AI regulation by industry

Sector regulators, relevant rules and common base documents for each industry.

• Banking, lending and fintech

  Banks, lenders and fintechs use AI to decide who gets credit, at what price and how fraud is detected, decisions that directly affect people's finances. That is why credit scoring is high-risk in the EU and Peru, a consequential decision in Colorado, and financial supervisors expect AI models to be governed like any other risk.

• Insurance

  Insurers use AI to price, underwrite, handle claims and detect fraud, with a direct impact on access to life and health coverage. The EU classifies life and health insurance pricing as high-risk, and supervisors such as EIOPA, Peru's SBS and New York's regulator already expect data governance, explainability and discrimination testing.

• Healthcare and medical devices

  Hospitals, clinics and healthtech companies use AI to diagnose, triage patients and draft clinical records using health data, which is sensitive data everywhere. Errors can harm patients, so healthcare is high-risk in the EU and Peru, clinical software may be a medical device, and regulators such as Brazil's CFM and Colombia's Ministry of Health already require validation and medical oversight.

• Education and edtech

  Schools, universities and edtech companies use AI to admit, grade, proctor and tutor students, often minors. These decisions shape educational paths, so they are high-risk in the EU and Peru, emotion recognition in classrooms is banned in the EU, and children's data has heightened protection everywhere.

• Public sector

  Public bodies use AI to decide on benefits, inspections, permits and essential services, with direct effects on citizens' rights. That is why they are the first required to assess impact, keep public algorithm inventories and ensure human oversight, and they pass those requirements on to suppliers through public procurement.

• Retail and e-commerce

  Retailers and online stores use AI to serve customers through chatbots, personalize offers, set prices and generate product content. The main risk is to consumers: lack of transparency, discriminatory treatment or deceptive practices, so AI transparency rules, the right to a human agent, and consumer and data protection laws apply.

• Telecom and utilities

  Telecom, energy and water operators use AI to serve millions of customers, manage networks and decide on disconnections, billing or prioritization. They are essential services and critical infrastructure, so human-agent, cybersecurity and incident-reporting duties combine with high-risk rules for safety components of infrastructure.

• HR services and staffing

  Recruiters, staffing agencies and HR departments use AI to screen resumes, interview, evaluate and decide promotions or terminations. It is the most regulated AI use case: high-risk in the EU and Peru, bias audits in New York City, notices in Illinois, anti-discrimination rules in California and worker information duties in Spain.

• Delivery, mobility and gig platforms

  Delivery, ride-hailing and on-demand platforms use algorithms to assign tasks, set pay, rate and deactivate workers. That is why they have specific algorithmic management laws in Mexico, Chile, Colombia and the EU, requiring transparency, human oversight and appeal channels.

• Manufacturing

  Factories use AI for predictive maintenance, quality control, machine safety and operator monitoring. Regulation comes in two ways: product safety, when AI is a component of machinery or critical infrastructure, and labor and data law, when AI monitors or evaluates workers.

• Technology and SaaS

  Software companies build, integrate and sell AI features to other organizations, so they carry provider duties: technical documentation, information for customers, transparency and security. Enterprise and public-sector buyers also demand evidence of AI governance during procurement, even where no law requires it.

• Professional services (legal, accounting, consulting)

  Law firms, accounting firms and consultancies use generative AI to draft, research and analyze with confidential client information. The core risks are professional secrecy and liability for errors, so professional bodies expect due diligence on tools, informed client consent and human verification of every output.

• Marketing, media and agencies

  Agencies, media and marketing teams generate text, images, voices and video with AI at scale. The risks are misleading the public, using people's likeness or voice without permission and infringing copyright, so synthetic content labeling, consent for voice and likeness and substantiation of AI claims are already required.

• Real estate

  Real estate agencies, property managers and rental platforms use AI to value properties, screen tenants, set prices and answer prospects. Access to housing is highly sensitive to discrimination, so in the US AI tenant screening falls under fair housing and credit reporting laws, and Colorado and California treat it as a consequential decision.

• Transport and logistics

  Transport, logistics and mobility companies use AI to plan routes, assign drivers, monitor fleets and automate warehouses. Rules come from road and infrastructure safety, algorithmic management of drivers and couriers, and worker monitoring through geolocation and cameras.

• Private security and surveillance

  Security firms, surveillance operators and retailers use AI to recognize faces, detect behavior and control access. It is the most restricted use: the EU bans several biometric practices, Peru treats them as misuse, and in the US laws such as Illinois BIPA require written consent and generate large lawsuits.

• Other industry

  Any organization using AI, even in a sector without its own rules, is subject to horizontal laws: the EU AI Act, Peru's AI law and each country's data protection and consumer laws. The use case defines the obligations: serving customers, deciding about people or generating content changes the risk more than the industry does.