Home / Who it is for / Sectors
Built for regulated organisations.
The control system is the same wherever it is installed. What changes from one sector to the next is the set of rules it has to answer to. We add those as an extra layer for your sector, called a sector overlay.
One system, with your regulator’s rules on top.
An overlay is used alongside the core system. It does not replace it. The core is already aligned to the UK Government’s principles for AI regulation, the EU AI Act and the NIST AI RMF, and nothing is rebuilt for each sector.
Your sector
Regulated infrastructure, public sector, financial services, or housing and social care.
The sector overlay adds
- Higher risk ratings for the uses your regulator watches
- Additional AI Impact Assessment questions
- The evidence your regulator expects
- A map of each obligation to the part of the system that demonstrates it
One control system
- Agent Passport®
- Oversight and approvals
- Who decides what, and how issues are raised
- Reporting
Whatever the sector, the regulator asks the same thing. Can you show that AI is under control where people use it?
Find your regulator.
Each entry gives the rules as they stand and the dates to watch. Open the one that applies to you.
Regulated infrastructure
Gas, electricity, water and telecoms. Organisations licensed by Ofgem, Ofwat or Ofcom, and those that serve them.
- Where the rules stand
- All three regulators have published material on AI, and none of it creates binding AI rules. Ofgem published good practice guidance on the ethical use of AI in the energy sector on 20 May 2025, and updated it on 13 May 2026. Ofwat published its AI adoption plan for the water sector in June 2026. Ofcom published its strategic approach to AI for 2026/27 on 4 June 2026. In practice, AI use is governed through your existing licence conditions and data obligations.
- Documents and dates
- Ofgem ethical AI guidance (2025, updated 2026). Ofwat AI adoption plan (2026). Ofcom AI approach 2026/27. Licence conditions. UK Government principles for AI regulation (2023 white paper, 2024 response). NIST AI RMF.
- Roles involved
- The AI governance lead, legal or regulatory affairs, IT security and the executive committee.
Public sector
Central government departments, arm’s-length bodies and local authorities.
- Where the rules stand
- The public sector carries a duty the private sector does not: being open with citizens about how algorithms are used. Algorithmic transparency recording is mandatory in central government. It was rolled out in phases from March 2024 and covers ministerial and non-ministerial departments, and arm’s-length bodies that provide public or frontline services or routinely deal with the public. Across the rest of the public sector, including local government, it is recommended, not mandatory. Equality duties under section 149 of the Equality Act 2010 apply throughout, as does data protection scrutiny of automated decision-making.
- Documents and dates
- Algorithmic Transparency Recording Standard (mandatory in central government). Public Sector Equality Duty, section 149. ICO: data protection impact assessments and automated decision-making. Technology Code of Practice. UK Government principles for AI regulation (2023 white paper, 2024 response).
- Roles involved
- The AI governance lead, the senior responsible owner, the data protection officer and the digital or technology director.
Financial services
Banks, insurers, asset managers, payments and consumer-credit providers serving the UK or the EU.
- Where the rules stand
- The regulators have been clear that AI is governed through the frameworks that already exist, not a new AI law. The Senior Managers and Certification Regime was reformed in April 2026 (FCA PS26/6 and PRA PS12/26), the first phase of a wider review. The FCA’s consultation on the scope of the Consumer Duty (CP26/23) closed on 18 September 2026, with a policy statement expected in the first quarter of 2027. The direction has not changed. The burden of proof sits with the firm, and AI outcomes sit within existing senior-management accountability.
- Documents and dates
- FCA SM&CR (reformed 2026). Consumer Duty. PRA SS1/23. EU AI Act Annex III. US SR 26-2, which replaced SR 11-7 in April 2026.
- Roles involved
- The AI governance lead, the chief risk officer, the model risk team, compliance and senior management function holders.
Housing and social care
Registered providers of social housing, housing associations and adult social care providers.
- Where the rules stand
- Regulation here became proactive in 2024. The four consumer standards have been in force since 1 April 2024, and the Housing Ombudsman’s Complaint Handling Code became statutory on the same date. Awaab’s Law is being introduced in phases, through regulations made under the Landlord and Tenant Act 1985 as amended by section 42 of the Social Housing (Regulation) Act 2023. Phase 1 began on 27 October 2025. Subject to parliamentary approval, Phase 2 adds seven further hazard categories from 30 November 2026. Neither the Regulator of Social Housing nor the Housing Ombudsman has published dedicated guidance on AI. The Ombudsman now records AI complaints as their own category and encourages landlords to train staff on the appropriate use of AI, and the Regulator expects landlords to understand the data protection implications of adopting it. AI use is therefore governed through data protection law, the consumer standards and board accountability. The Care Quality Commission set out its role and expectations for AI in health and social care on 21 May 2026.
- Documents and dates
- RSH consumer standards (1 April 2024). Housing Ombudsman Complaint Handling Code (statutory). Awaab’s Law Phase 2 (30 November 2026, subject to parliamentary approval). Care Quality Commission: AI role, expectations and plans (May 2026). ICO: data protection impact assessments and automated decision-making. UK Government principles for AI regulation (2023 white paper, 2024 response).
- Roles involved
- The AI governance lead, the director of digital, the data protection officer, the head of compliance and the executive team.
Start with your own regulatory context.
The AI Control Diagnostic includes an assessment of your risk position against the rules for your sector. The plan it produces is built for your organisation.