Compliance & Regulation

Clients regularly ask me what types of questions regulators are asking or are likely to begin asking about artificial intelligence during examinations. Because there is still relatively little prescriptive examination guidance specific to AI, I find it more useful to focus on the regulatory signals emerging from recent agency documents, supervisory guidance, and public comments rather than trying to predict an exact examiner questionnaire.   Taken together,...

Why industry-specific cybersecurity expertise matters. Not all cybersecurity threats are created equal. Different industries face distinct cybersecurity challenges shaped by regulations, cybersecurity compliance requirements, and evolving cybersecurity threats. Generic cybersecurity vendors often take a one-size-fits-all approach which simply does not work. Failing to account for the unique cybersecurity threats and regulatory complexities that financial institutions and healthcare organizations must navigate can leave these organizations at...

For many organizations, the word “audit” triggers a mix of anxiety, uncertainty, and the sudden urge to search every email for the word “noncompliant.” And while it’s easy to view auditors as adversaries, the reality is far less dramatic—we’re not out to get you. But we will find the things you’ve overlooked....