One AI model can need very different reviews in hiring, finance and health

A model does not arrive with one permanent regulatory category attached to its weights. The surrounding service, intended use, affected people and institutional role matter. A tool that helps organise public information can become a different proposition when used to shortlist job applicants, influe

A model does not arrive with one permanent regulatory category attached to its weights. The surrounding service, intended use, affected people and institutional role matter. A tool that helps organise public information can become a different proposition when used to shortlist job applicants, influence a financial decision or support a medical-device function. The practical review needs to follow that change in use. A generic “enterprise ready” label cannot describe all three situations.

Imagine a fictional enterprise developer, Sofia, whose team builds document-analysis components. Three prospective customers ask about the same summarisation capability: a hospital supplier, a financial institution and an employment agency. Sofia’s team uses invented documents for all demonstrations. It does not provide clinical care, make credit decisions or rank real candidates. Its immediate task is to identify which facts and evidence each customer needs before anyone proposes an operational use.

Start with the status printed on the source

The FDA’s January 2025 document on AI-enabled device software functions, lifecycle management and marketing submissions remains labelled draft on its official page at this check. It says it is not for implementation and contains nonbinding recommendations. It discusses documentation supporting evaluation of safety and effectiveness; it is not itself a device authorisation or a final binding rule. [US Food and Drug Administration](https://www.fda.gov/regulatory-information/search-fda-guidance-documents/artificial-intelligence-enabled-device-software-functions-lifecycle-management-and-marketing)

MAS published its Guidelines on Artificial Intelligence Risk Management for Financial Institutions on 7 October 2026. The official page describes supervisory expectations for financial institutions, with approaches tailored to risk profiles, and says the guidelines take effect on 7 October 2027. Publication and effective dates are therefore separate milestones; the guidelines should not be presented as already-effective legislation for all startups. [Monetary Authority of Singapore](https://www.mas.gov.sg/regulation/guidelines/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions)

New York City’s DCWP explains that Local Law 144 restricts covered automated employment decision tool use without a bias audit within one year, public information about that audit and required notices. The tool definition, employer context and geographic scope matter. This city regime is not a nationwide US rule for every hiring application, and an audit alone is not a guarantee of fairness. [New York City Department of Consumer and Worker Protection](https://home4.nyc.gov/site/dca/about/automated-employment-decision-tools.page)

MAS’s FEAT paper, published on 12 November 2018 and updated in paragraph 1.4 on 7 February 2019, supplies foundational fairness, ethics, accountability and transparency principles for AI/data analytics in Singapore’s financial sector. It is a principles paper, distinct from the new October 2026 supervisory guidelines and from existing financial law. [Monetary Authority of Singapore](https://www.mas.gov.sg/publications/monographs-or-information-paper/2018/feat)

This selection shows why a sector review needs more than a list of familiar framework names. A draft, a supervisory guideline with a future effective date, a local legal regime and a principles paper require different handling. Sofia should preserve those labels when explaining the sources to customers. Removing the caveats to produce a shorter sales slide would change the meaning of the evidence.

Describe the intended use before asking for a test score

The hospital supplier might ask whether a summary helps a professional inspect an administrative record or is intended to inform a device function. The financial institution might ask whether it merely organises documents or contributes to a decision about a customer. The employment agency might ask whether the output is a draft description or a score that substantially influences a hiring process. These are illustrative questions for qualified review, not determinations that a particular product is or is not regulated.

Sofia’s team can record the proposed use in a short scenario sheet. It names the user, the input, the output, the decision influenced and the person who can correct the result. It also names excluded uses and explains which technical controls enforce those limits. A disclaimer that says “advisory only” deserves scrutiny if the workflow automatically sends the output onward or makes it difficult for a human to disagree. The review should describe the actual operation.

The same test result can carry different significance across those scenarios. A summary might preserve every section heading yet omit the sentence that matters for a later decision. An aggregate accuracy score will not reveal whether that omission affects a particular group or task. The team should propose evaluation cases around the customer’s intended use and retain the evidence needed to investigate failures. It should resist using a strong score from one task as proof of suitability for another.

