Overview

You work for a U.S.-based manufacturing company. You're considering using an AI system to optimize your supply chain and procurement operations. The system would analyze supplier data, pricing, delivery times, and quality metrics to recommend optimal orders. It's a great productivity move. Then your general counsel mentions that the EU AI Act is coming into effect in 2025, and you suddenly need to understand what that means for your operations.

Or you work in healthcare operations, and you're eyeing AI tools to streamline patient scheduling and resource allocation. HIPAA applies to your organization, which means there are specific requirements around how you handle protected health information. What can the AI system access? What safeguards need to be in place? What does your business associate agreement with the vendor need to say?

Or you're in financial services. You want to use AI to optimize your operations processes, but you work under GLBA (Gramm-Leach-Bliley Act), which has specific requirements around information security and safeguarding customer data. Does your AI system trigger those requirements? What needs to be documented?

Generic compliance frameworks like SOC 2 and ISO 27001 set a baseline. But industry-specific regulations layer additional requirements on top. These regulations exist because certain industries handle particularly sensitive information (health data, financial data, employee data, consumer data) or make particularly important decisions (hiring, lending, healthcare). When AI enters the picture, regulators care deeply about how those sensitive domains are handled.

This lesson walks through the major industry-specific regulations that affect AI in operations, focusing on practical implications for operations professionals. We're not going to teach you the entirety of each regulation. We're going to help you understand which regulations apply to you, what they specifically require around AI, and how to start thinking about compliance in your specific context.

The EU AI Act: The Regulation Everyone's Worried About

The EU AI Act is the first comprehensive legal framework for AI in the world. It came into force in January 2024 and enters into full application phases through 2025. It's not just an EU law. It affects any organization that develops, deploys, or uses AI systems that affect EU residents. That means U.S. companies, Asian companies, anyone with EU operations or customers is in scope.

The EU AI Act classifies AI systems by risk level: prohibited, high-risk, limited-risk, and minimal-risk. It then layers different requirements depending on the risk classification.

Prohibited AI: The EU has banned certain AI applications outright. Examples include: subliminal or emotional manipulation techniques, real-time biometric identification in public places, social scoring systems, and AI that creates manipulative profiles without consent. For operations professionals, this rarely applies. You're unlikely to be building social scoring or real-time biometric systems in your operations.

High-Risk AI: The EU defines high-risk AI as systems that significantly affect people's rights or safety. Examples include: AI used for hiring decisions, employee performance monitoring, resource allocation, and credit/lending decisions. These are exactly the kinds of systems operations professionals consider.

If you're using AI to make or significantly influence decisions about hiring, promotion, scheduling, vendor selection, resource allocation, or credit, you're probably operating a high-risk system under the EU AI Act. High-risk systems require: impact assessments, documentation, transparency, human oversight, audit trails, and fairness testing.

Limited-Risk and Minimal-Risk AI: Systems that don't rise to high-risk status have lighter requirements. A basic AI chatbot for customer support might be limited-risk (requiring transparency disclosures). An AI system that analyzes public information to recommend process improvements might be minimal-risk (minimal requirements).

The practical implication: if you're an operations professional in the EU or working with EU operations, use AI for advisory functions (AI recommends, human decides) rather than autonomous functions (AI decides) when dealing with high-risk decisions. Or implement the high-risk controls: document your decision-making process, test for fairness and bias, maintain audit trails, ensure human oversight of material decisions, and be transparent about when AI is involved in decisions.

The EU AI Act also imposes obligations on AI system providers (vendors). It requires them to document their models, implement security measures, and provide transparency. This is good news for you as an operations professional using AI tools: you can rely on vendor commitments for many of the technical requirements. But you still need to implement the operational requirements (oversight, audit trails, fairness testing) on your end.

HIPAA: Healthcare and AI

HIPAA (Health Insurance Portability and Accountability Act) applies to covered entities (healthcare providers, health plans, healthcare clearinghouses) and business associates (vendors who handle protected health information on behalf of covered entities).

