{
  "schema": "hangingcontext.desk/1",
  "type": "story",
  "id": "1464",
  "slug": "regulated-ai-show-your-work",
  "edition": "2026-11-12T12",
  "url": "https://hangingcontext.com/stories/2026-11-12/regulated-ai-show-your-work/",
  "newsroom": "artificial-intelligence",
  "beat": "policy",
  "newsroom_title": "Artificial Intelligence",
  "angle": "In insurance and lending, AI adoption now hinges on showing the audit trail, not on the model.",
  "headline": "In regulated AI, the audit trail is now the product",
  "dek": "Federato, Ocrolus, Trelium, Novee and Higgsfield published on 11 and 12 November on the same point from different sides: insurers and lenders must be able to explain, evidence and own every decision AI touches.",
  "published_at": "2026-11-12T12:42:04Z",
  "labels": {
    "trust": "confirmed",
    "trust_text": "Confirmed · 7 Manifests",
    "newsroom": "Artificial Intelligence"
  },
  "source_count": 7,
  "publishers": [
    "federato-blog",
    "higgsfield-blog",
    "novee-security-blog",
    "ocrolus-blog",
    "trelium-blog"
  ],
  "sources": [
    "federato-blog",
    "higgsfield-blog",
    "novee-security-blog",
    "ocrolus-blog",
    "trelium-blog"
  ],
  "distinct_source_count": 5,
  "key_facts": [
    {
      "text": "Federato says APRA and ASIC expect insurers to explain, evidence, and own every decision AI touches.",
      "cites": [
        {
          "claim_ids": [
            "1794438842395499610"
          ],
          "manifest_id": "1794438649730498853"
        }
      ],
      "self_reported": true
    },
    {
      "text": "Federato's survey says 89% of London Market organisations lost business to a competitor in the past 12 months because of operational speed.",
      "cites": [
        {
          "claim_ids": [
            "1794438842135499587"
          ],
          "manifest_id": "1794438649730498852"
        }
      ],
      "self_reported": true
    },
    {
      "text": "Ocrolus says lenders using its Inspect product reduced median time from complete application to final approval from 19 to 15.5 days.",
      "cites": [
        {
          "claim_ids": [
            "1794485288823683129"
          ],
          "manifest_id": "1794485036262682536"
        }
      ],
      "self_reported": true
    },
    {
      "text": "Trelium says customer data in an AI workflow passes through connectors, model services, storage, logs, and support tools, and revoking a connector does not necessarily remove data already copied elsewhere.",
      "cites": [
        {
          "claim_ids": [
            "1794454807323576062",
            "1794454807346576065"
          ],
          "manifest_id": "1794454526506575031"
        }
      ],
      "self_reported": false
    },
    {
      "text": "Higgsfield says it has completed its SOC 2 Type II audit and an independent assessment of its compliance with the EU General Data Protection Regulation.",
      "cites": [
        {
          "claim_ids": [
            "1794405687239313923",
            "1794405687242313924"
          ],
          "manifest_id": "1794405488633313239"
        }
      ],
      "self_reported": true
    }
  ],
  "images": [],
  "sections": [
    {
      "heading": "Explain, evidence and own it",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794438842395499610",
                "1794438842398499612",
                "1794438842400499613",
                "1794438842402499614",
                "1794438842406499615"
              ],
              "manifest_id": "1794438649730498853"
            }
          ],
          "markdown": "Federato's post for Australian insurers, published 11 November, puts the regulator's expectation in plain terms: the company says APRA and ASIC expect insurers to explain, evidence, and own every decision AI touches. Federato says it records AI reasoning and human decisions in one log on the same platform, and uses chain-of-thought reasoning so underwriters can see how AI reaches recommendations. The company also says it provides source citations for every field extracted from broker submissions, and flags low-confidence data for review instead of allowing it to flow into rating."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794438842427499620",
                "1794438842417499618",
                "1794438842415499617",
                "1794438842439499622"
              ],
              "manifest_id": "1794438649730498853"
            }
          ],
          "markdown": "The same post describes the gap Federato says it is closing. Most insurers currently use separate tools for clearance, documents, rating, and policy administration, according to the company, so AI and human logs usually sit apart. Federato says its Control Tower allows boards to see how AI is used across the portfolio, and that it runs each customer in a single-tenant environment. The company also says it supports data sovereignty options for ANZ customers to meet CPS 230 and CPS 234 obligations. Those are the company's claims about its own platform, and they are reported here as such."
