How does this edition relate to The Auditability Gap?

The Auditability Gap sets out the argument for regulated institutions in general. This edition works it through one hypothetical asset manager's quarterly AUM report, from draft to approval and on to the next quarter, applies the same review to a bank and an insurer, and adds a worksheet and a four-week pilot plan. The five layers and the four stages are shared.

Does the EU AI Act cover AI-drafted management reporting?

It depends on the system's intended use. Annex III high-risk uses include credit scoring of natural persons (fraud detection excepted) and risk assessment and pricing for natural persons in life and health insurance; internal management reporting, as in the report's example, is not among them. The European Commission has announced that Annex III rules apply from 2 December 2027. A real system's classification should be confirmed with counsel.

Is an AI drafting layer a model under SR 26-2?

SR 26-2, issued by the Federal Reserve, OCC and FDIC in April 2026 to replace SR 11-7, covers quantitative models and excludes simple arithmetic and deterministic rule-based processes. Generative and agentic AI are outside its scope; a bank's broader risk-management and governance practices should guide their controls. The guidance states that it sets no enforceable standards. The useful question is which parts of a workflow are models, which are arithmetic, and which are a generative drafting layer.

The AI Auditability Gap · Financial services edition

2026 · PDF · 24 pages

Your AI produced the report. Can you defend the numbers?

A DataQube report for banks, asset managers and insurers on verifying and defending AI-generated analysis, followed through one quarterly report from AI draft to approval and into the next quarter.

A worked example: an AI-drafted quarterly AUM report with a correct figure and an unsupported explanation
Four places the evidence breaks, and the five layers of an auditable answer
EU, US and UK context as of October 2026: the AI Act and AI Omnibus, SR 26-2, BCBS 239 and the FCA
A six-question worksheet and a four-week pilot to run on one of your own reports

The AI Auditability Gap in Financial Services — Your AI produced the report. Can you defend the numbers?

Written forReport owners and approvers in data, analytics, reporting and investment operations, the risk and compliance functions that oversee them, and internal audit.

01Inside the report

A correct number, an unsupported explanation

In the report's worked example, a hypothetical asset manager's AI-drafted quarterly report says AUM rose 2.4%, “driven by strong investment performance”. The figure is right; the explanation is not. Net inflows of $17 million more than offset a $5 million investment loss. The executive brief draws three practices from it.

01
Check the explanation as well as the number.A correct figure can accompany an unsupported explanation. Connect each material sentence to its calculation, its sources and the definitions in force.
02
Record the review.What was challenged, what changed, why, and who approved it. The same record serves risk, compliance and internal audit, though an owner's approval is not independent assurance.
03
Keep the work for the next cycle.The record that supports approval is also where the next report can start, so a change in data can be told apart from a change in definition.

The evidence record behind the approved sentence, the bank and insurer examples, the regulatory context, the worksheet and the pilot plan are in the report. Get the report

17 Apr 2026SR 26-2 replaces SR 11-7 in US model risk guidance; generative and agentic AI are outside its scopeFederal Reserve, OCC and FDIC · cited in the report
19 Oct 2026The FCA publishes AI good and poor practice, including audit trails of AI interactionsFinancial Conduct Authority · cited in the report
2 Dec 2027EU AI Act Annex III high-risk rules apply, following the AI OmnibusEuropean Commission, July 2026 · cited in the report

Definition

What is the AI Auditability Gap?

The distance between an AI-generated conclusion and the evidence an institution can establish about how it was produced. It matters because a correct figure can accompany an unsupported explanation. If the reviewer cannot see the sources, calculation and definitions behind a sentence, they have to rebuild the work before signing it, and the time saved in drafting is spent again in review.

How does this edition relate to The Auditability Gap?: The Auditability Gap sets out the argument for regulated institutions in general. This edition works it through one hypothetical asset manager's quarterly AUM report, from draft to approval and on to the next quarter, applies the same review to a bank and an insurer, and adds a worksheet and a four-week pilot plan. The five layers and the four stages are shared.
Does the EU AI Act cover AI-drafted management reporting?: It depends on the system's intended use. Annex III high-risk uses include credit scoring of natural persons (fraud detection excepted) and risk assessment and pricing for natural persons in life and health insurance; internal management reporting, as in the report's example, is not among them. The European Commission has announced that Annex III rules apply from 2 December 2027. A real system's classification should be confirmed with counsel.
Is an AI drafting layer a model under SR 26-2?: SR 26-2, issued by the Federal Reserve, OCC and FDIC in April 2026 to replace SR 11-7, covers quantitative models and excludes simple arithmetic and deterministic rule-based processes. Generative and agentic AI are outside its scope; a bank's broader risk-management and governance practices should guide their controls. The guidance states that it sets no enforceable standards. The useful question is which parts of a workflow are models, which are arithmetic, and which are a generative drafting layer.

02What's inside

Ten sections, one quarterly report from draft to approval

01
The report is ready for reviewAn AI-assisted workflow drafts a quarterly AUM report, and approving it raises five questions.
02
Worked example: what moved AUMA correct number and an unsupported explanation, reconciled in a bridge of flows and investment result.
03
Where the evidence breaksSource, definition, calculation and interpretation: four gaps that turn a check into a reconstruction.
04
Regulatory contextThe EU AI Act, SR 26-2, BCBS 239 and the FCA's good and poor practice, read against one workflow.
05
Five layers of an auditable answerSource, transformation, context, reasoning and reproducibility, applied to the AUM report.
06
The evidence record and meaningful reviewOne approved claim with its evidence, and what the reviewer challenged, changed and approved.

07
Reuse in the next reporting cycleThe next quarter starts from the last one, which stays as it was approved.
08
Banking and insurance applicationsThe same review for exposure commentary at a bank and claims commentary at an insurer.
09
Assess a workflow and run a pilotA six-question worksheet, four stages of analytical auditability and a four-week pilot.
10
Where DataQube fitsAn architecture designed to keep analysis connected from source to sentence to approval.
+
Sources and evidence noteThe FCA, the Basel Committee, the Federal Reserve, OCC and FDIC, and the EU AI Act; research cutoff 20 October 2026.

Who it's for

Report owners and approvers in data, analytics, reporting and investment operations at banks, asset managers and insurers; the risk and compliance functions that oversee them; and internal audit, which provides independent assurance.

How to read it

Sections 1–3 follow the AUM report from AI draft to the gaps a reviewer finds. Section 4 is the regulatory context. Sections 5–7 are the framework, the evidence record and reuse in the next cycle. Sections 8–9 extend the review to banking and insurance and turn it into a worksheet and a pilot. The institutions, people and figures in the examples are hypothetical; the framework is DataQube's own, not a regulatory requirement.

Format: PDF · 24 pages
Language: English
Published: 2026

Read the full report

Twenty-four pages: the worked example, where the evidence breaks, the regulatory context, the five layers, the worksheet and the pilot plan. Prefer to discuss it with us?

Get the report Book a demo