> ## Documentation Index > Fetch the complete documentation index at: https://docs.mcpmanager.ai/llms.txt > Use this file to discover all available pages before exploring further. # Industries > How MCP Manager governs agentic AI for regulated industries — financial services, investment management, healthcare, pharma and biotech, insurance, cybersecurity, and energy and utilities — putting one governed gateway between AI agents and the regulated systems they reach, with identity attribution, inline sensitive-data controls, and an audit trail of every call. Every regulated industry is arriving at the same place at the same time: AI agents are useful precisely because they reach into the systems that hold the most sensitive data, and that is exactly the reach that compliance, security, and risk teams cannot leave ungoverned. The Model Context Protocol (MCP) is how those agents connect — and on its own, MCP produces no record of who called what, no gate on the data that flows back, and no inventory a security review can examine. **MCP Manager** puts one governed gateway in that path. Every agent-to-system connection runs through a single control point that attributes each call to a real identity, inspects the data in flight, and logs the whole interaction — so a team can say yes to agentic AI and still answer the question every auditor, examiner, and regulator asks: *what did the AI touch, when, under whose authority, and how was it controlled?* These pages translate that into the language and obligations of specific industries. Each one opens in the reader's world, names the regulatory frameworks that shape their AI adoption, and maps the gateway's capabilities to the controls those frameworks demand. ## Choose your industry Provable control and examinable AI for institutions governed by GLBA, DORA, SR 11-7, and the EU AI Act. Hold the information wall and the books-and-records line for the buy-side under the Investment Advisers Act, the EU AI Act, and DORA. Keep PHI out of unsanctioned models and attribute every clinical-system call, under HIPAA and GDPR. Protect IP and patient data and keep an inspection-ready record across GxP, 21 CFR Part 11, and the EU AI Act. Govern AI across underwriting and claims for NAIC, NYDFS, GLBA, and EU AI Act obligations. Adopt the agentic SOC without inheriting tool poisoning, uncontrolled retrieval, or audit blind spots. Bring governed AI to critical infrastructure under NERC CIP, NIS2, and GDPR. A zero-trust control point for citizen-data AI under FISMA, NIST 800-207, the EU AI Act, and GDPR. Join agentic commerce without losing control of customer data under PCI DSS, CCPA/CPRA, and GDPR. ## The thread that runs through all of them Across every framework in these pages — GLBA and DORA, HIPAA and GDPR, 21 CFR Part 11, the NAIC AI bulletins, NERC CIP, the EU AI Act — the demand reduces to the same handful of controls: know which identity took an action, restrict access to the least data needed, keep sensitive data from leaving its boundary, and produce evidence of all of it on demand. A gateway that sits in the path of every agent call is the natural place to deliver them. That is also why the operator matters. MCP Manager is built by **Usercentrics**, the company whose core business is proving that organizations handle personal data lawfully — Europe's largest consent management platform, active in 100+ countries and processing billions of consent signals every month. Governing how AI agents access regulated data is the same discipline, one layer up. Covered entities and business associates under HIPAA can have MCP Manager sign a Business Associate Agreement (BAA), available on select enterprise plans tailored for regulated organizations. See [Security & Compliance](/enterprise/security-and-compliance#business-associate-agreement-baa). ## Further reading The most-developed of the industry pages — start here for the full pattern. Authentication, feature governance, runtime protections, and audit — the controls behind every industry claim. The complete index of MCP Manager capabilities. How the gateway is hardened as the control point in the path of every call.