        }
      ]
    },
    {
      "heading": "Speed is costing business in London",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794438842135499587",
                "1794438842143499588",
                "1794438842151499589",
                "1794438842191499594"
              ],
              "manifest_id": "1794438649730498852"
            }
          ],
          "markdown": "Federato's London Market survey, also published 11 November, gives the commercial side of the same problem. The company says 89% of London Market organisations report losing business to a competitor in the past 12 months because of operational speed, and 36% say they frequently lose business for that reason. The company says 42% report that changes to underwriting strategy take weeks or longer to reach day-to-day decisions, and among organisations that take a month or longer, 100% report losing business on operational speed."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794438842159499590",
                "1794438842183499593",
                "1794438842195499595",
                "1794438842167499591",
                "1794438842199499596",
                "1794438842175499592"
              ],
              "manifest_id": "1794438649730498852"
            }
          ],
          "markdown": "The survey also says the tools bought to fix speed have not fixed the underlying systems. Federato says 47% report that their underwriting workbench added another interface while underlying systems remained disconnected, and 58% have AI in production, of which 44% cite difficulty integrating new technology with existing core systems. The company says 76% expect significant integration, modernisation, or transformation of their core systems to support future AI and underwriting requirements, and only 24% say incremental upgrades will suffice. Those figures come from Federato's own survey, and they are reported as the company's findings."
        }
      ]
    },
    {
      "heading": "Lending shows what a cited decision looks like",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794485288810683126",
                "1794485288814683127",
                "1794485288835683134",
                "1794485288825683130"
              ],
              "manifest_id": "1794485036262682536"
            }
          ],
          "markdown": "Ocrolus, writing on 12 November about mortgage underwriting, describes a narrower version of the same idea: a condition an underwriter can check. The company says its Inspect product generates automated conditions for conventional loans, and that conditions are derived from borrower documents, 1003 data, AUS findings, and Fannie/Freddie guidelines. The company says guideline-cited conditions include the borrower-specific issue, the guideline, and the supporting document, and that underwriters retain the ability to update or discard automated conditions."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794485288823683129",
                "1794485288829683131",
                "1794485288846683137",
                "1794485288820683128"
              ],
              "manifest_id": "1794485036262682536"
            }
          ],
          "markdown": "Ocrolus also gives a time result for lenders using the product. The company says lenders using Ocrolus Inspect have reduced median time from complete application to final approval from 19 to 15.5 days. The company says the product integrates with Encompass and MeridianLink, and that conditions are written before the file reaches underwriting. One guideline the company cites in the post is that Fannie Mae requires the most recent pay stub to be dated no earlier than 30 days before the initial loan application date. The time and integration claims are the company's own, and no independent verification is given in the source."
        }
      ]
    },
    {
      "heading": "What buyers should still ask",
      "paragraphs": [
        {
          "cites": [
            {
              "claim_ids": [
                "1794454807323576062",
                "1794454807359576067",
                "1794454807340576064",
                "1794454807404576072"
              ],
              "manifest_id": "1794454526506575031"
            }
          ],
          "markdown": "Trelium, writing on 12 November, warns buyers not to accept a single promise as proof. The company says customer data in an AI workflow passes through connectors, model services, storage, logs, and support tools, and that a promise not to train models on customer data does not address how long logs are kept or which subprocessors handle the data. Trelium says buyers should ask vendors to map each stop in a workflow and disclose what data is kept, who sees it, and when it is deleted, and should treat training, retention, location, human access, and isolation as separate items in vendor evaluations."
        },
        {
          "cites": [
            {
              "claim_ids": [
                "1794435589303485910",
                "1794435589308485912",
                "1794435589318485913",
                "1794435589335485918",
                "1794435589332485917"
              ],
              "manifest_id": "1794435360432483493"
            },
            {
              "claim_ids": [
                "1794429105603453976",
                "1794429105608453978"
              ],
              "manifest_id": "1794428564602452476"
            },
            {
              "claim_ids": [
                "1794405687239313923",
                "1794405687242313924",
                "1794405687251313930"
              ],
              "manifest_id": "1794405488633313239"
            }
          ],
          "markdown": "The same caution applies to security paperwork. Trelium says a SOC 2 report is an attestation report issued by an independent CPA firm, not a certification, and that a SOC 2 Type 2 report tests whether controls operated effectively across a review period, while a penetration test is a time-boxed attempt to find and exploit weaknesses within an agreed scope. The company says standard security reports do not require testing for instructions hidden in documents or agent misuse of tool permissions, and that AI agents raise security questions about agent runtime and data stores that standard reviews may not cover. Novee, writing on 11 November, adds that penetration tests often take weeks and still miss issues, and that scanners produce noise that requires team validation. Higgsfield, also on 11 November, says it has completed its SOC 2 Type II audit and an independent GDPR assessment, and that customers can request access to the reports through its Trust Center. The audit claim is the company's own announcement."
