As someone looking in from the outside: what regulations govern this type of work?

In EU: eIDAS and ETSI.

In the US: BIPA started in Illinois and is expanding to other states.

BIPA sets a brutal bar in terms of regulation.

Okay, that makes sense.

I'm in a different regulated industry (healthcare), so we have a lot of different international standards there, and wondered how that worked in a different space.