# Industries Source: https://www.primust.com/industries HTML title: Regulated Industries Have A Proof Problem — Primust Meta description: Auditors, regulators, reinsurers, and counterparties need evidence about workflows and data they cannot directly see. Primust closes that proof gap. ← Primust · Industries # Regulated industries have _a proof problem_. Every regulated industry has parties who need evidence about workflows they are not allowed to inspect — auditors, regulators, counterparties, reinsurers, insurers. They need proof, not assertions. Primust is the primitive that closes that gap. § 01 — Industry AI Governance ## Prove your AI checks ran. _Not just that they exist._ AI governance is moving from configuration to execution evidence. Regulators, auditors, and insurers don't want to see your policy document — they want proof the declared checks actually fired on real data. Every agent session, every LLM call, every inference generates a governance obligation. Primust turns each one into a cryptographic credential. Process What Primust proves Regulator / verifier Proof level PII / toxicity scan Regex and classifier checks ran — input data never disclosed EU AI Act · NIST AI RMF Mathematical Policy evaluation OPA or Cedar rules evaluated per request SOC 2 · ISO 42001 Mathematical ML classifier Model version committed, inference bound to weights EU AI Act Art 12 Verified Model Human review gate Reviewer identity verified, decision timestamped and signed EU AI Act Art 14 Witnessed Cost / rate limiting Threshold checks ran before execution Internal governance Mathematical Agent orchestration Full session governance — every tool call, every check EU AI Act · AIUC-1 All levels After primust init , auto-activation wraps your agent framework — no code changes. Regex and rule checks hit Mathematical automatically. ML classifiers hit Verified Model. Human review gates hit Witnessed. § 02 — Industry Financial Services ## Prove governance ran. _Without opening the black box._ Financial institutions operate at the intersection of proprietary models, confidential data, and extensive regulatory scrutiny. OCC, FCA, CFPB, FinCEN, and SEC all require evidence of governance — but the data and logic that governance ran on is often too sensitive to disclose. Process What Primust proves Regulator / verifier Proof level AML screening Entity screening ran — criteria never disclosed FinCEN · FCA · AUSTRAC Attestation SAR determination Analyst credentialed, rationale committed FinCEN · OCC Witnessed Credit decisioning Rules applied consistently — scoring model stays proprietary CFPB · ECOA · state AGs Mathematical* Fraud detection Score band committed — raw fraud model never disclosed OCC · Visa/MC compliance Attestation Model risk governance Validation checks ran per SR 11-7 OCC · Fed · FDIC Execution Financial data delivery Upstream vendor governance verified before processing OCC model risk · FCA Mathematical Automated decision basis Committed without disclosure (GDPR Art 22) GDPR supervisory auth. Attestation Connectors shipped ComplyAdvantage NICE Actimize FICO Falcon FICO Blaze IBM ODM Pega Decisioning * Mathematical with the Java in-process SDK. REST API connectors ship at Attestation today. § 03 — Industry Insurance ## The evidence layer for _the proof paradox._ The insurance industry has a structural proof problem built into its business model. Reinsurers, Lloyd's syndicates, and state DOI examiners need to verify that primary carriers ran their declared processes — but the underlying claim data is confidential. Process What Primust proves Regulator / verifier Proof level Claims adjudication Adjudication ran per treaty terms — claim file stays internal Reinsurers · Lloyd's Witnessed Underwriting rules Rating factors applied consistently — actuarial model proprietary State DOI · reinsurers Attestation Fraud screening Pre-claim screening ran — detection rules never disclosed State fraud bureaus Attestation AI model governance AI-assisted underwriting checks ran with declared proof level State insurance comm. Execution Suitability FINRA Rule 2111 check ran — customer profile never disclosed SEC · FINRA Attestation Connectors shipped Guidewire ClaimCenter Duck Creek (spec) Majesco (spec) Sapiens (spec) Java in-process SDK specs ready for Duck Creek, Majesco, Sapiens — Mathematical ceiling. § 04 — Industry Healthcare / Pharma / Clinical ## PHI never