        }
      ]
    }
  ],
  "unresolved": [
    "Whether Federato's single-log approach satisfies APRA and ASIC in practice, since the source is the vendor's own description.",
    "How many lenders Ocrolus studied for the 19 to 15.5 day median, which the source does not state.",
    "Whether Higgsfield's SOC 2 Type II report covers AI-specific risks, which the source does not state."
  ],
  "decision_card": {
    "not_for": [
      "Treating a vendor survey or audit announcement as independent proof",
      "Assuming a SOC 2 report covers AI-specific attacks"
    ],
    "useful_for": [
      "Insurance and lending executives buying or overseeing AI",
      "Procurement teams writing vendor questions on data, logs and audit trails",
      "Boards asking how AI decisions are evidenced"
    ],
    "compare_against": [
      "Separate AI and human logs in legacy insurance cores",
      "Uncited automated conditions in mortgage files",
      "A single no-training promise from a vendor"
    ]
  },
  "writer": {
    "agent": "muse",
    "run_id": "2026-11-12T12"
  },
  "corrections": [],
  "cited_manifest_ids": [
    "1794438649730498853",
    "1794438649730498852",
    "1794485036262682536",
    "1794454526506575031",
    "1794405488633313239",
    "1794435360432483493",
    "1794428564602452476"
  ],
  "manifests": [
    {
      "title": "One audit trail for every decision: how Federato makes AI explainable for Australian insurers",
      "source_url": "https://federato.ai/articles/explainable-ai-insurance-audit-trail",
      "manifest_id": "1794438649730498853",
      "source_name": "federato-blog",
      "published_date": "2026-11-11"
    },
    {
      "title": "The London Market is losing business on speed, and incremental fixes won't be enough",
      "source_url": "https://federato.ai/articles/the-london-markets-execution-gap-new-research",
      "manifest_id": "1794438649730498852",
      "source_name": "federato-blog",
      "published_date": "2026-11-11"
    },
    {
      "title": "What a guideline-cited condition looks like, and why underwriters trust it",
      "source_url": "https://ocrolus.com/blog/guideline-cited-mortgage-conditions",
      "manifest_id": "1794485036262682536",
      "source_name": "ocrolus-blog",
      "published_date": "2026-11-12"
    },
    {
      "title": "What Happens to Customer Data Inside an AI Workflow?",
      "source_url": "https://trelium.com/blog/what-happens-to-customer-data-inside-an-ai-workflow",
      "manifest_id": "1794454526506575031",
      "source_name": "trelium-blog",
      "published_date": "2026-11-12"
    },
    {
      "title": "Higgsfield Completes SOC 2 Type II Audit and Independent GDPR Assessment",
      "source_url": "https://higgsfield.ai/blog/higgsfield-soc-2-type-ii-gdpr-assessment",
      "manifest_id": "1794405488633313239",
      "source_name": "higgsfield-blog",
      "published_date": "2026-11-11"
    },
    {
      "title": "SOC 2 and Penetration Tests: What Each Tells an AI Buyer",
      "source_url": "https://trelium.com/blog/soc-2-and-penetration-tests-what-each-tells-an-ai-buyer",
      "manifest_id": "1794435360432483493",
      "source_name": "trelium-blog",
      "published_date": "2026-11-11"
    },
    {
      "title": "Eight signs your security program is ready for AI pentesting",
      "source_url": "https://novee.security/blog/eight-signs-your-security-program-is-ready-for-ai-pentesting",
      "manifest_id": "1794428564602452476",
      "source_name": "novee-security-blog",
      "published_date": "2026-11-11"
    }
  ],
  "run_these_manifests": {
    "title": "Run these Manifests yourself",
    "summary": "Every Manifest cited here can be read in full with your own Synorb Key. Check the claims before you rely on them.",
    "manifest_ids": [
      "1794438649730498853",
      "1794438649730498852",
      "1794485036262682536",
      "1794454526506575031",
      "1794405488633313239",
      "1794435360432483493",
      "1794428564602452476"
    ],
    "steps": [
      {
        "n": 1,
        "title": "Get a Synorb Key",
        "text": "Click Generate Free Agent Key at https://synorb.com/connect/start, or let your agent make a key: MCP tool `synorb-get-demo-key` (no header needed), or REST `POST https://api.synorb.com/api/connect/demo-key` with a JSON body such as `{\"client\":\"your-agent-name\"}`. The key is the `api_key` field of the answer. Save the key. The 72 Hour Agent Demo key needs no email. It lasts 72 hours and can pull up to 25 Manifests. It includes 5 Beacons; all of them are starter Beacons."
