AI in regulated industries
In healthcare, legal, finance and the public sector, the demo is easy and the approval is hard. The systems worth building are the ones your compliance officer, your regulator and your risk committee can sign off, because the evidence they need is designed in.
Provenance is the product
Every AI output traces back to its inputs, model identifier, prompt version, retrieval sources and timestamp. When the auditor asks "why did the system say this", the answer is a record, not a reconstruction. That single property converts most compliance conversations from adversarial to procedural.
It also survives model changes: when a model is swapped or fine-tuned, the trail shows exactly which outputs came from which version.
Eval gates before go-live, and after
No deployment without measurable success criteria the system has demonstrably met: accuracy on your cases, refusal behaviour on the inputs it must not touch, latency and cost inside budget. The same suite runs as a regression gate after every change, so the system that passed review is provably the system still running.
Human oversight matched to consequence
Automation depth follows the risk of the decision. Reversible, low-consequence steps run fully automated. High-consequence steps get review gates by design: the system drafts, a named human approves, and the approval is logged. This is the structure the EU AI Act pushes toward, and it is also simply how you keep trust inside the organisation.
Proof, and where to start
This architecture runs in production today: Switzerland's first clinical LLM platform inside hospital infrastructure, and court-document anonymisation for the Swiss judiciary. Both passed the reviews their sectors demand.
The 2-3 week process audit maps your workflows, their regulatory constraints and the realistic automation depth for each. CHF 15-25k fixed, under 20 hours of your team's time.
Common questions
Can we use AI at all under FADP / GDPR?
Yes. The constraint is architectural, not absolute: data minimisation, in-region or on-prem processing where required, documented legal basis, and traceability. Most "we cannot use AI" positions dissolve once the workflow is mapped and the actual data flows are visible.
What will the regulator want to see?
Traceable outputs, documented evaluation before go-live, logged human oversight on consequential decisions, and evidence the system behaves the same way it did at review. All four are properties of the architecture, which is why they are designed in rather than assembled for the audit.
Do we have to use local models?
Only where the data classification requires it. The usual pattern is routing: sensitive steps run on local or in-region models, the rest uses frontier APIs. The audit tells you which steps sit on which side of that line.
How long does an engagement take?
The audit runs 2-3 weeks. A first production system typically ships 4-10 weeks after that; regulated deployments sit at the longer end because eval and approval cycles are part of the build, not an afterthought.
Map the process before you buy the tool.
One call to agree whether a process audit, a system build or a fractional AI lead fits where you are.