If you work in healthcare operations or any healthcare-adjacent operations role, HIPAA applies. Protected health information includes: patient names, medical record numbers, dates of service, diagnosis codes, treatment information, insurance information, and any other information that could identify a patient and relate to their health.

HIPAA has specific requirements around electronic protected health information: encryption (data must be encrypted at rest and in transit), access controls (only authorized people can access data), audit trails (must log who accesses data and when), and incident response (must respond to breaches).

When you want to use an AI system in healthcare operations, you need to determine: does the system have access to protected health information? If yes, is the AI vendor a HIPAA-covered entity or will they be your business associate?

If the AI vendor will be your business associate, you need a Business Associate Agreement (BAA) that specifies: (1) the vendor will only use the data for the purposes you specify, (2) the vendor will implement security safeguards (encryption, access controls, audit trails), (3) the vendor will sub-contract to other vendors only with your approval, (4) the vendor will audit their own compliance, (5) the vendor will respond to any breach, (6) the vendor will delete or return data when you request.

The good news: major cloud vendors (Microsoft, Google, AWS) have standard BAAs available. If you want to use Microsoft 365 or Google Workspace with HIPAA data, you can. You need to request their BAA and they'll provide it. It's not a one-off negotiation.

The complication: most free or consumer AI tools don't have BAAs available. If you're a healthcare organization and you want to use ChatGPT with patient data, you need to use the enterprise version (Microsoft's deployment) where a BAA is available. Free ChatGPT is not HIPAA-compliant because there's no BAA.

As an operations professional in healthcare, the practical requirement is: any AI tool that touches patient data, appointment information, or provider information needs a BAA. Any AI tool used for operational decisions (scheduling, resource allocation, vendor management) that doesn't touch patient data is generally fine, but you should document that it's not handling PHI.

HIPAA and De-Identification

If you de-identify healthcare data (remove patient identifiers so it can't be linked back to individuals), HIPAA no longer applies to that data. This is a powerful tool in healthcare operations. Before sending healthcare operational data to an AI system, consider de-identifying it. Remove patient names, medical record numbers, dates of service (or aggregate to year/month only), and any other identifying information. De-identified data can be sent to any AI system without a BAA. Be careful though: de-identification must be technically sound. If someone could plausibly re-identify the data by linking it to other information, it's not truly de-identified.

GLBA and Financial Services Regulation

GLBA (Gramm-Leach-Bliley Act) applies to financial institutions: banks, credit unions, insurance companies, securities firms, and other entities that handle consumer financial information.

GLBA requires that financial institutions safeguard consumer information, and it gives regulators (federal banking agencies, SEC, FTC) authority to establish security standards. Beyond GLBA itself, each regulator has additional requirements: the OCC, Federal Reserve, FDIC, and CFPB all have guidelines for information security in financial institutions.

More recently, regulations around AI in financial services have gotten more specific. The SEC issued guidance on AI and machine learning (noting that firms using AI systems need to understand how the systems work, manage model risk, and address bias). The CFPB issued guidance on unfair, deceptive, or abusive acts, noting that AI systems can violate consumer protection laws if they produce discriminatory or unfair outcomes.

For operations professionals in financial services, AI triggers requirements in several areas:

Model Risk Management: If you're using an AI system to make credit decisions, underwriting decisions, or pricing decisions, the system is "model risk." You need to understand the model's mechanics, validate that it works as intended, monitor its performance over time, and be able to explain its outputs. Financial regulators take model risk seriously because bad models can lead to unfair treatment of customers or operational losses.

Bias and Discrimination: AI systems used in lending or customer decisions must be evaluated for bias. If an AI system produces disparate impact on protected classes (denying credit more often to a particular race or gender, for example), that's a violation. You need to be able to demonstrate that your system is fair. This requires: testing for bias, monitoring ongoing decisions for disparate impact, and adjusting the system if bias is detected.

