Guide · financial services
An audit trail for AI agents in financial services
What you want is that when a supervisor, an auditor or a customer asks about something an AI agent did, you answer with the record of who decided, under which control, and what ran — not with a reconstruction. In a bank, an insurer or a wealth manager the questions are predictable, and the regulations they come from already say what has to be kept.
Why a log of tool calls is not enough
An agent's trace says what it called. A supervisor asks more: which system it was and who owns it, who allowed the action and what they were shown, which policy and version applied, and whether anything was waived. Most of that is never in a trace, and it cannot be rebuilt afterwards.
What the rules ask for
| Source | What it asks you to be able to show |
|---|---|
| DORA (Regulation (EU) 2022/2554) | ICT risk management with records, classification and reporting of major ICT incidents, and a register of information on ICT third-party arrangements — which includes the AI providers an agent depends on. |
| EU AI Act | For high-risk systems, such as credit scoring of individuals and life and health insurance pricing, from 2 December 2027: human oversight by people with the competence and authority for it, logs kept for at least six months, and the record behind a decision. |
| PRA SS1/23 (UK banks) | Model risk management: an inventory of models, their owners and uses, validation, and controls proportionate to risk. |
| Senior Managers and Certification Regime (UK) | A named person accountable for each area, which means a named person who decided, not an anonymous approval. |
Whether and how each applies is for your organisation and its advisers to decide; the point is that all of them read the same kinds of evidence.
What to keep for every consequential action
- The AI system that acted, from a register with its provider, model, purpose and owner.
- What the agent was asked to do and what it proposed, as written at the time.
- The control that applied, the policy version, and whether it was met or waived — with the waiver's owner and expiry.
- The person who decided, what they were shown, their decision, their reason and the time.
- What actually ran, set against what was allowed.
- An insert-only, hash-chained log, and an export signed with a published key that someone outside the team can verify.
Where the record is written
The record has to be written at the moment of action, by the thing the agent asks before it acts. Written afterwards from logs, it misses what the approver saw and which rule applied. Written by the agent itself, it is the agent's account of its own behaviour. The approval and the record should be the same step.
How Deliverd keeps it
Deliverd is built for this: compliance at the moment of action. An agent declares a consequential action at a gate or asks a named person, and the decision, the person, what they saw and what ran are written as it happens to an audit trail that refuses edits. Compliance Mode, included in Business and Enterprise, adds the AI system register, governed work with controls and exceptions, and built-in packs for NIST AI Risk Management Framework, ISO/IEC 42001 AI management system, EU AI Act, UK AI regulatory principles, DORA (Digital Operational Resilience Act), DORA (Digital Operational Resilience Act), SR 26-2 model risk management and PRA SS1/23 model risk management.
One evidence pack holds the system, the controls, the evidence, the decisions and the timeline, signed so that a copy changed after export no longer verifies. It records governance; it does not certify compliance, and a framework mapping is a starting point for your own review.
Questions
- When do the EU AI Act's high-risk obligations apply?
- For Annex III systems, which include credit scoring of individuals and life and health insurance pricing, from 2 December 2027, the date set by the AI Omnibus (Regulation (EU) 2026/1744).
- Do AI providers belong in the DORA register of information?
- An AI provider an agent depends on is an ICT third-party service provider like any other, so it is a question for your register. Deliverd's ICT register view lists them from the AI system register.
- Can an auditor check an export without access to our systems?
- Yes. A Deliverd evidence pack carries a sha256 digest signed with a published Ed25519 key, and can be verified in a browser or with one command, without an account.