Artificial intelligence is especially attractive in industries overwhelmed by information. Healthcare organizations process enormous volumes of patient data, clinical records, insurance information and administrative documentation. Financial institutions analyze equally vast quantities of transactions, customer information, credit histories and market data. AI promises to make sense of all of it faster, and in many cases it already does.

AI can identify patterns, summarize records, detect anomalies, automate administrative work and help professionals reach the relevant information far more efficiently than traditional manual processes. In healthcare, it is increasingly incorporated into medical devices and clinical decision-support systems, while financial institutions are exploring its use across fraud detection, cybersecurity and customer service.

However, regulated industries carry a level of responsibility that makes AI deployment particularly consequential. An inaccurate marketing draft can be corrected. An inaccurate output that influences a patient’s treatment or a consumer’s access to credit may create consequences difficult to reverse.

Responsible adoption in these sectors requires organizations to understand the systems they are deploying. They must be both cautious and clear on the information AI systems receive, how outputs are being used and who is accountable for the decisions that follow.

Sensitive Data Changes the Equation

The first concern is data. AI systems depend upon information, and industries such as healthcare and financial services hold some of the most sensitive information an individual can provide.

In healthcare, the HIPAA Security Rule requires regulated entities to protect the confidentiality, integrity and availability of electronic protected health information. Introducing AI into the workflow creates another environment in which organizations must understand how protected information is being handled.

Before sensitive information is entered into an AI system, organizations should know where it will go, whether the provider retains it, whether it can be used for model training, who may access it and where it is stored. Financial institutions should be asking substantially the same questions about customer records, account information, transaction data and proprietary business information.

This is one of the areas where AI’s convenience can become dangerous. An employee may view an AI platform as another productivity tool and upload information without appreciating that the platform is operated by an external provider under its own contractual terms. If the organization does not understand those terms, it cannot properly understand its exposure.

When AI Influences the Decision

Risks increase when AI moves beyond administrative assistance and begins influencing consequential decisions.

Consider a financial institution using automated systems to support credit decisions. The technology may analyze quantities of information that would be difficult for an individual employee to process manually, but existing legal obligations continue to apply to the creditor.Regulation B continues to require creditors taking adverse action to provide the applicant with the applicable notice and reasons for that decision. The sophistication of the technology involved does not remove the creditor from the process.

Healthcare suffers from the same affliction. AI may assist a clinician by identifying patterns, organizing patient information or providing decision support. The FDA’s January 2026 final guidance on Clinical Decision Support Software reflects the increasingly important distinction between software that supports healthcare professionals and software functions that fall within medical-device regulation.

This area continues to develop quickly. In August 2026, the FDA opened a new discussion on the regulation of generative AI-enabled medical devices, including questions surrounding risk assessment, premarket evaluation and post-market monitoring.

Each of these developments reinforce the importance of understanding precisely what role AI plays within a decision. A system that organizes information creates a different risk profile from one that recommends, influences or effectively determines an outcome.

Human Review Must Involve Judgment

Organizations frequently respond to concerns about automation by saying that a human remains “in the loop.” That assurance is meaningful only where the individual reviewing the output has the knowledge, authority and time to question it. Moreover, what about that individual’s potential bias or deference to AI systems? How is that risk mitigated? These are questions that must be considered even when there is human intervention.

A healthcare professional approving an AI-generated recommendation without independently considering the patient’s circumstances provides little oversight. The same is true of an employee routinely approving automated financial decisions because the volume of work makes genuine scrutiny impractical.

Human review needs to be built into the workflow in a way that is functional. Organizations should determine which uses require independent verification, when questionable results should be escalated, and who becomes responsible for the decision.

Financial Regulation is Also Adapting

The regulatory position surrounding AI in financial services continues to develop. In April 2026, the Federal Reserve, FDIC and OCC revised their interagency Model Risk Management Guidance, emphasizing a more tailored approach based on the size, complexity and model-risk profile of a banking organization.

This change is relevant to AI because federal banking regulators have recognized that rapidly developing technologies do not necessarily fit neatly within frameworks designed for traditional models. Federal Reserve Vice Chair for Supervision Michelle Bowman has explained that the revised guidance does not apply to generative or agentic AI and instead applies more narrowly to traditional models and basic AI applications.

We are past the point where AI governance can be copied from an existing model-risk policy. The controls need to reflect the particular technology, its use and the consequences if it fails.

Vendor Risk Cannot Be Ignored

Many healthcare organizations and financial institutions will not develop their own AI systems. They will purchase them, license them or integrate services supplied by external vendors. That can create a false sense that responsibility for the technology has also been outsourced.

Vendor diligence should include data retention, cybersecurity, access controls, model changes, subcontractors, incident reporting and contractual restrictions governing customer information. Organizations also need to establish what happens when the provider updates the underlying system, because AI products can change considerably after initial procurement.

The federal banking agencies’ revised 2026 guidance specifically discusses considerations surrounding vendor and third-party products, including validation where the guidance applies. More broadly, NIST’s AI Risk Management Framework continues to provide a useful voluntary structure for identifying and managing AI risk throughout an organization’s operations. NIST is currently revising AI RMF 1.0, demonstrating how quickly the governance environment itself is developing.

Risk Management Must Develop With the Technology

AI has enormous potential in healthcare, financial services, and other highly regulated industries. Used carefully, it can reduce administrative burdens, identify relevant information more quickly, strengthen certain forms of monitoring and allow professionals to devote more attention to work requiring human expertise.

The difficulty is that the technology continues to develop faster than many organizations’ internal controls. Generative AI is already giving way to increasingly agentic systems capable of taking actions across workflows, while regulators are still determining how existing legal frameworks should apply to those capabilities. 

Organizations operating in these sectors therefore need to treat AI risk management as an ongoing process. Healthcare and financial services have always depended heavily on trust. AI may change how information is processed and how decisions are supported, but it does not remove the responsibilities attached to handling sensitive information or making decisions that materially affect people’s lives.

If your organization is considering the adoption of AI technologies or reviewing its existing approach to AI risk management, please contact the team at TALG to discuss the legal and regulatory considerations involved.