{"id":41894,"date":"2026-10-21T08:57:59","date_gmt":"2026-10-21T08:57:59","guid":{"rendered":"https:\/\/smartdev.com\/?p=41894"},"modified":"2026-10-21T08:57:59","modified_gmt":"2026-10-21T08:57:59","slug":"the-ai-decided-wont-satisfy-an-auditor-in-compliance","status":"publish","type":"post","link":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/","title":{"rendered":"\u201cThe AI Decided\u201d Won\u2019t Satisfy an Auditor in Compliance"},"content":{"rendered":"<div id=\"fws_6ad8efc2de76b\"  data-column-margin=\"default\" data-midnight=\"dark\"  class=\"wpb_row vc_row-fluid vc_row\"  style=\"padding-top: 0px; padding-bottom: 0px; \"><div class=\"row-bg-wrap\" data-bg-animation=\"none\" data-bg-animation-delay=\"\" data-bg-overlay=\"false\"><div class=\"inner-wrap row-bg-layer\" ><div class=\"row-bg viewport-desktop\"  style=\"\"><\/div><\/div><\/div><div class=\"row_col_wrap_12 col span_12 dark left\">\n\t<div  class=\"vc_col-sm-12 wpb_column column_container vc_column_container col no-extra-padding inherit_tablet inherit_phone flex_gap_desktop_10px\"  data-padding-pos=\"all\" data-has-bg-color=\"false\" data-bg-color=\"\" data-bg-opacity=\"1\" data-animation=\"\" data-delay=\"0\" >\n\t\t<div class=\"vc_column-inner\" >\n\t\t\t<div class=\"wpb_wrapper\">\n\t\t\t\t\n<div class=\"wpb_text_column wpb_content_element\" >\n\t<h3><span class=\"ez-toc-section\" id=\"TL_DR\"><\/span><span class=\"TextRun SCXW83289573 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"none\"><span class=\"NormalTextRun SCXW83289573 BCX0\" data-ccp-parastyle=\"heading 3\">TL; DR:<\/span><\/span><span class=\"EOP Selected SCXW83289573 BCX0\" data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full\" src=\"https:\/\/smd-wp-website-media.s3.eu-west-3.amazonaws.com\/uploads\/images\/%E2%80%9CThe+AI+Decided%E2%80%9D+Won%E2%80%99t+Satisfy+an+Auditor+in+Compliance\/1.png\" width=\"1672\" height=\"941\" \/><\/p>\n<ul>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"none\">Auditors test decisions, not models. \u201cThe AI decided\u201d gives them nothing to test.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/li>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"none\">The EU, Singapore, and the US all point the same way: traceable records, named human owners, and specific reasons.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"none\">A defensible decision record holds five parts: input, version, reasoning, routing, and human action.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"none\">Teams must build that record at each workflow step. Rebuilding it after the audit request fails.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<li aria-setsize=\"-1\" data-leveltext=\"\uf0b7\" data-font=\"Symbol\" data-listid=\"1\" data-list-defn-props=\"{&quot;335552541&quot;:1,&quot;335559685&quot;:720,&quot;335559991&quot;:360,&quot;469769226&quot;:&quot;Symbol&quot;,&quot;469769242&quot;:&#091;8226&#093;,&quot;469777803&quot;:&quot;left&quot;,&quot;469777804&quot;:&quot;\uf0b7&quot;,&quot;469777815&quot;:&quot;hybridMultilevel&quot;}\" data-aria-posinset=\"1\" data-aria-level=\"1\"><span data-contrast=\"none\">SmartDev\u2019s <\/span><a href=\"https:\/\/smartdev.com\/fr\/solutions\/nora-ai-adoption-accelerator\/\"><span data-contrast=\"none\">NORA<\/span><\/a><span data-contrast=\"none\"> builds the record into compliance workflows. <\/span><a href=\"https:\/\/smartdev.com\/fr\/contact-us\/\"><span data-contrast=\"none\">Talk to us<\/span><\/a><span data-contrast=\"none\"> about your first workflow.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:0,&quot;335559739&quot;:0}\">\u00a0<\/span><\/li>\n<\/ul>\n<h3 aria-level=\"3\"><span class=\"ez-toc-section\" id=\"Introduction_The_Question_Nobody_Rehearsed\"><\/span><b><span data-contrast=\"none\">Introduction: The Question Nobody Rehearsed<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><span data-contrast=\"auto\">Picture a compliance officer in a review meeting. An auditor picks one cleared customer file and asks a simple question: why did the system approve this case? The officer answers that the AI model scored the customer at low risk. The auditor writes one word in the margin: \u201cunsupported.