How to Build a Defensible Record for Every AI Decision (The Demo Room #28)
Welcome to The Demo Room – your front-row seat to the future of RegTech, RiskTech, and AI innovation.
In this series, we document our research interviews with vendors tackling significant risk and compliance challenges. Each blog looks at how a specific product addresses a live industry problem.
On this occasion, we feature Aegis Trace, a provider of regulatory intelligence and decision-level evidence for AI used in regulated firms.
Most AI governance sits above the level of an individual decision. Firms write policies, classify use cases, maintain model inventories and approve systems. These controls are necessary but not sufficient. They generally fail to answer the most fundamental question: why did this model make this decision for this customer, using these inputs, under the rules that applied at the time?
That level of nuance sets a high bar. And necessarily so, as AI moves into higher-value and higher-risk use cases across suitability, underwriting, financial crime monitoring, customer support and trading. Reviewers – compliance teams, auditors or regulators – need complete records of how AI influenced outcomes, and why that was justified.
There is evidence that, at present, these records may not exist and that scrutiny would reveal a significant compliance risk exposure. Our latest research found that 69.3% of financial institutions had AI deployment running ahead of their measured control environment.
Firms face pressure to adopt AI, to do so quickly, and to realise the commercial benefits it promises. They also face a fragmented regulatory landscape. AI-specific legislation sits alongside conduct, resilience (including cybersecurity and data protection), financial crime, prudential and sector rules. Their effect changes by jurisdiction, business activity and degree of automation.
At this rate of AI adoption, within this complex, still evolving regulatory environment, our observed governance gaps were inevitable. But AI will not be rolled back. Rather, governance must move forward. And since it is already behind, it must accelerate.
Aegis Trace is built to help firms realise the value of AI by closing governance gaps and building decision evidence that connects every action to every relevant regulation.
The Problem for Firms
Evidence for an AI-supported decision is often spread across model logs, prompts, workflow systems, customer files, policy documents and GRC platforms. Reconstructing the decision after a complaint, audit request or supervisory question becomes a manual exercise. Model versions may have changed, operational context may be missing and the original rationale may be difficult to separate from a later explanation.
Third-party technology adds another boundary. A vendor may provide technical logs or model documentation, but the regulated firm still owns the customer outcome and the way the system operates inside its process. The institution needs evidence tied to its own policies, controls, approvals and legal obligations.
Regulatory intelligence has a related relevance problem. A conventional alert may tell a compliance team that a publication has changed. It does not always show which workstream is affected, how the rule overlaps with another jurisdiction or which AI control needs attention. In a wealth manager, for example, the same development may have different implications for customer support, data governance, human resources and investment activity.
Privacy and integrity complicate the record further. Capturing a useful decision trace can involve sensitive client information. The firm must limit what leaves its environment while still preserving enough context for review. It must also be able to show that the evidence was created at the time and was not altered afterwards.
A Solution: Combining Regulatory Intelligence and AI Decision Traceability
Aegis Trace combines Atlas, its regulatory intelligence product, with AI decision capture and traceability, and a governance layer to apply regulatory and internal rules before an AI process runs.
1. Map the applicable rules with Atlas
Atlas is regulatory intelligence built specifically for AI, covering 393 regulatory regimes across 90 jurisdictions, all mapped against 24 business workstreams, 18 cross-cutting AI controls and 69 upcoming regulatory deadlines. With this, users can examine what applies to a particular activity within its exact context.
The solution focuses specifically on how regulations affect a firm’s use of AI. For broad instruments such as GDPR, it maps only the provisions relevant to automated or AI-supported decisions, rather than treating the entire regulation as an AI rule.
2. Capture the decision inside the workflow
The traceability platform records AI decisions when they occur, structuring and connecting the relevant metadata for complete auditability. Each record includes the decision, inputs or signals, model and version, the stated rationale and the applicable regime.
Depending on the firm's architecture, a team can submit the record through a REST API or typed client, reuse an existing gateway or service mesh, or place a collector on the network path. The collector captures relevant AI traffic without changing application code or blocking the live request, and personal data can be redacted inside the firm's environment before being sent to Aegis Trace.
3. Assess, seal and review the evidence
Aegis Trace checks the captured record against the regulatory clauses identified through Atlas. The platform presents decisions as passed, flagged, failed or not yet assessed, with the rationale and source citations available for review. Cases that cannot be resolved automatically can be routed to a human reviewer.
The resulting decision certificate records what was decided and the regulatory basis supplied at the time. It is signed, independently timestamped and stored as a tamper-evident record. If a relevant regulatory regime changes, the platform reassesses affected records and flags those that require human review.
Parker & Lawrence’s View
Aegis Trace joins two areas that firms often manage separately. Atlas establishes which rules may apply to an AI-enabled activity. The traceability platform records what happened at the point of decision. Connecting those layers is a significant step forward for compliance and audit teams, who are currently faced with general policies and raw technical logs.
The product is most convincing in high-volume workflows where individual outcomes may be challenged later. Suitability recommendations, alert suppression, credit decisions and underwriting all create a clear need for evidence at decision level. A signed certificate can give the first line, compliance, audit and a regulator a common record to inspect.
The certificate does not prove that a decision was correct. Its value depends on the completeness of the captured inputs, the quality of the applicable-rule mapping and the way human intervention is recorded. A sealed but incomplete trace would preserve the integrity of an inadequate record. Buyers should test the capture schema and exception handling with cases specific to their business.
Atlas faces a different sort of scrutiny. Regulatory intelligence earns trust through update speed, source quality, versioning and accurate applicability. Aegis Trace is getting ahead of this: training and refining models for regulatory tasks such as identifying obligations, assessing applicability and supporting findings with source material. Prospective clients should still examine missed-obligation controls, false positives, multilingual consistency and the role of human verification.
Selection for the FCA AI Supercharged Sandbox and the partnership with InterSystems give Aegis Trace credible routes to test its approach in financial services. The next stage is to show that Atlas and the certificates remain complete across live institutional workflows, integrate cleanly with model inventories, GRC and case-management systems, and produce evidence that compliance teams and regulators can use without extensive reconstruction.
If Aegis Trace can demonstrate that in production, it will occupy a distinct layer in the AI governance stack.
