Insights · Regulated sectors
AI where it’s regulated.
The organisations with the most to gain from AI are often the ones with the least room for error: air traffic, health, banking. We have delivered technology in all three. Regulation is not the obstacle. Unclear thinking is.
Why does regulated feel harder?
Because the consequences are real: safety, patients, other people’s money. Every change carries an audit trail and every failure has a headline waiting for it. The fear in the room is rarely about the model. It is about the exposure.
But regulated organisations hold an advantage the market overlooks: they already know how to govern. Assurance, evidence, controlled change, accountable ownership: the muscles AI adoption needs are the muscles they already have. The task is pointing them at something new, not building them from scratch.
What did air traffic control teach us?
In air traffic control we built technical prototypes and simulations, secure real-time dashboards, and secure enterprise integration, alongside compliance and systems assurance work. The lesson: innovation and assurance can share a room. The same organisation that ran an innovation lab with us also demanded, rightly, that everything stood up to systems assurance. Neither killed the other. Each made the other credible.
What did health teach us?
In public healthcare our work spanned mental-health service initiatives and one-to-one personalised patient communication. The lesson: adoption runs on clinical trust. Technology in health supports professional judgement; it never replaces it, and the moment it disrupts the clinical workflow it will be rejected regardless of how clever it is. Fit the workflow, earn the trust, and change becomes possible.
What did banking teach us?
In retail banking we delivered offer personalisation with legal-compliance tooling for communications built into the pipeline itself. The lesson: speed and auditability are not opposites. Compliance designed into the system beats compliance bolted on at the end, every time, and it is the difference between personalisation at pace and personalisation in committee.
What transfers to AI now?
All three lessons, unchanged. Treat assurance as an enabler and involve it early. Earn the trust of the professionals who will live with the tool. Build the controls into the pipeline, not around it. The vocabulary of the wave is new. The discipline of delivering inside serious organisations is not, and it is the discipline that decides who actually captures the value.
Common questions
Can regulated organisations use large language models at all?
Yes, with data rules, residency decisions and tiered usage in place. In our own delivery work, UK data residency is the default.
Where should a regulated organisation start?
Low-consequence internal use first, with governance already in place. Then move toward the customer with evidence.
Does regulation kill the return?
No. Control done well is what makes speed safe. Stated more strongly: regulation is the key to innovation, because permission is what lets anything ship at all.