\u201d<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">That moment explains why many AI pilots stall before production. Models perform well in demos. Audits, however, test something different. They test whether a team can show the evidence, the rules, the version, and the person behind each decision. A score alone shows none of those.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">This article is close to that gap. First, we explain why a model output fails as an answer. Next, we map what regulators in the EU, Singapore, and the US expect. Then we break down the decision record, the oversight design, and how <\/span><a href=\"https:\/\/smartdev.com\/fr\/solutions\/nora-ai-adoption-accelerator\/\"><span data-contrast=\"none\">NORA<\/span><\/a><span data-contrast=\"none\">, SmartDev\u2019s AI Adoption Accelerator delivers both. Our earlier guides on the <\/span><a href=\"https:\/\/smartdev.com\/fr\/ai-compliance-audit-trail\/\"><span data-contrast=\"none\">AI compliance audit trail<\/span><\/a><span data-contrast=\"none\"> and on <\/span><a href=\"https:\/\/smartdev.com\/fr\/compliance-audit-trail-ai-decisions\/\"><span data-contrast=\"none\">audit trails for AI decisions<\/span><\/a><span data-contrast=\"none\"> cover the logging layer. This piece goes one step further, to decision accountability.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><span class=\"ez-toc-section\" id=\"Why_%E2%80%9CThe_AI_Decided%E2%80%9D_Fails_the_Auditors_Test\"><\/span><b><span data-contrast=\"none\">Why \u201cThe AI Decided\u201d Fails the Auditor\u2019s Test<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">What an auditor tests<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Auditors rarely judge your model architecture. Instead, they sample decisions and follow each one back to its evidence. For every sampled case, they look for four links: the input data, the rule or policy applied, the system version, and the person who owned the outcome. A weak link in any of the four turns a control into a finding.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">This sampling logic explains why accuracy statistics do not rescue a team. A model that is right 98 times out of 100 still leaves two cases that nobody can explain. Auditors ask about those cases first, because regulators and customers will ask about them too.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Why a model output is not a reason<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">The score reports the result. A reason explains it. \u201cRisk score 0.12\u201d tells an auditor what the model produced, but it does not say which documents the model read, which policy threshold applied, or why the case skipped human review. Therefore, a score cannot stand alone as the decision record.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Regulators draw the same line. In the US, the CFPB\u2019s 2022 circular on adverse action stated that creditors must give specific and accurate reasons, even when a complex algorithm drives the decision (the United States section below covers the circular\u2019s status). Teams that store only scores will struggle to produce those reasons on demand.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full\" src=\"https:\/\/smd-wp-website-media.s3.eu-west-3.amazonaws.com\/uploads\/images\/%E2%80%9CThe+AI+Decided%E2%80%9D+Won%E2%80%99t+Satisfy+an+Auditor+in+Compliance\/2.png\" width=\"1672\" height=\"941\" \/><\/p>\n<p><span data-contrast=\"auto\">The difference is not how much information each record contains. It is whether the decision can be reconstructed, challenged, and defended after the fact. A compliance decision is only as defensible as the evidence behind it. A score can show what the system concluded, but without traceable inputs, version details, routing logic, and review of ownership, it cannot explain why that conclusion was justified.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">The accountability gap in automated workflows<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Automation spreads work across systems, vendors, and teams. Each handoff dilutes ownership. When an extraction tool feeds a scoring model, which then feeds a case system, no single person can explain the whole chain. Auditors notice that gap quickly.