Executive brief · Status as of 16 October 2026
Sector-specific AI rules
What do you need to know?
- One AI system can fall under a sector rule, the EU AI Act and GDPR at the same time. Sector rules include model risk management (how banks govern decision models), fair lending, employment and medical-device law.
- Today's enforcement exposure comes mostly from sector supervisors and data-protection authorities, not the AI Act. Outside credit scoring of individuals, most banking and insurance AI is not high-risk under the AI Act.
- The US is narrowing its rules while the EU is delaying but not retreating. US bank guidance and Colorado's AI law were cut back; EU platform-work and AI Act duties keep coming.
What should you do now?
- Get platform-work and Colorado notices ready. Before 2 December 2026, review algorithmic management in EU platform operations: worker information, human monitoring, review of significant decisions. By 1 January 2027, put in place Colorado pre-use notices, adverse-outcome explanations and three-year records.
- Check NYC bias audits. Confirm audits are current, independent and publicly posted, and candidate notices complete. Enforcement is likely to increase.
- Close the US generative and agentic AI gap. Keep SR 11-7-style validation, monitoring and effective challenge for generative and agentic AI, though the new guidance excludes them. Prepare for the agencies' planned request for information.
- Build one obligation map per AI use case. For each hiring, credit, trading, clinical or underwriting system, list every applicable sector rule plus the AI Act, GDPR and DORA. Meet shared requirements (bias testing, documentation, notices, human review) once; reuse the evidence.
- Treat model change as a regulated event. Use FDA PCCPs for planned clinical AI updates. Track accumulated AI changes to trading algorithms against RTS 6's material-change test. Align insurance AI with the NAIC bulletin and Colorado reporting.
Which rules apply to each AI use case?
Siloed compliance duplicates work and misses gaps. A hiring model used in New York and the EU needs an annual bias audit under NYC Local Law 144 (LL144). It is AI Act high-risk (Annex III) from 2 December 2027; GDPR applies now.
Financial services
| Regime | Status | Core obligations |
|---|---|---|
| Regime US model risk management (MRM) guidance (OCC, Fed, FDIC) | Status Issued 17 Apr 2026. Rescinds SR 11-7, OCC 2011-12 and FDIC FIL-22-2017 | Core obligations Principles-based; aimed mainly at banks over $30bn in assets (was $1bn). Narrower "model" definition excludes rule-based tools. Independent, expert effective challenge; covers vendor models. Excludes generative and agentic AI; a request for information is planned. |
Employment
| Regime | Status | Core obligations |
|---|---|---|
| Regime NYC Local Law 144 | Status In force | Core obligations Annual independent bias audit (impact ratios by sex, race and ethnicity). Public summary of the results. Candidate notice of the characteristics assessed and the right to request an alternative process or accommodation. |
Health
| Regime | Status | Core obligations |
|---|---|---|
| Regime FDA predetermined change control plans (PCCPs) | Status Final guidance, 4 Dec 2024 (non-binding) | Core obligations Pre-authorises planned AI software updates via a description of modifications, a modification protocol and an impact assessment. |
Insurance
| Regime | Status | Core obligations |
|---|---|---|
| Regime Colorado SB21-169 and Division of Insurance rules | Status In force. Life since 2023; private auto (including telematics) and health benefit plans since 15 Oct 2025 | Core obligations Board-overseen governance of external consumer data and models; annual reviews; consumer information after adverse decisions; unfair-discrimination testing (quantitative rule still a 2023 draft). Compliance counts as compliance with SB 26-189. |
Who enforces these rules, and what are the penalties?
The largest fines are EU ones, but AI Act high-risk duties start only in December 2027.
| Regime | Enforcer | Maximum penalty |
|---|---|---|
| Regime EU AI Act | Enforcer National market surveillance authorities; AI Office for general-purpose AI | Maximum penalty High-risk breaches: €15m or 3% of worldwide turnover, whichever is higher. Prohibited practices: €35m or 7%. |
A December 2025 State Comptroller audit found NYC's LL144 enforcement ineffective (at least 17 issues where the city found one). Expect tightening.
How are US and EU rules diverging?
US bank model-risk guidance has been replaced. SR 11-7 and OCC 2011-12 were rescinded on 17 April 2026 and replaced by principles-based guidance. It excludes generative and agentic AI, so firms must govern them themselves. Boards will still be asked how they are controlled.
Colorado's AI Act has been replaced. SB 26-189, signed 14 May 2026 and effective 1 January 2027, is a narrower notice-and-explanation law. It drops the original duty of care and impact assessments.
EU platform work rules land soon. Member States must transpose the Platform Work Directive by 2 December 2026; the Commission says the deadline will not move. As of May 2026, none had.
The EU is formalising the layering, not retreating. The AI Omnibus (Regulation 2026/1744) has applied since 27 July 2026. Via delegated acts, it lets the Commission limit some AI Act duties for high-risk systems covered by equivalent or stronger sector rules. Sector law thus matters more, not less.
- AI Act high-risk duties apply from 2 December 2027 for Annex III uses such as hiring and credit.
- They apply from 2 August 2028 for AI in regulated products (Annex I), such as medical devices.
What counts as a sector-specific AI rule?
"Sector-specific AI rules" are existing rules for models, decisions and products, now applied to AI. Much of this layer is US law.
Four clusters are covered: financial services, employment, health and insurance. Alongside apply the EU AI Act (Regulation 2024/1689), GDPR and, for financial firms, DORA, the EU's ICT resilience regulation.
Which dates matter?
| Date | Event |
|---|---|
| Date 4 Dec 2024 | Event FDA final guidance on PCCPs for AI-enabled devices |
| Date 17 Jan 2025 | Event DORA applies |
Where does this come from?
- Orrick — Agencies Overhaul Model Risk Management Guidance for Banks (Apr 2026)
- Herbert Smith Freehills Kramer — ESMA supervisory briefing on algorithmic trading under MiFID II
- Holland & Knight — Colorado Governor Signs SB 189 (May 2026)
- DLA Piper — Critical audit of NYC AI hiring law (Jan 2026)
- EUR-Lex — Directive (EU) 2024/2831 on platform work
- Foley — FDA final guidance on AI device software PCCPs
- Debevoise — Colorado extends AI regulation to auto and health insurers