CH 1 · CHALLENGE OF THE AGES 5
Five sectors anchor the analysis, each grounded in its own instruments:
Life sciences — U.S. FDA, the International Council for Harmonisation
(ICH), and ISO 13485:2016 (medical-device quality management systems)
Automotive — UN Regulation No. 156 (the UNECE software update
management regulation)
Aviation — the EASA AI Concept Paper, Issue 02 (the European Union
Aviation Safety Agency’s machine-learning guidance)
Nuclear — IAEA SSG-39 (the International Atomic Energy Agency’s safety
guide for instrumentation and control systems)
Finance — Federal Reserve SR 26-2 (the 2026 revised U.S. supervisory
guidance on model risk management, superseding SR 11-7)
One signal is worth marking at the outset. When the U.S. banking agencies re-
vised their model risk management guidance in 2026, they expressly placed
generative and agentic AI outside its scope, leaving those systems to each
organization’s broader governance and flagging a further consultation to come.
The newest guidance defers the AI-specific question to the architectural com-
mitments an enterprise builds across its lifecycle, which is exactly the ground
this book’s analysis categorizes.
The thesis is structural. Organizations that navigate the AI era successfully,
avoiding warning letters and patient harm, converge on the same architectural
commitments because the regulations have already specified them. The book
lays the analysis out so the categorization is in hand before the inspection
arrives.
The promise is concrete. By the end of the book, you will hold the categoriza-
tion the analysis lays out, and the obligations the regulations specify under
each. You will recognize, when a vendor presents their AI platform, whether
the answer they give to “how does this satisfy EU AI Act Article 14” is real or re-
hearsed. You will recognize, when a consultant scopes a transformation pro-
gram, whether the categories of obligation they organize their work around
match the categories an inspection will traverse. You will recognize, when a
colleague reports that “the AI flagged this exception,” whether the work behind
that statement can withstand the same question a regulator now knows to ask.
You will not become a data scientist. You will not need to. You will become the
kind of leader who can lead from understanding, ask the questions that matter,
and recognize whether the answers hold. That is the promise.
Five sectors anchor the analysis, each grounded in its own instruments:
Life sciences — U.S. FDA, the International Council for Harmonisation
(ICH), and ISO 13485:2016 (medical-device quality management systems)
Automotive — UN Regulation No. 156 (the UNECE software update
management regulation)
Aviation — the EASA AI Concept Paper, Issue 02 (the European Union
Aviation Safety Agency’s machine-learning guidance)
Nuclear — IAEA SSG-39 (the International Atomic Energy Agency’s safety
guide for instrumentation and control systems)
Finance — Federal Reserve SR 26-2 (the 2026 revised U.S. supervisory
guidance on model risk management, superseding SR 11-7)
One signal is worth marking at the outset. When the U.S. banking agencies re-
vised their model risk management guidance in 2026, they expressly placed
generative and agentic AI outside its scope, leaving those systems to each
organization’s broader governance and flagging a further consultation to come.
The newest guidance defers the AI-specific question to the architectural com-
mitments an enterprise builds across its lifecycle, which is exactly the ground
this book’s analysis categorizes.
The thesis is structural. Organizations that navigate the AI era successfully,
avoiding warning letters and patient harm, converge on the same architectural
commitments because the regulations have already specified them. The book
lays the analysis out so the categorization is in hand before the inspection
arrives.
The promise is concrete. By the end of the book, you will hold the categoriza-
tion the analysis lays out, and the obligations the regulations specify under
each. You will recognize, when a vendor presents their AI platform, whether
the answer they give to “how does this satisfy EU AI Act Article 14” is real or re-
hearsed. You will recognize, when a consultant scopes a transformation pro-
gram, whether the categories of obligation they organize their work around
match the categories an inspection will traverse. You will recognize, when a
colleague reports that “the AI flagged this exception,” whether the work behind
that statement can withstand the same question a regulator now knows to ask.
You will not become a data scientist. You will not need to. You will become the
kind of leader who can lead from understanding, ask the questions that matter,
and recognize whether the answers hold. That is the promise.