AI Act) apply. Choose answers that address all applicable layers.
6. Treat explainability as a compliance requirement. In lending and adverse decisions, choose answers that give specific reasons to affected individuals. Avoid unexplainable black-box models when the law requires reasons.
7. Know that accuracy is not enough. A distractor may claim that high accuracy justifies deployment. In regulated sectors, also look for validation, fairness, approvals and documentation.
8. Pause or escalate when non-compliant. If a scenario reveals a compliance gap mid-project, the best response is to stop or escalate, assess the gap and remediate. Do not continue and fix it later, and do not hide the issue.
9. Remember vendors do not transfer accountability. Buying a third-party model does not remove the organization's compliance duties. Choose answers involving due diligence, contractual controls and validation.
10. Compliance continues after go-live. Monitoring, re-validation, incident reporting and change control are required after deployment, especially for adaptive models.
11. Prefer documentation and traceability. Answers involving audit trails, lineage, model cards and requirement traceability tend to be correct.
12. Use proportionality. Controls should scale with risk. A low-risk internal chatbot does not need the same rigor as a diagnostic AI. Avoid answers that over- or under-apply controls relative to the risk described.
13. Eliminate distractors. Rule out answers that:

• ignore regulators;
• assume one global rule fits all jurisdictions;
• rely only on technical teams;
• treat ethics frameworks as legally binding when they are voluntary, or treat binding laws as optional.

14. Use keyword cues. Words such as patient, PHI, clinical point to healthcare rules. Loan, credit, adverse action point to fair lending and explainability. Applicant, hiring point to bias audits. EU citizens point to GDPR and the EU AI Act.

Sample Question
A project team is building an AI model to approve personal loans. Midway through development, they realize the model uses zip code, which correlates strongly with race. What should the project manager do FIRST?
A) Continue, since zip code is not a protected attribute.
B) Deploy and monitor complaints.
C) Pause, engage compliance and legal to assess disparate impact under fair lending rules, and evaluate removing or mitigating the proxy.
D) Increase model accuracy to offset risk.
Answer: C. Zip code can act as a proxy for race and produce disparate impact. The best first step is to pause and escalate to compliance and legal experts, then evaluate mitigation.

Summary
Sector-specific AI compliance means knowing which industry rules apply, turning them into project requirements and acceptance criteria, and embedding controls throughout the CPMAI lifecycle. Key controls are privacy safeguards, fairness testing, explainability, validation, approvals, human oversight and monitoring. On the exam, favor answers that are early, collaborative, risk-proportionate, well documented and continuous.