Healthcare is where AI's promise and its evidence bar are both highest. A wrong output can harm a patient, so regulators treat much clinical AI as a medical device, and clinicians want proof before they trust it.

Clinical decision support analyses patient data to help clinicians diagnose, choose a treatment or spot deterioration early. Medical imaging is the most mature part of it: models flag suspected findings on scans and slides for a radiologist or pathologist to review. The useful debate is augmentation, not replacement: the model triages, the clinician decides, and someone must settle who carries liability when they disagree. In drug discovery, predictive models help choose biological targets and generative models propose candidate molecules, compressing the earliest stages of a pipeline that typically runs for more than a decade. Insilico Medicine found both the target and the molecule for rentosertib, a lung-disease drug candidate, with its generative AI platform, and published mid-stage trial results in Nature Medicine in June 2025. Patient engagement covers triage chatbots, remote monitoring from wearables and personalised care plans, where the patient, not a clinician, often acts on the output.

Regulation follows the claim the software makes. Software that informs a diagnosis or a treatment decision is likely to be a medical device: in the UK it needs UKCA or CE marking under the MHRA's oversight, and in the US clearance or approval from the FDA. The MHRA opened AI Airlock, a regulatory sandbox for AI as a medical device, in May 2024. Administrative AI, such as scheduling or letter drafting, is usually not a device, but health data is special category data under UK GDPR, so data protection duties still apply.

Evidence doesn't travel well. A model validated in one hospital can fail in another because patients, scanners and record-keeping differ: dataset shift. Ask for validation on a population like yours and monitoring after go-live.

DeepMind's Streams app is the governance lesson. It alerted Royal Free London clinicians to acute kidney injury using an NHS rules-based algorithm, not machine learning. In 2017 the ICO found that the Royal Free had broken data protection law in sharing around 1.6 million patients' records to test it, and Google later decommissioned the app. The failure was data governance, and the "AI" label hid what the system actually was.

Classify these three initiatives for the exercise: (a) a tool that drafts clinic letters from a consultant's dictation for the consultant to check and sign; (b) a symptom-checker chatbot that tells patients whether to call 999, book a GP appointment or self-care; (c) an imaging model that flags suspected lung nodules on chest X-rays for a radiologist to review. Use three tiers: administrative, clinician-reviewed clinical, and patient-facing clinical.

Financial services used predictive AI long before generative AI arrived, because its data suits it. Transaction records are high-volume and structured, and for fraud they come labelled: the firm already knows which past payments turned out to be fraudulent. The sector is data-rich, but customers' money and access to credit are at stake, so supervision is close.

Fraud detection and anti-money laundering are the clearest wins. Anomaly-detection models score each payment in real time against the customer's normal behaviour, and transaction-monitoring models rank alerts so investigators look at the most suspicious first. UK Finance's annual fraud reports, which track losses across the industry, show why banks keep investing here.

Credit scoring and algorithmic underwriting are where value meets scrutiny. Lenders have long used statistical scorecards; machine-learning models can find patterns those scorecards miss. The catch is explainability and fairness. A lender must be able to tell a declined applicant why, and show that the model doesn't produce worse outcomes for groups of customers, including through data that stands in for protected characteristics. Creditworthiness assessment is also one of the EU AI Act's Annex III high-risk uses, covered in Module 5.

In advice and asset management, robo-advisers and AI portfolio tools make investment help cheaper to deliver. The line that matters is between giving information and making a personal recommendation: the second is regulated advice, with a duty to show it suits the customer. Personalised engagement uses next-best-action systems to decide which offer or message each customer sees, and open banking data, shared with the customer's consent, gives a fuller picture of their finances. Compliance AI, such as know-your-customer (KYC) document checks, transaction monitoring and regulatory reporting, is often the lowest-risk place to start, because its output goes to staff rather than customers.

The FCA has not written AI-specific rules. Its AI Update of April 2024 described its approach as technology-agnostic, principles-based and outcomes-focused, and mapped the government's five AI principles onto rules firms already follow: the Consumer Duty, in force since July 2023, which requires good outcomes for retail customers, and the Senior Managers and Certification Regime, which makes a named senior person accountable. For any regulated decision an AI system touches, three questions follow: can you explain it, can you show it is fair, and who is accountable?

For the exercise, map these three applications: (a) a card-fraud model that holds suspicious payments until the customer confirms them; (b) a machine-learning model that approves or declines personal-loan applications automatically; (c) a generative assistant that drafts replies to KYC document queries for compliance staff to check.

Retail has the shortest line from AI to revenue, and the shortest line from AI to the consumer. Both matter.

Personalisation is the best-known use. Recommendation systems such as those at Netflix, Spotify and Amazon rely on collaborative filtering (people who liked this also liked that), and increasingly on large language models that let shoppers search and compare in plain language. Profile-based personalisation uses what you know about a customer over time. Contextual personalisation uses the session itself, such as the device, the location or what is already in the basket, and needs far less personal data.

Demand forecasting may be worth more. Small swings in consumer demand grow as they pass back up the supply chain, because each tier over-orders to protect itself: the bullwhip effect. Better short-term forecasts dampen it. IKEA's demand-sensing tool, built with Blue Yonder and piloted in Norway in 2020 before a wider rollout, combines sales history with signals such as weather, local events and promotions to forecast demand by product and store. Markdown optimisation applies the same thinking at the end of a product's life, deciding when and how deeply to discount remaining stock.