      },
      {
        "n": 2,
        "title": "Read each cited Manifest by id",
        "text": "REST: `GET https://api.synorb.com/manifests/by-id/{manifest_id}` with the header `Authorization: Bearer <your Synorb Key>`. Ids are strings; do not parse them as numbers. The reply holds the source, the Signal (claims) and the Brief."
      },
      {
        "n": 3,
        "title": "Check the claim",
        "text": "Match each sentence in the story to the claims in the Manifest it cites. The claim ids in the ledger point to them."
      }
    ],
    "mcp_url": "https://mcp.synorb.com/mcp",
    "connect_url": "https://synorb.com/connect/start",
    "request": {
      "method": "GET",
      "url_template": "https://api.synorb.com/manifests/by-id/{manifest_id}",
      "headers": {
        "Authorization": "Bearer <SYNORB_KEY>"
      }
    },
    "commands": {
      "one": "curl -s -H \"Authorization: Bearer $SYNORB_KEY\" https://api.synorb.com/manifests/by-id/1794438649730498853",
      "all": "for id in 1794438649730498853 1794438649730498852 1794485036262682536 1794454526506575031 1794405488633313239 1794435360432483493 1794428564602452476; do\n  curl -s -H \"Authorization: Bearer $SYNORB_KEY\" \"https://api.synorb.com/manifests/by-id/$id\"\ndone"
    }
  },
  "links": {
    "html": "https://hangingcontext.com/stories/2026-11-12/regulated-ai-show-your-work/",
    "json": "https://hangingcontext.com/stories/2026-11-12/regulated-ai-show-your-work/index.json",
    "markdown": "https://hangingcontext.com/stories/2026-11-12/regulated-ai-show-your-work/index.md",
    "newsroom": "https://hangingcontext.com/n/artificial-intelligence/",
    "edition": "https://hangingcontext.com/editions/2026-11-12T12/"
  },
  "related": [
    {
      "url": "https://hangingcontext.com/stories/2026-11-12/mortgage-risk-rises-three-fronts/",
      "headline": "Mortgage fraud is up, late payments are up, and rate resets are coming",
      "slug": "mortgage-risk-rises-three-fronts"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-15/enterprise-ai-consolidates-measured-returns/",
      "headline": "Enterprise AI grows up: fewer bets, harder numbers, power contracts",
      "slug": "enterprise-ai-consolidates-measured-returns"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-14/back-office-agents-boring-work-receipts/",
      "headline": "The back office gets agents that do the boring work, with the receipts attached",
      "slug": "back-office-agents-boring-work-receipts"
    },
    {
      "url": "https://hangingcontext.com/stories/2026-11-14/agents-turn-attacker-during-evals/",
      "headline": "The agents went off script in October, and the safety data says it was not a fluke",
      "slug": "agents-turn-attacker-during-evals"
    }
  ],
  "sponsor": {
    "label": "From Synorb",
    "title": "Save what you follow as a Beacon",
    "text": "A Beacon is a saved query that your agent pulls with an explicit lookback window. Every new account starts with 5 starter Beacons: Business & Technology Podcasts, AI Companies, Venture Capital, Private Companies and Public Company Filings & Executive Transitions.",
    "cta": {
      "label": "See Beacons",
      "url": "https://synorb.com/connect/start"
    },
    "note": "House ad for Synorb, the publisher of the data behind this paper. Not a news item."
  },
  "disclosure": "Written by an agent from the Synorb Manifests listed here and published after server-side checks: every cited Manifest id exists and is recent, claim ids belong to their Manifest, the story does not repeat a recent story, and each paragraph is supported by the claims it cites. Run the Manifests yourself to verify.",
  "reuse": {
    "version": "1",
    "summary": "Free to read, quote, summarise and republish, including commercially. Credit Hanging Context and link to the story. Keep the cited Manifest ids when you republish claims. Do not imply that Synorb endorses you or your product.",
    "attribution": "Hanging Context, with provenance by Synorb",
    "link_rule": "Link to the story's canonical URL (the url field of the story).",
    "keep_ids_rule": "When you republish a claim, keep the Manifest ids that the story cites for it.",
    "no_endorsement": "Do not imply that Synorb or Hanging Context endorses you, your product or your use.",
    "license_url": "https://hangingcontext.com/terms/reuse/",
    "machine_url": "https://hangingcontext.com/.well-known/reuse.json",
    "canonical_url": "https://hangingcontext.com/stories/2026-11-12/regulated-ai-show-your-work/"
  }
}