As someone looking in from the outside: what regulations govern this type of work?

In EU: eIDAS and ETSI.

In the US: BIPA started in Illinois and is expanding to other states.

BIPA sets a brutal bar in terms of regulation.