Make changes visible to the people who rely on the evidence

Change control begins with knowing what was reviewed. The scenario sheet can identify the model service, prompt, retrieval configuration, reference corpus and user-facing limitations. A later change may affect only one component, but that is enough to ask whether the earlier evidence remains relevant. The answer might be a focused comparison rather than a complete restart; it should still be explicit and recorded.

For the fictional employment demonstration, the team could compare outputs before and after a prompt change using synthetic candidate documents. Reviewers would look for differences in what information is emphasised, what is omitted and how uncertainty is expressed. Such a comparison is a development exercise. It is not an independent bias audit, does not use real applicants and should never be labelled as meeting a legal audit requirement without the appropriate process and evidence.

For the hospital-supplier discussion, the team could keep a strict separation between an administrative prototype and any proposed clinical use. A question about a device function would be escalated through the customer’s specialist process, with the draft FDA source’s status retained. The team should not offer a clinical operating instruction from this article or assume that reading guidance authorises a product. The useful contribution is an accurate boundary and a clear evidence request.

Review what happens when the answer is wrong

A human-review promise needs practical details. Can the reviewer see the underlying record? Can they change the result without losing their own work? Does the system preserve a correction and its reason? Can affected people reach the organisation responsible for the decision? The appropriate answers differ by service, but the questions expose whether “human oversight” describes a real task or only a sentence in documentation.

A proposed failure test might make the summarisation service unavailable after a reviewer has entered a correction. The interface should preserve that safe correction and explain what remains unsaved. It should distinguish a temporary service failure from a permission problem or a changed record. None of those states is improved by exposing a technical error to the reviewer. Recovery should help the reviewer continue without creating an unconfirmed consequential action.

An adult student can compare the three fictional customer requests and write separate lists of missing facts. The goal is to explain why the review differs, not to memorise one worldwide AI compliance recipe. As of 15 October 2026, the primary sources establish the specific statuses and milestones above. The examples and proposed checks offer a way to organise specialist questions; they do not provide clinical, financial or legal advice, regulatory approval or a universal compliance guarantee.

Evidence diagram and readable guide


Original qualitative sector comparison for fictional demonstrations; not clinical, financial or legal advice, and not a compliance score.

[Open the complete evidence diagram](/assets/policy-workflow-sector-change-control-20261016.svg)

Read the diagram

**One AI model can need very different reviews in hiring, finance and health**

Three fictional customer discussions use invented documents. Draft guidance, future-effective supervision and a local legal regime remain different kinds of evidence.

- **Describe the intended use** Name the user, input, output and decision the component may influence.

- **Health · draft guidance** FDA’s January 2025 lifecycle source is draft and not for implementation.

- **Finance · separate dates** MAS published its FI guidelines on 7 October 2026; they take effect on 7 October 2027.

- **Hiring · local scope** NYC’s covered AEDT regime concerns bias audit, public information and notices.

- **Review a proposed change** Compare the relevant model, prompt, corpus and human-review evidence.

- **Retain a scoped record** Preserve the reviewed version, correction route and unresolved specialist questions.

The three sector lanes are comparisons, not successive approvals or interchangeable compliance tests.

How the connections work

- A proposed device function raises specialist questions; an administrative prototype is not automatically a clinical use.

- The financial institution’s proposed role and risk profile determine which supervisory questions are relevant.

- A hiring application needs its actual tool, employer and geographic scope checked; the city rule is not nationwide.

- The FDA source’s draft status stays visible when a changed device-related use is reviewed.

- The MAS publication and effective dates remain separate; no readiness result is inferred from the interval.

- A synthetic comparison is not an independent legal bias audit or a guarantee of fairness.

- The changed configuration and its limits enter a record that another reviewer can inspect.

Relationship key

Dashed links identify sector-specific questions. Solid links retain each source’s status through change review; no shared score or legal approval is calculated.