Skip to content
Book a review

Sector-specific · finance · employment · health · insurance

Sectoral AI Rules

Sector regulators are writing their own AI rules, sometimes faster than the general law, and they stack on top of the AI Act.

Sectors
Four, and growing
Character
Stacks on the AI Act
Status
Mostly in force
Reach
EU, UK, and US

Why this matters

The Tightest Rule Is Often the Sector's

A hiring model in New York, a credit model at a US bank, or a triage model in a hospital may face a sector regulator whose rule is older, more specific, and more aggressively enforced than any horizontal AI law. These instruments rarely announce themselves as "AI regulation," which is exactly why they are missed.

They also stack. A sectoral rule sits on top of the AI Act and the GDPR, so the same system carries the general duties and the sector-specific ones at once. The four below are the largest clusters; we map many more.

Where it meets the others

Sector Rules Sit on Top of the General Law

One fact about a system, and each regime that asks for it.

  • One hiring model
    • NYC Local Law 144bias auditannual
    • EU AI Acthigh-risk system (Annex III 4(a))from 2 December 2027
    • GDPRprocessing of candidate datalawful basis and DPIA

A hiring model used in New York City and in the EU answers to Local Law 144, is a high-risk system under the AI Act, and processes personal data under the GDPR. The obligations add up. Map each one, capture the shared requirement once, and one body of evidence satisfies the sector rule, the general law and the data regime.

The sectors

Where AI Meets a Specialist Regulator

  • Financial services

    Model Risk and Fair Lending

    Banks have governed models for a decade. Supervisors expect AI to meet the same discipline: validation, documentation, monitoring, and fair-lending testing.

    • SR 11-7 / OCC 2011-12: model risk managementIn force
    • ECOA & fair lending: disparate-impact testingIn force
    • MiFID II RTS 6: algorithmic trading controlsIn force

  • Employment & hiring

    Automated Decisions About People

    Hiring and workforce AI is the most heavily litigated frontier. Rules require bias audits, notice to candidates, and human review of algorithmic management.

    • NYC Local Law 144: bias audit for hiring toolsIn force
    • Colorado AI Act (SB 205): high-risk consumer AI2026
    • EU Platform Work Directive: algorithmic managementTransposing

  • Health & clinical

    Beyond the Device Regulations

    On top of the MDR and IVDR, health regulators are setting rules for how clinical AI is validated, updated, and monitored once it is in use.

    • FDA SaMD: predetermined change-control plansGuidance
    • IMDRF AI (SaMD): international good practiceGuidance
    • Clinical governance codes: deployment oversightGuidance

  • Insurance

    Algorithms in Underwriting and Pricing

    Insurance regulators are targeting the use of AI and external data in underwriting and claims, with duties to test for unfair discrimination.

    • Colorado SB21-169: external data & algorithmsIn force
    • NAIC model bulletin: AI use by insurersAdopting

This overview names the largest sectoral regimes as illustrations, not an exhaustive list, and their status and detail vary by jurisdiction and over time. It is not legal advice. Confirm each instrument's current text and applicability, and take advice from counsel.

The regimes alongside it

The Regimes That Apply Alongside It

Your next step

Which of the Six Apply to You?

Book a 30-minute review