{"catalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","kind":"record","record":{"attributes":{"category":"compliance_regulatory","domain":["Compliance, Audit & Assurance","Risk Assessment & Management"],"inherent_rating":"high","taxonomy":["enterprise-risk","coso-erm-risk"]},"canonicalUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-sector-regulatory-breach","description":"Non-compliance with sector regimes — banking prudential rules, consumer-lending laws, payment-network rules, healthcare (FDA/HIPAA/CMS, Anti-Kickback/Stark, False Claims), export controls (EAR/ITAR), antitrust, and environmental/labor rules — triggering fines, sanctions, or loss of license.","details":{"category":"compliance_regulatory","impact":"high","inherent_rating":"high","likelihood":"medium","risk_id":"compliance-sector-regulatory-breach","taxonomies":["enterprise-risk","coso-erm-risk"],"treatment":"mitigate"},"id":"risk:compliance-sector-regulatory-breach","mapUrl":"https://controlsmap.com/?v=1&node=risk%3Acompliance-sector-regulatory-breach","sourceIds":["aiuc-1","cobit-2019","eu-ai-act","gdpr","iso-27001","nist-800-53"],"sourceUrl":null,"title":"Sector regulatory non-compliance (financial, healthcare, trade)","type":"risk"},"relationships":[{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:120bcc031dc2a38db85fea9db36abd09cc72207adeba526ac2a3160bed1fc14a","properties":{"rationale":"The quality system is where regulatory-compliance strategy and evidence for AI products are maintained.","strength":"related"},"sourceDetailPath":"/data/v1/records/uc-uc-ai-24-066ea393.json","sourceId":"uc:UC-AI-24","targetDetailPath":"/data/v1/records/risk-compliance-sector-regulatory-breach-5eb29698.json","targetId":"risk:compliance-sector-regulatory-breach","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:6e0b91b6945069b7e7edae111d475c5e13cc043c1d41718d123a918a403bef97","properties":{"rationale":"DPIA/PIA (GDPR Art 35) before high-risk processing is a direct data-protection compliance control identifying and mitigating privacy-law violations before they occur.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-risk-16-81243062.json","sourceId":"uc:UC-RISK-16","targetDetailPath":"/data/v1/records/risk-compliance-sector-regulatory-breach-5eb29698.json","targetId":"risk:compliance-sector-regulatory-breach","type":"mitigates"},{"expectedCatalogRevision":"24028ffcfc2b295fa1b08ee6caa84b765f0731b321496bf4f548c49ad2177028","id":"rel:9355fd7a51ade2a286f4a1133269c3027bb627d8db6eca853c29e2c5b2ecbfe7","properties":{"rationale":"A register of applicable legal/regulatory requirements with owners, evaluated on a cadence and remediated, is the operative defense against sector non-compliance.","strength":"primary"},"sourceDetailPath":"/data/v1/records/uc-uc-audit-24-fa96fe18.json","sourceId":"uc:UC-AUDIT-24","targetDetailPath":"/data/v1/records/risk-compliance-sector-regulatory-breach-5eb29698.json","targetId":"risk:compliance-sector-regulatory-breach","type":"mitigates"}],"schemaVersion":1}