Autonomous retail uses computer vision and sensors so that shoppers can take goods and leave without a checkout. Amazon Go made the format famous, but in January 2026 Amazon said it would close all its Amazon Go and Amazon Fresh stores because it had not found a customer experience and economic model fit for large-scale expansion. It still sells its Just Walk Out checkout technology to other operators. Working technology and a working business model are different tests.

Facial recognition raises the stakes further. Biometric data used to identify people is special category data under UK and EU GDPR. Under the EU AI Act, the outright ban on real-time remote biometric identification in public spaces applies to law enforcement, but remote biometric identification systems are high-risk under Annex III, and building facial databases by untargeted scraping is prohibited. A retailer using facial recognition to spot suspected shoplifters needs a very strong justification.

Consumer trust is the binding constraint. The CMA's 2021 paper on algorithms set out how they can harm consumers: personalised pricing people can't see, choice architecture that steers them, and ranking that favours the seller over the shopper. The Digital Markets, Competition and Consumers Act 2024 let the CMA fine firms directly for consumer-law breaches from April 2025. The ethical test for any retail AI is whether customers would accept it if they could see exactly how it works.

In most sectors AI changes how the work is done. In the creative industries it can change the product itself, which is why the questions of who made it, from what, and whether customers were told are sharpest here.

In media and entertainment, generative AI is used across production: drafting and analysing scripts, generating visual effects, and localisation, where synthetic voices and lip-sync can dub a programme into many languages. Creative workers drew public lines in 2023. The Writers Guild of America's agreement of September 2023 established that AI can't write or rewrite literary material and that AI output doesn't count as source material; a writer may choose to use AI with the company's consent but can't be required to. SAG-AFTRA's agreement of November 2023 required performers' informed consent and compensation for digital replicas. Both are useful markers for any organisation deciding where people stay in charge.

Fashion uses AI for trend prediction from search, social and sales data, and for design assistance. Stitch Fix publicly described its Hybrid Designs work in 2017: an algorithm recombined garment attributes its customers had rated well, such as neckline, sleeve length and print, to propose new styles, and human designers chose and finished the ones that went into production.

Advertising is moving fastest. Generative tools can produce and version campaign assets at a scale no studio could, and some brands make AI part of the story. Coca-Cola launched Y3000, a limited-edition flavour, in September 2023 and described it as co-created with AI.

Every brand publishing AI-assisted content now faces four checks. Provenance: was the model trained on content its provider had the right to use, and does the vendor's contract indemnify you if output infringes? Ownership: Module 5 showed that human creative input is what makes copyright protection likely, so record what people contributed. Disclosure: from 2 August 2026, Article 50 of the EU AI Act requires deployers of deepfakes, meaning realistic generated or manipulated images, audio or video, to disclose that the content is artificial, and providers to mark generated output in a machine-readable way. The Digital Omnibus gave generative systems already on the market before that date until 2 December 2026 to add the marking. Brand safety: review every asset for real people's likenesses, other firms' trademarks and stereotypes before it ships.

A gen AI product story is how a brand explains an AI-assisted product honestly. It says what the AI did, what people did and what the customer gets. "Designed by AI" usually overclaims; "our designers used AI to explore thousands of options, then chose and refined one" is accurate, and still interesting.

Functional AI planning tells you what AI can do in finance or HR. A vertical AI strategy asks what AI means for your industry: which use cases its regulators allow, which its data supports, and how fast competitors are moving. Four dimensions capture most of that.

Regulatory environment: how constrained is AI deployment in the sector? Score 1 for highly restricted, such as clinical decisions or consumer credit, and 4 for permissive. Data availability: is the sector's data structured, labelled and accessible? Score 1 for very limited and 4 for abundant. Competitive pressure: is AI already reshaping how firms compete? Score 1 for nascent and 4 for established AI-native competitors. Implementation maturity: how far along the adoption curve is the industry? Score 1 if only early adopters use AI and 4 if the late majority do. Back each score with a line of evidence.

The Industry AI Readiness Scorecard totals the four scores, equally weighted, into a readiness percentage. A high total means the sector is ready for AI and the pressure is real. But read the profile, not just the total: two sectors with the same total can need opposite strategies. Choose a posture by applying four rules in order.

First, if regulatory environment scores 1 or 2, the posture is Compliance-First. Build the governance, explainability and human sign-off the regulator will expect before scaling, and start where outputs go to staff, not customers. Second, if data availability scores 1 or 2, it is Data Builder. Invest first in capturing and organising the data later AI will need, using low-risk generative tools on your own content meanwhile. Third, if competitive pressure or implementation maturity scores 3 or 4, it is Fast Follower. Adopt proven tools quickly, usually by buying or partnering, and compete on speed of adoption. Otherwise it is Category Creator. The sector is permissive and data-rich but AI hasn't reshaped it yet, so pioneer a distinctive AI-enabled offer through staged bets.

The posture then works on your existing portfolio. Use it as a second pass over the ranked shortlist from Module 2: vertical dynamics can promote a use case, because competitors are already there, or demote one, because the regulator isn't ready. Then check it against the deployment plan from Module 4: a function facing strong sector pressure may need its tools sooner.

In regulated sectors, each priority also needs a make, partner or comply decision. Make it yourself and, under the EU AI Act, you take on a provider's duties. Partner, as A&O Shearman did with Harvey on agentic tools, and you share the build and the upside. Comply means accepting that a use case has to wait until the rules or the evidence allow it.