∞Direct answer
Direct answer
An audit trail lets a person check an AI note step by step. Save the claim, first source, ask, tool, reply, check, and each change. Use it to test a claim. It cannot show that a deal is good. NIST warns that generative AI can make false text and false source links. [1]
Start with one claim
Start with a fact that may change the deal. It may be about a buyer, cash, shares, or a key term. Do not save a broad note, such as strong sales.
Give each fact its own card. Keep the exact words, type, and state. Say if it is a fact, a guess, a view, or a key question.
Name the first source. Add the file or web link, page or cell, source date, and check date. An AI note is a lead. It is not proof.
NIST says generative AI may give false text and false source links with confidence. Open the named source before you use the point. [1]
- Claim ID: a short, stable name for the point.
- Proof: source, place, date, and a short exact extract.
- State: confirmed, open, disputed, or rejected.
- Owner: the person who must close or raise the point.
Save the AI run
Write the question before you run the tool. Save the prompt, tool name, model name if known, run date, and files or links it may use.
Keep its first reply. Do not swap it for a neat memo. A person who checks it needs to see what the tool said first.
Link each point in the reply to a claim card. If the tool cannot name a source, mark it not known. Do not let a neat line hide a gap.
NIST says teams should review and check sources and citations in AI replies. [1]
- Question: the small task for this run.
- Input set: approved files, links, and cut-off date.
- Run log: tool, known version, and time.
- Reply: saved answer and links to claim cards.
Show the human check
The person who checks it should open the key source. They should check the claim, date, and what the source does not show. They may then pass, change, or reject the point.
Save the name, date, and why for each big edit. Keep a new note for a clash, lost file, or question sent to the firm.
Do not use a person as a rubber stamp. They need time and power to keep weak work out of the deal memo.
ESMA says records for firms in its scope should cover AI use, decision paths, data sources, algorithms, and changes over time. [3]
- Check: pass, change, reject, or raise.
- Edit note: what changed and why.
- Open point: lost proof and next step.
- Raise it: who decides if the point can change the deal.
Keep a record you can find
Keep the claim card, source copy or link, AI run, and check note in one place. Give it a deal ID and a clear folder or system path.
Set access rules before you add files with private data. Name the record owner. Ask legal or compliance staff about how long to keep it, privacy, and any stop on delete.
US advisers that are registered, or must register, have set books-and-records rules. The SEC rule lets them use e-records. Its terms call for access, search, guards, and a spare copy. [2]
IOSCO names AI inputs, replies, tool logic, and logs of use and choice as audit-trail proof a supervisor may check. [4] The right set depends on the firm, place, and task.
- Record path: deal ID and one place to find it.
- Access: people who may see or change the record.
- Keep rule: owner, check date, and delete rule.
- Issue: error, harm, fix, and later check.
FAQ
Frequently asked questions
What goes in the AI trail?
Keep the claim, first source, exact place, prompt, input set, tool, reply, checker, edits, and open points. A later checker should be able to trace the path.
Can a source link prove an AI claim?
No. Open the source. Check the words, date, scope, and link to the claim. NIST says generative AI can make false text and false citations. [1]
Should we save the prompt and first reply?
Yes. They show how the note began. Keep them with the approved inputs and the human edits. This makes a later check more useful.
Does this meet all legal rules?
No. Rules depend on the firm, service, place, and record type. The SEC rule has a set scope for advisers. Ask legal or compliance staff about your own duties. [2]
REF
Sources
- 1
National Institute of Standards and Technology
Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile ↗ - 2
Electronic Code of Federal Regulations
17 CFR 275.204-2 — Books and records to be maintained by investment advisers ↗ - 3
European Securities and Markets Authority
Public Statement on Artificial Intelligence and Investment Services ↗ - 4
International Organization of Securities Commissions
Supervisory Toolkit for AI Use in Capital Markets ↗