AI in Regulated Industries Evidence Map
A compact map of primary sources for healthcare, finance, data protection, security and AI literacy, with questions to ask before relying on a vendor claim.
Healthcare
- Check regulator status for the exact product and intended use.
- Separate device authorisation from evidence of benefit in your setting.
- Review monitoring, workflow and human-oversight evidence.
Financial services
- Check FCA and Bank of England material for sector-specific expectations and adoption evidence.
- Map third-party model and cloud dependencies.
- Distinguish assisted decisions from full autonomy.
Data protection and security
- Map personal-data purpose, lawful basis, minimisation and rights.
- Use security guidance across development, deployment and operation.
- Treat supplier changes as a trigger for review.
Governance evidence
- Keep source dates and links beside important claims.
- Record limitations as well as benefits.
- Prefer regulator, government, standards and peer-reviewed sources over vendor summaries.
Evidence behind this checklist
- US Food and Drug Administration · FDA Issues Comprehensive Draft Guidance for Developers of Artificial Intelligence-Enabled Medical Devices · 2025-01-06 · Primary source
- Bank of England and Financial Conduct Authority · Artificial intelligence in UK financial services - 2024 · 2024-11-21 · Primary source
- Information Commissioner’s Office · Guidance on AI and data protection · 2025-06-19 · Primary source
- UK Government · Code of Practice for the Cyber Security of AI · 2025-01-31 · Primary source
- European Commission, AI Office · AI Literacy - Questions & Answers · 2025-11-19 · Primary source