Transparency and Disclosure: If an AI system makes or significantly influences a financial decision affecting a customer, many regulations require that you inform the customer that AI was involved and provide them a way to contest the decision. This is true for FCRA (Fair Credit Reporting Act), ECOA (Equal Credit Opportunity Act), and GLBA itself.

Data Security: GLBA requires encryption, access controls, and incident response for consumer financial information. These requirements apply whether or not you're using AI. But when you integrate AI, you need to ensure the AI vendor also meets these requirements.

As an operations professional in financial services using AI, document the business justification for the system, perform a bias assessment, set up monitoring to catch unfair outcomes, ensure customer transparency, and maintain audit trails showing what the system did and why.

Labor Law and AI in Hiring, Scheduling, and Performance Management

Labor law is less centralized than healthcare or financial regulation, but it's increasingly addressing AI. Multiple jurisdictions (EU, states like Illinois and Colorado, cities like San Francisco) have passed laws regulating AI in employment decisions.

EEOC and Discrimination: The EEOC has made clear that employers are responsible for AI systems that produce discriminatory outcomes, even if discrimination wasn't intentional. If an AI system used for hiring recommendations systematically disadvantages women or minorities, that's a violation of Title VII regardless of the intent.

Algorithmic Transparency and Explainability: Multiple jurisdictions require that employers using AI in employment decisions disclose this to job applicants and employees. Some require that employers be able to explain the AI system's decision to affected individuals.

Opt-Out Rights: Some jurisdictions grant employees the right to request human review of AI decisions (especially for scheduling and performance decisions) and to request that their data not be used in AI systems.

Vendor Auditing: Employers are expected to audit AI vendors to verify they're complying with anti-discrimination laws. This means asking vendors for bias testing results and documentation of fairness assessments.

For operations professionals, this means: if you're using AI for hiring (resume screening, interview scheduling, candidate ranking), be prepared to explain the system, test it for bias, document the testing, and respond if someone complains about discriminatory outcomes.

If you're using AI for scheduling or performance decisions, similar principles apply. Transparency (tell employees an AI system is involved), fairness testing (verify the system doesn't disadvantage protected groups), and human oversight (for material decisions, have a human review the AI recommendation).

Industry-Specific Process for Checking Regulatory Applicability

Here's how to think through whether industry regulations apply to a specific AI use case in your operations:

Step 1: Identify Your Industry and Regulatory Environment

What industry are you in? Healthcare, financial services, insurance, manufacturing, retail, tech? Each industry has its specific regulatory bodies and requirements. Google "[your industry] compliance requirements" and you'll get a starting point.

What jurisdictions do you operate in? If you have EU operations or customers, GDPR and the EU AI Act apply. If you have California operations, CCPA applies. If you're a healthcare provider, HIPAA applies regardless of where you are. If you're a financial institution, your regulator applies (FDIC, OCC, SEC, etc.).

Step 2: Map the AI Use Case to Regulatory Triggers

What data does the AI system use? Personal data (regulated by GDPR, CCPA, state privacy laws), healthcare data (regulated by HIPAA), financial data (regulated by GLBA, FCRA, ECOA), employee data (regulated by employment laws)?

What decision does the AI system influence? Hiring (regulated by EEOC, state employment laws, EU AI Act high-risk), credit (regulated by FCRA, ECOA, GLBA, CFPB), healthcare (regulated by HIPAA and medical device regulations if applicable)?

Does the system have public or regulatory visibility? If regulators or the public could learn about this system, you need stronger controls. A scheduling recommendation visible only internally needs less documentation than a hiring recommendation that applicants might appeal.

Step 3: Identify Specific Regulatory Requirements

Once you've identified relevant regulations, look for specific AI-related requirements or guidance. Many regulators have issued guidance on AI (EEOC, SEC, CFPB, FTC, EU regulatory bodies). Read the guidance and map it to your system.

