Why industry-specific schemas?
The base SRF defines who is accountable and for what. It does not resolve how a hospital, a bank, or a federal agency should implement those accountabilities under their specific regulatory regimes. Each vertical closes that gap.
Every vertical schema adds: a regulatory crosswalk to the sector's primary AI or model governance standard, tier parameters calibrated to the sector's risk appetite, and evidence specifications aligned to the sector's audit and examination practices.
Available verticals
Financial Services
40 controls across five SRF layers, calibrated for banks, asset managers, and fintechs. Addresses the SR 26-2 gap for agentic AI, with FINOS AIGF and OWASP LLM Top 10 crosswalks.
Healthcare
40 controls across five SRF layers, covering clinical decision support, AI-assisted diagnostics, and agentic care coordination. Maps to FDA TPLC and PCCP guidance, ONC HTI-1, HIPAA, EU AI Act, IEC 62304, and ISO 14971. FHIR AuditEvent evidence pointers throughout.
Insurance
40 controls for underwriting, claims, and vendor model governance. Aligned to the NAIC Model Bulletin, Colorado Regulation 10-1-1 (July 2026 deadline), NYDFS CL 7, and the NAIC AI Systems Evaluation Tool used in market conduct exams.
Public Sector
40 controls for federal civilian agencies (FCEB). The agency side of the FedRAMP Customer Responsibility Matrix for AI, with responsibility_split on every control. Mapped to OMB M-25-21 minimum practices, M-25-22 acquisition terms, FedRAMP 20x KSIs, and NIST AI RMF. September 22, 2026 deadline anchor.
Department of War
53 controls for DoD components and the defense industrial base. Maps Responsible AI tenets to named accountability across IL4, IL5, and IL6 impact levels, with separate Non-NSS and NSS control tiers and CMMC-aligned evidence for contractors.
Manufacturing
45 controls for OT/ICS deployments, product-embedded AI, and IT-side manufacturing systems. Aligned to EU AI Act high-risk obligations (August 2026 deadline), EU Machinery Regulation 2023/1230 (January 2027), and IEC 62443 OT cybersecurity zones.