External controls by sector

Sectors use the same basic setup and differ in which actions matter most, which rules already apply to them, and how much time the check has to decide.

Federal civilian agencies

Agencies are using agents to draft decisions, update case files, and correspond with the public. OMB M-25-21 applies its minimum practices to high-impact AI, meaning AI whose output serves as a principal basis for decisions or actions that have a legal, material, binding, or significant effect on rights or safety.

Actions to check: Eligibility and benefit determinations, case record changes, payments and debt actions, notices to the public, and changes to systems of record.
Applicable rules: OMB M-25-21 and M-25-22, the Privacy Act, agency records schedules, and NIST SP 800-53 controls under the system’s authorization.
What to require: A register at authorization (C-1), holds for high-impact actions (C-5), records kept under the records schedule (C-6), and the ability to discontinue a use case at the layer without taking down the whole system.

See also: procurement language and OMB mapping.

Defense and national security

Mission systems often run disconnected, across classification levels, and alongside coalition partners, so the layer has to work without reaching back to a vendor.

Actions to check: Commands to platforms and sensors, logistics and maintenance orders, network and configuration changes, and release of data across classification or coalition boundaries.
Applicable rules: The Department of Defense AI Ethical Principles (2020), including “Governable,” and Risk Management Framework controls drawn from NIST SP 800-53.
What to require: Hard enforcement at the point of effect, operation in disconnected and air-gapped modes, government-held signing keys (C-4), offline verification (C-7), and fleet-wide revocation and quarantine.

Pharmaceuticals and life sciences

In GxP work, procedures, training, and their records are part of the regulated system. An AI system that drafts SOPs, CAPA effectiveness reviews, validation protocols, or change control records is writing the evidence an inspector will rely on. Those uses warrant the same scrutiny as batch record review, even when they are classified as paperwork.

Actions to check: Releasing or revising SOPs, batch record entries, deviation and CAPA records, change control documents, validation protocols, and training records.
Applicable rules: 21 CFR Parts 11 and 211, and EU GMP Annex 11. EU GMP Annex 22, which is still in draft, would add that generative AI and large language models should not be used in critical GMP applications, and that appropriately qualified personnel are responsible for outputs in other uses.
What to require: No AI-originated change reaches an effective GxP record without a recorded decision by appropriately qualified personnel. Decision records meet the organization’s audit trail expectations. Action classes follow the organization’s GxP criticality assessment, which also covers procedural controls.

Financial services

Financial regulation already covers automated action at the point of effect. The market access rule requires pre-trade controls under the firm’s direct and exclusive control. The same logic applies to agents that pay, refund, or make commitments in the firm’s name.

Actions to check: Payments and refunds, changes to vendor and bank details, orders and trades, credit decisions, and customer statements that can bind the firm.
Applicable rules: SEC Rule 15c3-5 for market access. Under the EU AI Act as amended in 2026, AI used to assess the creditworthiness of individuals is high-risk under Annex III, point 5(b), and the obligations for such systems apply from 2 December 2027.
What to require: Limits on amount, counterparty, and velocity enforced at the layer; dual authorization above set thresholds; and holds on any change to payee or bank details.

Industrial systems, robotics, and critical infrastructure

When the point of effect is a motor, a valve, or a breaker, the time budget is short and the safe state is physical.

Actions to check: Motion commands, entry into zones shared with people, setpoint changes, valve and breaker operations, and firmware or logic updates.
Applicable rules: IEC 62443-3-3, OSHA 29 CFR 1910.147, the EU Machinery Directive 2006/42/EC, which Regulation (EU) 2023/1230 replaces from 20 January 2027, and functional safety standards such as IEC 61508 and ISO 13849.
What to require: The layer in front of the actuator, with decisions inside the control loop’s time budget; a defined safe state for each command class; and safety-rated functions that stay independent of both the AI system and the layer.

Software delivery and IT operations

Coding and operations agents often have write access to production, and in one documented failure an agent issued a destructive command during a code freeze.

Actions to check: Merges and deployments, infrastructure and permission changes, database writes and deletions, and access to secrets.
Applicable rules: NIST SP 800-53 CM-3, SOC 2 change management criteria, and the organization’s own change control process.
What to require: Agents may propose changes, but merges, deployments, and production writes pass through the layer. Change freezes are enforced at the layer, and any deletion of production data is held for a named approver.

See also: Replit analysis and implementation guide.