Step 4: Design Controls to Address Regulatory Requirements

Common controls across industries: (1) documentation of the system and its decision logic, (2) bias and fairness testing, (3) audit trails showing decisions, (4) human oversight of material decisions, (5) transparency to affected individuals, (6) ability to contest or appeal decisions, (7) vendor management (if using third-party AI).

Not every regulation requires every control. But if multiple regulations apply to your system, you'll likely need most of them anyway.

Create a Simple "AI Regulatory Checklist" for Your Industry

Document: (1) Your industry regulatory bodies and primary regulations, (2) For each regulation, which AI use cases trigger it (e.g., hiring triggers EEOC, credit decisions trigger FCRA), (3) For each trigger, the key requirements (e.g., test for bias, document decisions, ensure explainability). Then when someone proposes a new AI use case, walk it through the checklist. "We want to use AI for scheduling. Does this trigger any regulations? Check the checklist. Yes, employment law applies if scheduling decisions affect compensation or advancement. What controls do we need? Transparency, fairness testing, audit trails." This checklist becomes your risk assessment tool.

Emerging AI-Specific Regulations

Beyond the regulations discussed above, several jurisdictions are passing or considering AI-specific laws. The regulatory environment is evolving rapidly. Here are some things to watch:

U.S. Federal AI Bill of Rights: The White House issued a non-binding AI Bill of Rights emphasizing: rights to notice and explanation, the ability to opt out of AI systems, protections against algorithmic discrimination, and data privacy. While not law, these principles are influencing legislation and enforcement priorities.

State AI Laws: Colorado, Illinois, and other states have passed laws regulating AI in employment decisions. More states are considering similar laws. The trend is toward requiring transparency, bias testing, and audit trails for employment AI.

Sector-Specific AI Regulations: The FDA is establishing framework for AI in medical devices. The NIST has published AI Risk Management Framework that many organizations use as a baseline. The FTC is actively enforcing against unfair or deceptive AI use under Section 5 of the FTC Act.

International Convergence: The EU AI Act is a blueprint that other jurisdictions are considering. As more countries pass AI laws, the requirements are converging around similar themes: transparency, fairness, human oversight, documentation, vendor management.

The practical implication for operations professionals: the regulatory environment around AI is tightening. Systems that might have been acceptable two years ago are coming under scrutiny. The safest approach is to assume that if you're using AI to influence important decisions (hiring, scheduling, vendor selection, resource allocation), you'll need to explain the system, test for fairness, maintain audit trails, and have human oversight of material decisions. These controls will satisfy most current regulations and are likely to satisfy emerging ones too.

What to Do Monday Morning

• Identify your regulatory environment: Write down: (1) What industry are you in? (2) What regulatory bodies oversee you (FDIC, HIPAA, EEOC, SEC, etc.)? (3) What jurisdictions do you operate in (if EU, GDPR and EU AI Act apply)? (4) Are there specific AI-related guidance documents from your regulators? (You can usually find these on the regulator's website or by searching "[regulator] AI guidance.") This 30-minute exercise gives you your baseline.
  - Map one AI use case to regulatory requirements: Pick one AI system your organization uses (or wants to use). For each regulation you identified above, ask: does this regulation apply to this AI system? If yes, what are the specific requirements? Document your findings in a simple spreadsheet: Regulation | Applies? | Key Requirements | Current Controls | Gaps. This shows you what you're already doing well and where you need to improve.
  - Schedule a conversation with your legal or compliance team: Share what you've learned. Ask: "Am I missing any regulations?" "Are my interpretations correct?" "What's our risk tolerance for any gaps?" This gets you aligned with your legal team before you make operational decisions.

