
Building Compliance-Driven AI Systems: Navigating IEC 62304 and PCI-DSS Constraints
Pradeep Rao Vennamaneni , Senior Data Engineer - Lead, Citibank, USAAbstract
Due to the ever-increasing adoption of AI systems in the financial space, it is necessary to assess these regulatory frameworks, such as IEC 62304 and PCI DSS. As AI technologies within the finance sector process huge quantities of data that are sensitive, like transaction and personal information, these must be handled securely so that these are not breached or involve fraud—meeting the strict data security standards, privacy, and operation standards for a medical device software compliance with IEC 62304 and PCI DSS for payment card data security results. This article investigates how these compliance frameworks create the responsibility for designing, structuring, and building AI systems in financial institutions. It describes the technical problems in implementing real-time financial data processing and the issues addressed with cloud-native platforms, encryption, and data management applications. It discusses how, with technological advancements like large language models, Apache Kafka, and Apache Spark, the resulting financial AI systems can be compliance-driven and perform well. The article also delves into the ethical options of AI in finance and, in particular, data privacy, bias, and transparency. The conclusions include insights into the future of AI compliance with new technologies such as quantum computing and blockchain that will change the face of science. This study offers an actionable roadmap for companies to address the difficulties of regulatory compliance in the vein of AI’s potential fulfillment.
Keywords
Compliance-driven AI systems, financial data security, IEC 62304, PCI-DSS, Real-time data processing
References
Alam, M. A., Nabil, A. R., Mintoo, A. A., & Islam, A. (2024). Real-Time Analytics In Streaming Big Data: Techniques And Applications. Journal of Science and Engineering Research, 1(01), 104-122.
Ali, O. (2024). Popular API Technologies: REST, GraphQL, and gRPC.
Barik, R. K., Lenka, R. K., Rao, K. R., & Ghose, D. (2016, April). Performance analysis of virtual machines and containers in cloud computing. In 2016 international conference on computing, communication and automation (iccca) (pp. 1204-1210). IEEE.
Batani, J. (2017). An adaptive and real-time fraud detection algorithm in online transactions. International Journal of Computer Science and Business Informatics, 17(2), 1-12.
Brecko, A., Kajati, E., Koziorek, J., & Zolotova, I. (2022). Federated learning for edge computing: A survey. Applied Sciences, 12(18), 9124.
Carcillo, F., Dal Pozzolo, A., Le Borgne, Y. A., Caelen, O., Mazzer, Y., & Bontempi, G. (2018). Scarff: a scalable framework for streaming credit card fraud detection with spark. Information fusion, 41, 182-194.
Chavan, A. (2024). Fault-tolerant event-driven systems: Techniques and best practices. Journal of Engineering and Applied Sciences Technology, 6, E167. http://doi.org/10.47363/JEAST/2024(6)E167
Chavan, A. (2024). Fault-tolerant event-driven systems: Techniques and best practices. Journal of Engineering and Applied Sciences Technology, 6, E167. https://doi.org/10.47363/JEAST/2024(6)E167
Dhanagari, M. R. (2024). MongoDB and data consistency: Bridging the gap between performance and reliability. Journal of Computer Science and Technology Studies, 6(2), 183-198. https://doi.org/10.32996/jcsts.2024.6.2.21
Dhanagari, M. R. (2024). Scaling with MongoDB: Solutions for handling big data in real-time. Journal of Computer Science and Technology Studies, 6(5), 246-264. https://doi.org/10.32996/jcsts.2024.6.5.20
Dwivedi, R., Dave, D., Naik, H., Singhal, S., Omer, R., Patel, P., ... & Ranjan, R. (2023). Explainable AI (XAI): Core ideas, techniques, and solutions. ACM Computing Surveys, 55(9), 1-33.
Edapurath, V. N. (2023). Design and Implementation of a Scalable Distributed Machine Learning Infrastructure for Real-Time High-Frequency Financial Transactions.