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Outsourcing the model does not outsource accountability. Reporting on the Monetary Authority of Singapore\u2019s new guidelines notes that financial institutions remain accountable for AI used in their services, even when a vendor builds or runs it. <\/span><a href=\"https:\/\/www.blockhead.co\/2026\/10\/08\/mas-finalises-ai-risk-rules-for-financial-institutions-with-agentic-ai-guidance-to-follow-in-2027\/\"><span data-contrast=\"none\">That expectation<\/span><\/a><span data-contrast=\"none\"> pushes the burden of proof back onto the firm.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">How pilots hide the problem<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Pilots run on clean samples, with engineers watching every output. Under those conditions, nobody needs a decision record, so nobody builds one. The gap surfaces only at go-live, when volume rises, and an auditor arrives.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">SmartDev\u2019s <\/span><a href=\"https:\/\/smartdev.com\/fr\/\"><span data-contrast=\"none\">homepage<\/span><\/a><span data-contrast=\"none\"> cites MIT NANDA research showing that 95% of generative AI pilots deliver no measurable P&amp;L impact. It also cites a March 2026 survey of 650 leaders, in which 78% of enterprises ran an AI pilot but only 14% had scaled one. Audit readiness is one reason pilots stay stuck. Our guides on <\/span><a href=\"https:\/\/smartdev.com\/fr\/keep-rebuild-or-kill-it-a-blunt-guide-to-rescuing-your-stalled-ai-pilot\/\"><span data-contrast=\"none\">rescuing a stalled AI pilot<\/span><\/a><span data-contrast=\"none\"> and on <\/span><a href=\"https:\/\/smartdev.com\/fr\/go-live-is-day-one-who-owns-your-ai-after-launch\/\"><span data-contrast=\"none\">who owns AI after launch<\/span><\/a><span data-contrast=\"none\"> explore the operating side.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"none\">Takeaway:<\/span><\/b><span data-contrast=\"none\"> An auditor follows each decision to evidence, a rule, a version, and an owner. A score covers none of them, and pilots rarely test that gap before go-live.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><span class=\"ez-toc-section\" id=\"What_Regulators_Expect_Behind_Every_AI_Decision\"><\/span><b><span data-contrast=\"none\">What Regulators Expect Behind Every AI Decision<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">The EU AI Act: automatic logs and traceability<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Article 12 of the EU AI Act sets the baseline. It says high-risk AI systems must <\/span><a href=\"https:\/\/ai-act-service-desk.ec.europa.eu\/en\/ai-act\/article-12\"><span data-contrast=\"none\">technically allow the automatic recording of events<\/span><\/a><span data-contrast=\"none\"> over the lifetime of the system. The logs must support risk identification, post-market monitoring, and operational monitoring.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Credit scoring sits squarely in scope. Annex III, point 5(b) lists AI systems that evaluate the creditworthiness of natural persons or establish their credit score as high-risk, with an exception for fraud detection, according to <\/span><a href=\"https:\/\/www.mccannfitzgerald.com\/knowledge\/technology-and-innovation\/essential-services-spotlight-eu-ai-act-draft-guidelines-on-high-risk-ai-classification\"><span data-contrast=\"none\">McCann FitzGerald\u2019s analysis<\/span><\/a><span data-contrast=\"none\">. Note one nuance: the minimum log fields in Article 12(3) name biometric identification systems specifically. The wider traceability of duty in Article 12(1) and 12(2) still applies to other high-risk systems.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">The EU AI Act: human oversight that works<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Article 14 requires that people can <\/span><a href=\"https:\/\/www.activemind.legal\/legislation\/ai-act\/article-14\/\"><span data-contrast=\"none\">effectively oversee high-risk systems<\/span><\/a><span data-contrast=\"none\"> while those systems run. It also asks overseers to stay aware of automation bias, which means the tendency to over-rely on the system\u2019s output.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">That wording matters for audits. A policy that says \u201ca human will check the output\u201d does not satisfy it. As one EU AI Act guide puts it, the system itself must make the check possible. Reviewers need evidence, time, and authority, not just a button.