Industry Regulations for AI
No AI guidance from your regulator is not the same as no rules.
What is industry regulations?
Industry regulation for AI means applying your sector existing obligations, on outsourcing, record keeping, customer treatment and governance, to systems those rules were written before anybody imagined.
Organisations in regulated sectors often wait for their regulator to publish AI guidance before doing anything. The waiting is the mistake. Rules on outsourcing, record keeping and how customers are treated apply already, whatever technology sits underneath.
Outsourcing is the clearest case. Handing part of a regulated activity to an external provider has been governed for years, and using a foreign AI service is exactly that, even though nobody involved called it outsourcing.
Two regulators usually apply at once. The Data Commissioner governs personal data, and your sector regulator governs the activity. Satisfying one does not settle the other, and where they differ the stricter position is the one you have to hold.
Why we do not speak for your regulator
Duara works with regulated organisations in Kenya on how sector obligations apply to AI systems.
We do not tell you what your regulator will accept, because only your regulator can say that. Where a position is genuinely ambiguous we recommend asking them, which is slower than a supplier opinion and considerably more durable.
Who this is for
- You operate in a regulated sector
- Your regulator has asked about AI use
- You are unsure which rules cover automation
- You are waiting for AI specific guidance before acting
Industries we serve
- Banking under the Central Bank
- Insurance under the regulator
- Telecommunications
- Healthcare providers
- Pensions and capital markets
- Licensed financial services
Problems this solves
These are the ways regulated organisations misjudge where AI sits in their obligations.
- Waiting for AI specific rules. Existing obligations apply now, and an inspector will ask about them rather than about guidance that has not been published.
- Outsourcing not recognised as outsourcing. Using an external AI provider for part of a regulated activity is delegation, whatever the contract is titled.
- One regulator satisfied, the other assumed. Data protection and sector rules both apply, and meeting one does not resolve the other.
- Nothing to show on approval. The common inspection question is who approved this and on what basis, which is a governance record rather than a technical one.
What we deliver
Identifying which existing sector obligations reach your AI use, translating them into requirements for systems and staff, and preparing the records an inspector will ask for.
The sector rules that apply to your specific use
Requirements translated into system and process changes
Approval and governance records prepared
Outsourcing treated as outsourcing where it is
The stricter position identified where regulators differ
A watch on rules as your sector publishes them
Features
- Existing rules applied first. Obligations written before AI still reach it, which is what an inspector will work from rather than absent guidance.
- Outsourcing named correctly. Delegating part of a regulated activity to an external service carries duties regardless of what the arrangement is called.
- Both regulators handled. Data protection and sector obligations addressed together, since satisfying one leaves the other untouched.
- Approval trails built. Who decided, on what basis and with what authority, because that is the question inspections open with.
- Ambiguity referred, not guessed. Where a position is genuinely unclear we recommend asking your regulator rather than offering you our reading of it.
Benefits
- Inspections have answers. Governance records prepared in advance turn a difficult meeting into a straightforward one.
- No waiting required. Acting under existing rules removes the reason organisations give for postponing AI decisions indefinitely.
- Outsourcing exposure closed. Treating a provider arrangement as the delegation it is prevents the finding that it was never assessed.
- A defensible position. Meeting the stricter of two overlapping requirements holds up whichever regulator asks first.
What sector rules usually cover
- Outsourcing obligations. Duties that attach when part of a regulated activity is performed by somebody else.
- Record keeping. What must be retained about decisions, and for how long, which usually exceeds what a system keeps by default.
- Customer treatment. Rules about decisions affecting customers, including what they must be told and how they can complain.
- Governance and approval. Who may authorise a system of this kind, and the evidence that they did.
- Business continuity. What happens if the provider becomes unavailable, which regulators ask about more than organisations expect.
- Reporting duties. What must be reported to the regulator, and within what period, when something goes wrong.
The question that opens most inspections is who approved this and on what basis. That is a governance record rather than a technical one, and it is the thing organisations most often cannot produce.
How the process works, step by step
This work usually takes three to five weeks, depending on how many regulated activities the AI system touches.
-
Step 1
Free position call
We establish which activities the system touches and which regulators have an interest in them.
-
Step 2
Obligations mapped
The existing rules that reach your use, rather than a summary of your sector rulebook.
