Regulation rarely says no outright
In most regulated sectors the requirement is not that automation is forbidden, but that decisions are explicable, records are kept, customers are informed, and a person remains accountable. Those are design requirements rather than blockers.
You must be able to reconstruct any interaction
What was asked, what was retrieved, what was said, and under which version of the rules. That is the explainability record, and it needs building in from the start rather than added when someone asks.
In a regulated business, an interaction you cannot reconstruct is one you cannot defend.
Advice stays with humans
Anything constituting regulated advice — financial, legal, medical — belongs firmly on the never list, regardless of how well the model could phrase it.
Disclosure is likely mandatory, not optional
Several jurisdictions now require telling people they are dealing with an automated system. That converts disclosure from a trust decision into a compliance one.
Data location and retention are contractual
Where processing happens, what a provider retains, and whether anything may be used for training are questions with regulatory consequences — the diligence any dependency on someone else’s model requires, with a higher bar.
Start where the stakes are lowest
Internal drafting, scheduling and document handling deliver value without touching regulated decisions. Building the audit trail there first means the harder cases arrive with the evidence machinery already proven.