Fine-tuning LLMs in regulated industries
Banks, insurers and health systems can own fine-tuned models, but only if the model, its data and its evidence survive governance. What the rules say in 2026, and how we build engagements around them.
A fine-tuned model is, in one sense, easier to govern than a prompted frontier API: it has a defined task, a frozen version, training data you can document and a measurable error rate on a test set you control. It also introduces obligations an API user never had, because you now trained something.
Three regimes come up in almost every regulated engagement we run. In US banking, the long-standing model-risk guidance SR 11-7 was replaced in April 2026 by SR 26-2, which explicitly leaves generative AI outside its scope — so banks are writing their own rules for LLMs now. In US healthcare, HIPAA governs any protected health information used for training, and de-identification is the cleanest path. In the EU, the AI Act’s obligations for general-purpose model providers have applied since August 2025, and the Commission has said when a fine-tuner becomes a provider: a compute threshold that a typical enterprise fine-tune misses by four orders of magnitude.
Across all three, the same artefacts do most of the work: a data card, a model card, a frozen evaluation with confidence intervals, red-team results, and a change log. We produce them by default.
Evidence pack we deliver
- Data card: sources, consent basis, de-identification method, known gaps
- Model card: intended use, out-of-scope uses, limitations
- Evaluation report: held-out metrics with confidence intervals, per-segment results
- Red-team and safety testing log
- Training compute record (FLOPs, hardware, dates)
- Change log and retraining policy
Model risk management for fine-tuned LLMs after SR 26-2
What changed in April 2026 and how banks are governing LLMs now.
HealthcareHIPAA and fine-tuning on clinical data
Business associates, de-identification and memorization risk.
European UnionEU AI Act: when does fine-tuning make you a provider?
The one-third compute rule, computed for real fine-tunes.
Common questions
Can’t find your question? Ask a senior engineer.
Can regulated companies fine-tune LLMs?
Yes. The usual approach is to train inside the company’s own environment on de-identified or appropriately governed data, and to produce documentation and evaluation evidence for model-risk and compliance review.
Is a fine-tuned model easier to govern than an API?
Often yes: it is versioned, its training data is documented and its error rates are measured on a test set you control. It also adds obligations, because you trained it.
Bring your risk team to the briefing.
We walk through the evidence pack for your regime and where data and weights live at every step.
Book a briefing →