AI agent governance by industry
The controls are constant; the examiner changes. These pages map agent governance to the two industries where the regulatory surface is concrete enough to cite: banking and financial services, and healthcare.
Get an Agent Trust Gap BriefSame controls, different examiners
Agent governance does not change shape by industry; the interrogation does. A bank answers to model risk supervision, a health system to HIPAA audit trails. Both need the same thing underneath: per-action evidence of authority.
| Industry | Governing surfaces | What the examiner asks |
|---|---|---|
| Banking & financial services | OSFI E-23 (May 2027) · DORA · SR 11-7 · NYDFS | Is the agent in the model inventory? Validated? Monitored? Can you explain one decision? |
| Healthcare | HIPAA · FDA device thinking · state AI law · 42 CFR Part 2 | Minimum-necessary access? Clinical boundary provable? Retention matched to obligation? |
Workload-level detail lives under use cases; jurisdiction detail under regions.
Common questions
Which industries regulate AI agents most heavily?
Banking and financial services, through model risk management regimes (SR 11-7, OSFI E-23, DORA), and healthcare, through HIPAA and device regulation. Neither names agents; both bind their effects.
Does agent governance differ by industry?
The control set barely changes - identity, policy gates, approvals, receipts, revocation. What changes is which regulator asks, which records they expect, and how long evidence must survive.
Where should a regulated firm start?
With the action inventory: what can each agent cause to happen that cannot be undone. Every industry regime maps onto that list, not the other way round.
What about industries with no AI-specific rules?
Existing sectoral law still binds automated effects - consumer protection, contract, privacy. No AI statute does not mean no obligations.
Why do you only publish two industry pages?
Because these are the two where we can cite named instruments with dates. Pages for other industries appear when there is something sourced to say, not before.
Last verified 2026-08-11. Not legal advice.
A bank answers to model-risk supervision and a health system to audit trails, but both need the same thing underneath: per-action evidence of authority.