Elouataoui, W. (2024). AI-Driven frameworks for enhancing data quality in big data ecosystems: Error_detection, correction, and metadata integration. arXiv preprint arXiv:2405.03870.
Feng, Z. (2024). Can GPT Help Improve Robo-advisory? The Construction of Robo-advisor for Users with Low Investment Experience Based on LLM. Advances in Economics, Management and Political Sciences, 90, 26-41.
Goel, G., & Bhramhabhatt, R. (2024). Dual sourcing strategies. International Journal of Science and Research Archive, 13(2), 2155. https://doi.org/10.30574/ijsra.2024.13.2.2155
Gupta, R., Tanwar, S., Al-Turjman, F., Italiya, P., Nauman, A., & Kim, S. W. (2020). Smart contract privacy protection using AI in cyber-physical systems: tools, techniques and challenges. IEEE access, 8, 24746-24772.
Hoofnagle, C. J., Van Der Sloot, B., & Borgesius, F. Z. (2019). The European Union general data protection regulation: what it is and what it means. Information & Communications Technology Law, 28(1), 65-98.
Iwasokun, G. B., Omomule, T. G., & Akinyede, R. O. (2018). Encryption and tokenization-based system for credit card information security. International Journal of Cyber Security and Digital Forensics, 7(3), 283-293.
Juuso, I., & Pöyhönen, I. (2023). Medical-Grade Software Development: How to Build Medical-Device Products That Meet the Requirements of IEC 62304 and ISO 13485. CRC Press.
Kansal, S., & Gupta, V. (2024). ML-powered compliance validation frameworks for real-time business transactions. International Journal for Research in Management and Pharmacy (IJRMP), 13(8), 48.
Kanwal, N., Janssen, E. A., & Engan, K. (2023, September). Balancing privacy and progress in artificial intelligence: anonymization in histopathology for biomedical research and education. In International Conference on Frontiers of Artificial Intelligence, Ethics, and Multidisciplinary Applications (pp. 417-429). Singapore: Springer Nature Singapore.
Karwa, K. (2024). The future of work for industrial and product designers: Preparing students for AI and automation trends. Identifying the skills and knowledge that will be critical for future-proofing design careers. International Journal of Advanced Research in Engineering and Technology, 15(5). https://iaeme.com/MasterAdmin/Journal_uploads/IJARET/VOLUME_15_ISSUE_5/IJARET_15_05_011.pdf
Konneru, N. M. K. (2021). Integrating security into CI/CD pipelines: A DevSecOps approach with SAST, DAST, and SCA tools. International Journal of Science and Research Archive. Retrieved from https://ijsra.net/content/role-notification-scheduling-improving-patient
Koo, J., Kang, G., & Kim, Y. G. (2020). Security and privacy in big data life cycle: a survey and open challenges. Sustainability, 12(24), 10571.
Kumar, A. (2019). The convergence of predictive analytics in driving business intelligence and enhancing DevOps efficiency. International Journal of Computational Engineering and Management, 6(6), 118-142. Retrieved from https://ijcem.in/wp-content/uploads/THE-CONVERGENCE-OF-PREDICTIVE-ANALYTICS-IN-DRIVING-BUSINESS-INTELLIGENCE-AND-ENHANCING-DEVOPS-EFFICIENCY.pdf
Lee, J. (2020). Access to finance for artificial intelligence regulation in the financial services industry. European Business Organization Law Review, 21(4), 731-757.
Luo, F., Zhao, J., Dong, Z. Y., Chen, Y., Xu, Y., Zhang, X., & Wong, K. P. (2015). Cloud-based information infrastructure for next-generation power grid: Conception, architecture, and applications. IEEE Transactions on Smart Grid, 7(4), 1896-1912.
Mubeen, M. (2024). Zero-Trust Architecture for Cloud-Based AI Chat Applications: Encryption, Access Control and Continuous AI-Driven Verification.
Muzukwe, S. (2023). A Governance Framework for Security in Cloud Architecture (Master's thesis, University of Johannesburg (South Africa)).