Key Takeaways

• The EU AI Act is the most comprehensive AI regulation and affects any organization with EU operations or customers: If your system is high-risk (hiring, performance, resource allocation decisions), you need impact assessments, documentation, transparency, and human oversight. Use AI for advisory (AI recommends, human decides) rather than autonomous decision-making for high-risk decisions.
  - HIPAA applies to healthcare and makes AI vendor relationships explicit: Any AI tool touching protected health information needs a Business Associate Agreement specifying data protection obligations. De-identification is powerful: de-identified data is no longer subject to HIPAA and can be sent to any AI system.
  - GLBA and financial regulations require model risk management: Understand how your AI system works, validate it produces fair outcomes, monitor performance over time, and be able to explain decisions. Bias testing and disparate impact monitoring are non-negotiable for credit, underwriting, and pricing AI.
  - Labor law increasingly regulates AI in employment decisions: Test AI systems used for hiring and scheduling for bias, maintain audit trails of decisions, provide transparency to affected employees, and ensure human review of material decisions. The EEOC holds employers liable for discriminatory AI outcomes.
  - The regulatory environment is evolving, and the trend is toward tighter requirements: Assume that AI systems influencing important decisions (hiring, resource allocation, customer decisions) will need documentation, fairness testing, and audit trails regardless of your specific jurisdiction.
  - Your legal and compliance teams are your best resource: Before deploying material AI systems, get their input. They can identify regulations you missed and requirements you're not meeting.

Frequently Asked Questions

Does the EU AI Act apply to my U.S. company?

Only if you have EU operations or EU customers and your AI system affects EU residents. If you're a U.S.-only company with U.S.-only customers, the EU AI Act doesn't apply. But if you have European customers, branches, or subsidiaries, or if your system operates online and could affect EU residents, the Act applies. The practical standard: if you're subject to GDPR (because you process EU residents' data), you're likely subject to the EU AI Act too (because you deploy AI systems affecting EU residents).

What's the difference between a HIPAA-covered entity and a business associate?

A HIPAA-covered entity is a healthcare provider, health plan, or healthcare clearinghouse that directly handles protected health information. A business associate is a vendor or contractor that handles protected health information on behalf of a covered entity. If you're a healthcare operations team (part of a hospital or health plan), you're operating as a covered entity. If you're an operations team for a non-healthcare company using an AI tool to process healthcare data, that AI vendor is your business associate. The distinction matters for compliance obligations: covered entities have full HIPAA compliance obligations. Business associates have a subset of obligations (mainly around data protection and audit trails).

Can I use free tools like ChatGPT for operational work in a regulated industry?

Only if the tool doesn't touch regulated data and doesn't make regulated decisions. A financial services company can use free ChatGPT for general operational analysis (how to improve our meeting scheduling process, best practices for vendor management). They cannot use free ChatGPT for credit analysis, customer data, or pricing optimization without GLBA controls. A healthcare organization can use free ChatGPT for workflow improvements but not for patient data. The test: if the tool touches regulated data (healthcare, financial, employee) or makes regulated decisions (hiring, credit, healthcare), you need controls (vendor contracts, audit trails, bias testing) that free tools don't provide.

Who's liable if an AI system discriminates against someone?

You are. The organization using the system is liable. The vendor who built it shares some responsibility, but your responsibility doesn't disappear. If you use a vendor's AI system to make hiring decisions and it systematically rejects qualified female candidates, the EEOC can hold your organization liable for discrimination. Your defense is that you tested the system for bias, found the issue, and fixed it. If you didn't test for bias, you have no defense. This is why bias testing and documentation are critical: they demonstrate you were managing the discrimination risk, even if your mitigation didn't catch everything.

What should I do if I'm not sure whether a regulation applies to my AI system?

Ask your compliance or legal team. They can review the system and tell you which regulations apply. It's worth the 30-minute conversation with them. The alternative is discovering mid-audit or after a regulatory inquiry that you missed a requirement. If you can't reach your compliance team immediately, assume a regulation applies if: your system touches sensitive data (personal, health, financial, employee), your system makes or influences important decisions (hiring, credit, compensation, healthcare), or your system operates in a regulated industry (healthcare, financial services, insurance). Design controls accordingly, and then get confirmation from compliance when you can.