Other regulated industries
AI for organisations that work under rules
Better quality of work at lower cost, from a custom AI solution to an air-gapped system, built where compliance, data privacy and auditability are essential.
What we build in your industry
One example per industry, and the rule that makes it matter: the European Union Artificial Intelligence Act (EU AI Act), the GDPR or your sector's own law.
Software suppliers to financial firms
- What we build
- Assistants that answer from your documents. Inside your product or for your staff, on the deployment your client's contract allows.
- The rule
- DORA puts its duties on your financial client, which passes them on to you by contract.
The rule and its source
DORA, Articles 28 to 30, applies from 17 January 2025. Your client must know where your service runs and where data is stored, who your subcontractors are, and keep the right to audit you and to leave.
The Dutch financial supervisors supervise your client, and your client passes the demands on to you.
Sources: DORA, Article 28; DORA, Article 30; Regulation (EU) 2022/2554, Article 64; Wet op het financieel toezicht, Articles 1:81 and 1:82.
Worked example: The bank's questionnaire now asks about your model provider
For your chief technology officer: what to have ready
If you make software or connected products: the Cyber Resilience Act
Healthcare
- What we build
- Summaries of calls and consultations. Drafting support with human sign-off. For consultations, replies and reports, as a private deployment or an air-gapped system.
- The rule
- Health data is a special category under the GDPR, and in a larger care organisation the board approves security.
The rule and its source
GDPR, Article 9, applies already, and since 15 August 2026 the Cyberbeveiligingswet makes the board of a larger care organisation approve the security measures. An AI system that is, or is a safety component of, a medical device that needs a notified body comes under the high-risk duties from 2 August 2028.
The Autoriteit Persoonsgegevens for personal data; the Inspectie Gezondheidszorg en Jeugd for care.
Sources: GDPR, Article 9; Cyberbeveiligingswet, Article 24; Inspectie Gezondheidszorg en Jeugd, digital care; Inspectie Gezondheidszorg en Jeugd, Toetsingskader Digitale Zorg; Regulation (EU) 2026/1744, Article 1, points (39) and (40), on the dates.
Worked example: Speech driven reporting arrived before the governance did
Employers and recruitment
- What we build
- Assistants that answer from your documents. Answers from your own policies; where software ranks or plans people, a person approves.
- The rule
- AI that recruits, evaluates or monitors people is on the EU AI Act's high-risk list, from 2 December 2027 and not before.
The rule and its source
EU AI Act, Annex III, point 4: recruiting and selecting people, evaluating candidates, decisions on promotion and termination, allocating tasks and monitoring performance. The high-risk duties apply from 2 December 2027; they do not apply before that date. GDPR, Article 22, already forbids a decision by software alone that significantly affects a person.
The Autoriteit Persoonsgegevens for Article 22. We could not confirm which Dutch authority will supervise these uses under the Act.
Sources: EU AI Act, Annex III; GDPR, Article 22; Regulation (EU) 2026/1744, Article 1, points (39) and (40), on the dates.
Worked example: The ranking your recruiters asked a chat assistant for is on the high risk list
Public bodies
- What we build
- Assistants that answer from your documents. Drafting support with human sign-off. For caseworkers, letters and replies; a decision about a person keeps human approval and a record.
- The rule
- AI that decides on benefits and services is on the EU AI Act's high-risk list, from 2 December 2027 and not before.
The rule and its source
EU AI Act, Annex III, point 5(a), with a fundamental rights impact assessment under Article 27 before such a system is used. The high-risk duties apply from 2 December 2027; they do not apply before that date. Systems already in use by public authorities must comply by 2 August 2030 at the latest.
The Autoriteit Persoonsgegevens coordinates the control of government algorithms.
Sources: EU AI Act, Annex III; EU AI Act, Article 27; Algoritmeregister, about the register; Regulation (EU) 2026/1744, Article 1, points (39) and (40), on the dates.
Energy, water, transport and other critical infrastructure
- What we build
- Agents that work under approval. For operations and reporting, on an air-gapped system where drawings and settings may not leave your premises.
- The rule
- The Cyberbeveiligingswet makes the board approve security; AI safety components join the high-risk list from 2 December 2027 and not before.
The rule and its source
Since 15 August 2026 the Cyberbeveiligingswet, which implements the second Network and Information Security Directive, requires the board to approve the security measures and gives each member two years to hold a training certificate. The EU AI Act, Annex III, point 2, covers AI safety components in critical infrastructure; the high-risk duties apply from 2 December 2027; they do not apply before that date.
The Rijksinspectie Digitale Infrastructuur for energy; the Inspectie Leefomgeving en Transport for drinking water, transport and wastewater.
Sources: EU AI Act, Annex III; Directive (EU) 2022/2555, Article 20; Cyberbeveiligingswet, Article 24; Nationaal Cyber Security Centrum, supervisors per sector.
Worked example: What the board of a water company approves when it approves artificial intelligence
These are examples of what we can build. They do not describe client work.
The same rules in more industries
Makers of medical devices, telecommunications and managed service providers, education, manufacturing, chemicals, food, postal services, waste management, and companies outside the EU whose AI is used in it.
How we work
We start with a free briefing, then discovery, the design, the build, and run and improve. See the five steps.
Each solution runs as a custom AI solution, a private deployment or an air-gapped system, as your data allows. Compare the three.
What you risk
Under the EU AI Act alone, using a prohibited AI practice can cost up to €35 million or 7% of worldwide annual turnover, the most the law allows. See every fine with its source.
This page was last checked on .