Nandan Prasad, A. (2024). Monitoring and Maintaining Machine Learning Systems. In Introduction to Data Governance for Machine Learning Systems (pp. 429-483). Apress, Berkeley, CA.
Narkhede, N., Shapira, G., & Palino, T. (2017). Kafka: the definitive guide: real-time data and stream processing at scale. " O'Reilly Media, Inc.".
Nyati, S. (2018). Revolutionizing LTL carrier operations: A comprehensive analysis of an algorithm-driven pickup and delivery dispatching solution. International Journal of Science and Research (IJSR), 7(2), 1659-1666. Retrieved from https://www.ijsr.net/getabstract.php?paperid=SR24203183637
Onoja, J. P., Hamza, O., Collins, A., Chibunna, U. B., Eweja, A., & Daraojimba, A. I. (2021). Digital Transformation and Data Governance: Strategies for Regulatory Compliance and Secure AI-Driven Business Operations.
Owoade, S. J., Uzoka, A., Akerele, J. I., & Ojukwu, P. U. (2024). Cloud-based compliance and data security solutions in financial applications using CI/CD pipelines. World Journal of Engineering and Technology Research, 8(2), 152-169.
Padmanaban, H. (2024). Revolutionizing regulatory reporting through AI/ML: Approaches for enhanced compliance and efficiency. Journal of Artificial Intelligence General science (JAIGS) ISSN: 3006-4023, 2(1), 71-90.
Rajesh, Y. S., Kumar, V. K., & Poojari, A. (2024). A unified approach toward security audit and compliance in cloud computing. Journal of The Institution of Engineers (India): Series B, 105(3), 733-750.
Raju, R. K. (2017). Dynamic memory inference network for natural language inference. International Journal of Science and Research (IJSR), 6(2). https://www.ijsr.net/archive/v6i2/SR24926091431.pdf
Ritondale, E. (2022). Shipwrecking Probability in Mediterranean Territorial Waters. A Cultural Approach to Archaeological Predictive Modelling.
Rust, P., Flood, D., & McCaffery, F. (2016). Creation of an IEC 62304 compliant software development plan. Journal of Software: Evolution and Process, 28(11), 1005-1010.
Sardana, J. (2022). Scalable systems for healthcare communication: A design perspective. International Journal of Science and Research Archive. https://doi.org/10.30574/ijsra.2022.7.2.0253
Sardana, J. (2022). The role of notification scheduling in improving patient outcomes. International Journal of Science and Research Archive. Retrieved from https://ijsra.net/content/role-notification-scheduling-improving-patient
Seaman, J. (2020). PCI DSS: An integrated data security standard guide. Apress.
Sharma, M., Choudhary, V., Bhatia, R. S., Malik, S., Raina, A., & Khandelwal, H. (2021). Leveraging the power of quantum computing for breaking RSA encryption. Cyber-Physical Systems, 7(2), 73-92.
Singh, V. (2022). Intelligent traffic systems with reinforcement learning: Using reinforcement learning to optimize traffic flow and reduce congestion. International Journal of Research in Information Technology and Computing. https://romanpub.com/ijaetv4-1-2022.php
Singh, V., Doshi, V., Dave, M., Desai, A., Agrawal, S., Shah, J., & Kanani, P. (2020). Answering Questions in Natural Language About Images Using Deep Learning. In Futuristic Trends in Networks and Computing Technologies: Second International Conference, FTNCT 2019, Chandigarh, India, November 22–23, 2019, Revised Selected Papers 2 (pp. 358-370). Springer Singapore. https://link.springer.com/chapter/10.1007/978-981-15-4451-4_28
Steurer, R. (2021). Kafka: Real-Time Streaming for the Finance Industry. The Digital Journey of Banking and Insurance, Volume III: Data Storage, Data Processing and Data Analysis, 73-88.
Article Statistics
Downloads
Copyright License
Copyright (c) 2025 Pradeep Rao Vennamaneni

This work is licensed under a Creative Commons Attribution 4.0 International License.