In a regulated firm, the audit trail is the product.
Every AI demo shows you the result. Almost none show you the record. In a regulated firm that is backwards, because the record is the part you will actually be asked for.
Published 6 min read Sources checked 8 September 2026
Filed under FCA compliance, AI governance, Audit trail, Financial services
The short answer
Log six things for every agent action: what triggered it, what inputs it read and from where, what it produced, which human confirmed it, what changed between draft and final, and what it refused or escalated. If a supplier cannot show you that record in a demo, they have built the interesting half and left you the liable half.
On this page · 8 sections
Ask a supplier to demo the audit trail rather than the agent. Watch what happens.
Most demos are built around the moment of output: the report appears, the call is booked, the pack is assembled. The record of how that happened is usually a log file somebody will “expose in the API”.
For a firm outside regulation, fair enough. For you, that is the deliverable.
Why is “the model decided” not an answer?
Because it is not a decision anyone can be accountable for, and accountability is the unit the regulator works in.
Consumer Duty asks you to evidence good outcomes. SM&CR asks who was responsible. Neither has a category for a process nobody owns. If your file cannot name a person at the point of decision, the answer is not “the AI”: the answer is you.
The purpose of the log is not to prove the agent was right. It is to prove a human was there when it mattered, and to make it cheap to find out when they were not.
What does each record actually need to contain?
| Record | Must contain | The question it answers later |
|---|---|---|
| Trigger | Event, timestamp, which rule fired | Why did this happen at all? |
| Inputs | Each document, its origin, its version and date | Where did that figure come from? |
| Output | The artefact, immutable, with a hash | Is this the version that was sent? |
| Confirmed by | Named individual, timestamp, what they saw | Who is accountable? |
| Diff | What the human changed before it went | Did anyone actually read it? |
| Refused | What it would not do, and who it went to | Did the guardrail work, or was it decorative? |
Why does the refusal record matter most?
Because a guardrail nobody can see is indistinguishable from no guardrail.
If your agent has never refused anything, one of two things is true: the work is genuinely always in scope, or the limit does not exist. The log is how you tell those apart, and it is the first thing we would look for in someone else’s system.
How do you specify this without a compliance project?
- Write the six records into the statement of work. One page. Not an annex, a requirement.
- Ask to see them in the demo, populated with a real run, before you sign.
- Require export. If the trail lives only in a supplier’s dashboard, you do not have a record: you have a subscription to one.
- Set retention to match your file retention, not the supplier’s default of ninety days.
- Test it once, deliberately. Pick a completed case at random and try to reconstruct the decision from the log alone. If you cannot, neither can anyone else.
The uncomfortable part
Building this makes the automation less impressive and more expensive. A confirmation step is friction, and friction is exactly what the demo was designed to remove.
That is the trade, and in a regulated firm it is not really a trade at all. The thing you are buying is not the time saved. It is the time saved that you can still account for.
What this does not tell you
What any regulator requires of your particular system. The six records are what we think makes an agent’s work accountable in a regulated firm, labelled as our opinion in the sources; they are not a rule the FCA has written, and a firm under a specific obligation should check that obligation rather than this list.
Nor does a complete log make the work correct. The trail shows who confirmed what and when; it does not show that they were right to, which is still a person’s job.
Questions people actually ask
What should an AI agent log in a regulated firm?
Six records per action: the trigger, the inputs and their sources, the output, the named human who confirmed it, the difference between draft and final, and anything the agent refused or escalated and to whom.
Is "the AI decided" an acceptable answer to a regulator?
No. Consumer Duty asks a firm to evidence good outcomes and SM&CR asks who was responsible. Neither has a category for a process nobody owns, so accountability returns to the firm by default.
Why does logging refusals matter?
A guardrail nobody can observe is indistinguishable from no guardrail. If an agent has never refused anything, either the work is always in scope or the limit does not exist, and only the log tells you which.
Sources
- 01 FCA, PS22/9 “A new Consumer Duty”, 27 July 2022: “the rules come into force on 31 July 2023” for open products and services, and on 31 July 2024 for closed ones (the outcome tests this specification is written against). fca.org.uk(opens in a new tab)
Weight: regulator, primary Re-checked: every six months Last read: 24 September 2026
- 02 FCA, “Senior Managers and Certification Regime”, updated 24 April 2026: the regime aims to “reduce harm to consumers and strengthen market integrity by making individuals more accountable for their conduct and competence” (the accountability requirement this specification is written against). fca.org.uk(opens in a new tab)
Weight: regulator, primary Re-checked: every six months Last read: 24 September 2026
- 03 The six-record specification is Noxia’s own and is not a regulatory standard. It is what we build to.
Weight: our opinion, labelled Re-checked: never: it cannot go out of date
Checked 8 September 2026. Next scheduled check 23 March 2027. Numbers that move (leaderboards, live indices) are re-checked every 30 days; annual datasets and rules in force every six months; dated research once a year. If something here has gone stale before we got to it, tell us and we will correct it and say what changed.
Cite this note
Noxia, “In a regulated firm, the audit trail is the product”, Field notes, 8 September 2026; sources checked 8 September 2026. https://www.noxia.co.uk/field-notes/the-audit-trail-is-the-product
Ask us to demo the audit trail, not the agent.
We will show you the six records on a real run before you sign anything, and the export path out of our system on day one.