-
Step 3
Requirements translated
What each obligation means for the system, the process and the people operating it.
-
Step 4
Records assembled
Approval trails and evidence prepared before an inspection rather than during one.
-
Step 5
Open questions referred
Genuinely ambiguous positions identified for your regulator or counsel rather than resolved by us.
Quality assurance and how we work
The commitments attached to advice with a regulator on the other side of it.
- We do not predict what your regulator will accept. Only they can say, and a supplier assurance is worth nothing in the room where it matters.
- We recommend asking when the position is unclear. It is slower than an opinion from us and it produces an answer you can actually rely on.
- We are not lawyers. We translate obligations into system and process requirements, and your counsel holds the legal reading.
- We apply the stricter of two requirements. Where data protection and sector rules differ, meeting the lower one leaves you exposed to whichever regulator asks.
- We tell you when a system is not defensible. Some arrangements cannot be made to satisfy the rules that govern them, and hearing that early is cheaper.
Frequently asked questions about industry regulations
Our regulator has not published AI rules, so are we clear?
No. Rules on outsourcing, record keeping and customer treatment apply already, and an inspector works from those rather than from absent guidance.
Is using an AI provider outsourcing?
Where it performs part of a regulated activity, yes. Delegation carries duties regardless of what the arrangement is titled.
Does data protection compliance cover us?
No. The Data Commissioner governs personal data and your sector regulator governs the activity, and both apply at once.
What if the two sets of rules differ?
You hold the stricter position. Meeting the lower one leaves you exposed to whichever regulator asks the question first.
What do inspectors usually ask first?
Who approved this and on what basis. That is a governance record rather than a technical one, and most organisations cannot produce it.
Should we wait for guidance before adopting AI?
Waiting is the mistake most regulated organisations make. The existing rules apply now and are what you will be judged under.
Can you tell us our regulator will be satisfied?
No. Only they can say that, and a supplier assurance is worth nothing in the room where it matters.
What should we do about a genuinely unclear rule?
Ask your regulator. It is slower than taking our reading of it and it produces an answer you can actually rely on.
Do record keeping rules affect AI systems?
Frequently, and they usually require more than a system retains by default, which is a change to make before an inspection rather than after.
What about continuity if the provider disappears?
Regulators ask about this more than organisations expect, particularly where the provider is foreign and the activity is licensed.
Does this apply to internal AI use?
Where it touches a regulated activity, yes. Internal tools escape attention until they affect a customer outcome or a record.
Which sectors have the tightest rules?
Banking, insurance and healthcare in most cases, though telecommunications obligations reach further than people expect.
Do we need to notify our regulator?
Sometimes, depending on the activity and the arrangement, which is one of the first things worth establishing rather than assuming.
Can a foreign provider be used at all?
Usually, with the outsourcing obligations met and the transfer position addressed. The rules constrain how rather than whether.
How soon would we know where we stand?
Three to five weeks, depending on how many regulated activities the system actually touches.
Will you speak to our regulator for us?
No. That conversation belongs to you and your counsel, and we prepare what you need for it.
What if our system cannot meet the rules?
We say so. Some arrangements cannot be made defensible, and hearing that early costs far less than hearing it at inspection.
Do rules change often?
Sectors are actively looking at AI, so positions move. That is a reason to keep watching rather than to defer acting.
Who sees our regulatory records?
Only the people doing the work, under whatever confidentiality terms you set before we begin.
What does regulatory work cost?
The number of regulated activities involved determines it, quoted after the position call.
Glossary of terms
Regulatory terms in plain language.
- Outsourcing
- Having part of a regulated activity performed by somebody else, which carries duties whatever the contract is called.
- Sector regulator
- The body governing your industry activity, as distinct from the Data Commissioner who governs personal data.
- Approval trail
- The record of who authorised a system and on what basis, which inspections usually open with.
- Record keeping obligation
- What you must retain about decisions and for how long, often longer than a system keeps by default.
- Continuity requirement
- What happens if a provider becomes unavailable, which regulators raise more often than organisations expect.
- Reporting duty
- What must be told to the regulator when something goes wrong, and within what period.
Related services in AI Compliance
Talk to us about industry regulations
Ask whether your AI provider arrangement was assessed under your outsourcing rules. In most organisations it was not.
Start your project