Evidence, not certificates.
If an auditor, an examiner or your insurer asks how your systems are tested, logged and overseen, you hand them last month's report. Below is which rule asks for what, and which part of the report answers it.
Last reviewed 10 October 2026. Rules change, so check each one with your counsel before you rely on it.
United States
| Rule or framework | Who it applies to | What the monthly report covers |
|---|---|---|
| State insurance data security laws (most based on the NAIC Insurance Data Security Model Law) | Insurance agencies and MGAs | Vendor oversight records, access reviews, incident log |
| FTC Safeguards Rule and IRS Publication 4557 | CPA and accounting firms | Inputs for your written information security plan: data map, access log, vendor review |
| NIST AI RMF 1.0 and Generative AI Profile (AI 600-1) | Any organization; widely used in vendor reviews | Risk tiering at the start of each build; control status reported in the monthly report |
| FINRA 2026 oversight expectations for generative AI | Broker-dealers | Prompt and output logs, model version tracking, evaluation results, human review |
| NYDFS Part 500 and third-party guidance (2025) | New York regulated financial and insurance firms | System inventory, incident log, vendor access review, no-training and subcontractor clauses |
| NAIC Model Bulletin on AI | Insurers in the states that have adopted it | AI program documentation, vendor oversight records, change log |
| Interagency third-party risk guidance | Banks and credit unions | Due diligence kit, monitoring records, exit plan |
| HIPAA | Healthcare organizations and their business associates | BAA, access reviews, logs kept in your account |
Australia
| Rule or framework | Who it applies to | What the monthly report covers |
|---|---|---|
| APRA letter on AI (April 2026), CPS 230 and CPS 234 | Banks, insurers and super funds | Supply chain mapping, quarterly substitution test, exit plan |
| DTA Policy for the responsible use of AI in government v2.0 | Commonwealth agencies | Use-case register and impact assessment support |
| Privacy Act automated decision disclosure (from 10 December 2026) | Organizations covered by the Privacy Act | Automated decision inventory, updated monthly |
What this is, and is not
We provide technical and documentation support for your compliance program. We are not lawyers, auditors or actuaries, and nothing here is legal advice. Whether a rule applies to you, and whether you meet it, is a call for you and your counsel. The monthly report gives them something concrete to work from.
Talk it through
Thirty minutes with Bhuwan Aryal, the engineer who would build it. You'll leave with a written plan, a fixed quote and an honest view on which system is worth it for you, if any.
Live in 2 to 4 weeks. Month to month after that, and you can cancel anytime.
Book a 30-minute callBhuwan Aryal
Founder, BhuwanLabs