Guide · September 2026 edition
The AI Compliance Guide.
Bank examiners, insurance departments, and employment agencies ask the same four questions about AI, with different citations on the letter. This guide sets out what AI compliance means in practice for a regulated organization, the six duties every instrument shares across financial services, insurance, and HR, and a twelve-week program to get from a policy binder to evidence a stranger can verify. Free with a work email.
- One landscape page covering finance, insurance, and employment, each instrument linked to its reference entry and primary sources.
- A six-duty table that lets a multi-industry organization build one program instead of four.
- Opens right on this page; print or save as PDF once it's unlocked.
What's inside
Eight chapters, one program.
What compliance means, where it bites in each industry, the duties they share, and the order to build in.
What AI compliance means
The four questions an examiner asks, whatever the citation on the request letter: which AI runs, what data reaches it, who decided, where is the record.
Why AI traffic is different
Why the controls that cover your other systems miss AI: it arrives from everywhere, the unit is a conversation, the data leaves, and agents act.
The landscape, by industry
SR 26-2, NYDFS 500, and FINRA 24-09 for finance; the NAIC bulletin and state layers for insurance; Illinois, NYC, and Colorado for employment; the EU AI Act, DORA, ISO/IEC 42001, and SOC 2 across all three.
The common denominator
Six duties every instrument shares (inventory, data controls, decision records, human review, testing evidenced, change control) in one table, with the evidence that satisfies each.
A twelve-week program
Inventory and scope, then controls and records, then evidence and review cadence. What each phase builds and what it leaves behind.
Evidence that holds up
Tamper-evident records, observed versus attested, retention to the longest floor, and the failure modes that recur across every regulator's findings.