leaves. _Proof does._ HIPAA, FDA 21 CFR Part 11, GCP, and GMP all require documented evidence that regulated processes ran as declared. The underlying data — patient records, trial data, measurement data — is among the most sensitive that exists. The parties who need proof cannot receive it. Process What Primust proves Regulator / verifier Proof level Clinical decision support Drug interaction check ran — medication list never transmitted CMS · Joint Commission Attestation Clinical trial delivery CRO data integrity checks ran before delivery to sponsor FDA 21 CFR Part 11 Attestation PHI access governance PHI access check ran on every query HIPAA Security Rule Mathematical AI diagnostic tools AI diagnostic governance ran — model reasoning stays internal FDA SaMD · EU MDR Execution Batch release Manufacturing QC checks ran per batch — values stay internal FDA 21 CFR Part 211 Mathematical Connectors shipped Wolters Kluwer UpToDate retention_policy: FDA_PART11_7Y — declared at pipeline init, enforced at Enterprise tier. § 05 — Industry Software / Technology ## Your policy engines are deterministic. _Make new decisions provable._ OPA and Cedar policy engines are the governance backbone of modern cloud-native infrastructure. Their allow-or-deny decisions are deterministic — same input, same policy, same output. Add Primust at the evaluation boundary and each new decision becomes a signed VPEC tied to policy version, input commitment, output, and timestamp. Process What Primust proves Regulator / verifier Proof level OPA policy evaluation Mathematical — each instrumented allow/deny is provable DevSecOps · compliance Mathematical Cedar authorization Mathematical — each instrumented authorization decision AWS-native security teams Mathematical CI/CD supply chain Dependency hash checks, SAST, license compliance Government procurement Mathematical Coding agent governance Every file write, command execution, code review CISO · IT security Execution AI feature governance LLM checks ran before output served to users Product compliance Execution SOC 2 Type II Evidence Pack for Big 4 auditor methodology review GRC teams All levels Connectors shipped OPA / Rego Cedar Drools IBM ODM OPA and Cedar ship today at Mathematical ceiling via Go plugin and Java SDK. Add Primust at the evaluation boundary; no policy rewrite required. § 06 — Industry Legal ## AI-assisted legal work needs a paper trail. _Not a screenshot._ Bar associations are establishing requirements for attorney disclosure of AI use and verification of AI-generated research. Malpractice insurers are beginning to ask whether citation verification ran. The evidence standard is moving from 'we used AI' to 'we verified what the AI produced.' Process What Primust proves Regulator / verifier Proof level Legal research Citation verification ran before brief filing Bar associations · courts Execution Contract review AI-identified clauses verified by credentialed attorney Malpractice insurers Witnessed Due diligence Source verification ran on AI-generated findings Client · counterparty Execution Regulatory filing Review checks ran — attorney signed off Regulators · courts Witnessed ABA Formal Opinion 512 and state bar AI guidelines are the emerging regulatory driver. § 07 — Industry Government / Defense ## AI procurement requires provenance. _Primust provides it._ Federal AI procurement is converging on provenance and supplier-governance requirements. Restricted and disconnected environments also require evidence that can be issued and verified without outbound network access. Process What Primust proves Regulator / verifier Proof level AI component provenance Model hash committed, governance checks ran Federal procurement Mathematical AI system governance Declared checks ran per agency requirements Agency AI governance All levels Vendor verification Upstream vendor VPEC verified before processing Federal acquisition Mathematical Air-gapped deployment VPEC issuance with no outbound network — on-premises Defense / restricted networks All levels Air-gapped deployment available — HSM-backed signing with customer keys. No outbound network required. § Next ## Don't see your industry? _The primitive is sector-agnostic._ Primust is content-blind. If your industry has a party who needs evidence about workflows they are not allowed to inspect, VPECs close the gap. Talk to us. Get sandbox access Talk to sales →