In regulated AI, the audit trail is now the product

Explain, evidence and own it

Federato's post for Australian insurers, published 11 November, puts the regulator's expectation in plain terms: the company says APRA and ASIC expect insurers to explain, evidence, and own every decision AI touches. Federato says it records AI reasoning and human decisions in one log on the same platform, and uses chain-of-thought reasoning so underwriters can see how AI reaches recommendations. The company also says it provides source citations for every field extracted from broker submissions, and flags low-confidence data for review instead of allowing it to flow into rating. m:…8853

The same post describes the gap Federato says it is closing. Most insurers currently use separate tools for clearance, documents, rating, and policy administration, according to the company, so AI and human logs usually sit apart. Federato says its Control Tower allows boards to see how AI is used across the portfolio, and that it runs each customer in a single-tenant environment. The company also says it supports data sovereignty options for ANZ customers to meet CPS 230 and CPS 234 obligations. Those are the company's claims about its own platform, and they are reported here as such. m:…8853

Speed is costing business in London

Federato's London Market survey, also published 11 November, gives the commercial side of the same problem. The company says 89% of London Market organisations report losing business to a competitor in the past 12 months because of operational speed, and 36% say they frequently lose business for that reason. The company says 42% report that changes to underwriting strategy take weeks or longer to reach day-to-day decisions, and among organisations that take a month or longer, 100% report losing business on operational speed. m:…8852

The survey also says the tools bought to fix speed have not fixed the underlying systems. Federato says 47% report that their underwriting workbench added another interface while underlying systems remained disconnected, and 58% have AI in production, of which 44% cite difficulty integrating new technology with existing core systems. The company says 76% expect significant integration, modernisation, or transformation of their core systems to support future AI and underwriting requirements, and only 24% say incremental upgrades will suffice. Those figures come from Federato's own survey, and they are reported as the company's findings. m:…8852

Lending shows what a cited decision looks like

Ocrolus, writing on 12 November about mortgage underwriting, describes a narrower version of the same idea: a condition an underwriter can check. The company says its Inspect product generates automated conditions for conventional loans, and that conditions are derived from borrower documents, 1003 data, AUS findings, and Fannie/Freddie guidelines. The company says guideline-cited conditions include the borrower-specific issue, the guideline, and the supporting document, and that underwriters retain the ability to update or discard automated conditions. m:…2536

Ocrolus also gives a time result for lenders using the product. The company says lenders using Ocrolus Inspect have reduced median time from complete application to final approval from 19 to 15.5 days. The company says the product integrates with Encompass and MeridianLink, and that conditions are written before the file reaches underwriting. One guideline the company cites in the post is that Fannie Mae requires the most recent pay stub to be dated no earlier than 30 days before the initial loan application date. The time and integration claims are the company's own, and no independent verification is given in the source. m:…2536

What buyers should still ask

Trelium, writing on 12 November, warns buyers not to accept a single promise as proof. The company says customer data in an AI workflow passes through connectors, model services, storage, logs, and support tools, and that a promise not to train models on customer data does not address how long logs are kept or which subprocessors handle the data. Trelium says buyers should ask vendors to map each stop in a workflow and disclose what data is kept, who sees it, and when it is deleted, and should treat training, retention, location, human access, and isolation as separate items in vendor evaluations. m:…5031

The same caution applies to security paperwork. Trelium says a SOC 2 report is an attestation report issued by an independent CPA firm, not a certification, and that a SOC 2 Type 2 report tests whether controls operated effectively across a review period, while a penetration test is a time-boxed attempt to find and exploit weaknesses within an agreed scope. The company says standard security reports do not require testing for instructions hidden in documents or agent misuse of tool permissions, and that AI agents raise security questions about agent runtime and data stores that standard reviews may not cover. Novee, writing on 11 November, adds that penetration tests often take weeks and still miss issues, and that scanners produce noise that requires team validation. Higgsfield, also on 11 November, says it has completed its SOC 2 Type II audit and an independent GDPR assessment, and that customers can request access to the reports through its Trust Center. The audit claim is the company's own announcement. m:…3493 m:…2476 m:…3239