AI in Regulated Industries Evidence Map

Healthcare

• Check regulator status for the exact product and intended use.
• Separate device authorisation from evidence of benefit in your setting.
• Review monitoring, workflow and human-oversight evidence.

Financial services

• Check FCA and Bank of England material for sector-specific expectations and adoption evidence.
• Map third-party model and cloud dependencies.
• Distinguish assisted decisions from full autonomy.

Data protection and security

• Map personal-data purpose, lawful basis, minimisation and rights.
• Use security guidance across development, deployment and operation.
• Treat supplier changes as a trigger for review.

Governance evidence

• Keep source dates and links beside important claims.
• Record limitations as well as benefits.
• Prefer regulator, government, standards and peer-reviewed sources over vendor summaries.

Evidence behind this checklist

• US Food and Drug Administration · FDA Issues Comprehensive Draft Guidance for Developers of Artificial Intelligence-Enabled Medical Devices · 2025-01-06 · Primary source
• Bank of England and Financial Conduct Authority · Artificial intelligence in UK financial services - 2024 · 2024-11-21 · Primary source
• Information Commissioner’s Office · Guidance on AI and data protection · 2025-06-19 · Primary source
• UK Government · Code of Practice for the Cyber Security of AI · 2025-01-31 · Primary source
• European Commission, AI Office · AI Literacy - Questions & Answers · 2025-11-19 · Primary source

How evidence is selected and checked