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Singapore: MAS guidelines on AI risk management<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">On 7 October 2026, MAS issued its <\/span><a href=\"https:\/\/www.mas.gov.sg\/regulation\/guidelines\/guidelines-on-artificial-intelligence-risk-management-for-financial-institutions\"><span data-contrast=\"none\">Guidelines on Artificial Intelligence Risk Management<\/span><\/a><span data-contrast=\"none\">. They apply to all financial institutions and all forms of AI, and they take effect on 7 October 2027.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">The guidelines expect board and senior management oversight, AI inventories, and materiality assessments for each use case. They also expect controls such as data governance, testing, human oversight, and monitoring. MAS added that it will follow with guidance on agentic AI in 2027, according to <\/span><a href=\"https:\/\/www.blockhead.co\/2026\/10\/08\/mas-finalises-ai-risk-rules-for-financial-institutions-with-agentic-ai-guidance-to-follow-in-2027\/\"><span data-contrast=\"none\">Blockhead\u2019s report<\/span><\/a><span data-contrast=\"none\">. Teams in Singapore should therefore treat decision records as part of the inventory, not as an extra.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">The United States: specific reasons and shifting model guidance<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">The US picture changed twice in recent years. First, the CFPB issued Circular 2022-03, which said the Equal Credit Opportunity Act and Regulation B <\/span><a href=\"https:\/\/www.consumerfinance.gov\/compliance\/circulars\/circular-2022-03-adverse-action-notification-requirements-in-connection-with-credit-decisions-based-on-complex-algorithms\/\"><span data-contrast=\"none\">do not permit creditors to use complex algorithms<\/span><\/a><span data-contrast=\"none\"> when that prevents specific and accurate reasons for an adverse action. The CFPB later withdrew the circular in May 2025, as <\/span><a href=\"https:\/\/library.nclc.org\/companion-material\/consumer-financial-protection-circular-2022-03-adverse-action-notification\"><span data-contrast=\"none\">NCLC\u2019s library records<\/span><\/a><span data-contrast=\"none\">. The Regulation B requirement for specific reasons remains part of the regulation itself, so counsel should confirm how it applies to your products.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Second, on 17 April 2026, the OCC, Federal Reserve, and FDIC issued revised model risk guidance. According to <\/span><a href=\"https:\/\/www.orrick.com\/en\/Insights\/2026\/04\/Agencies-Overhaul-Model-Risk-Management-Guidance-for-Banks-Heres-What-Changed\"><span data-contrast=\"none\">Orrick\u2019s summary<\/span><\/a><span data-contrast=\"none\">, it rescinds SR 11-7 and narrows the definition of a model. One advisory analysis adds that <\/span><a href=\"https:\/\/elevateconsult.com\/insights\/sr-11-7-rescinded-model-risk-guidance-ai-gap\"><span data-contrast=\"none\">generative and agentic AI sit outside the new scope<\/span><\/a><span data-contrast=\"none\">. Guidance moves, but the audit question stays the same: can you explain the decision?<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">NIST AI RMF as the common spine<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Most firms operate across several regimes, so they need one organizing frame. The NIST AI Risk Management Framework offers it. NIST released version 1.0 in January 2023, and its core has four functions: Govern, Map, Measure, and Manage, as <\/span><a href=\"https:\/\/www.jonesday.com\/en\/insights\/2023\/02\/nist-releases-ai-risk-management-framework\"><span data-contrast=\"none\">Jones Day\u2019s overview<\/span><\/a><span data-contrast=\"none\"> describes.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">The framework is voluntary, yet it maps well to audit work. Govern assigns owners. Map documents context. Measure tests performance. Manage acts on findings. A decision record feeds all four, which makes it the cheapest control to build once and reuse everywhere.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full\" src=\"https:\/\/smd-wp-website-media.s3.eu-west-3.amazonaws.com\/uploads\/images\/%E2%80%9CThe+AI+Decided%E2%80%9D+Won%E2%80%99t+Satisfy+an+Auditor+in+Compliance\/3.png\" width=\"1672\" height=\"941\" \/><\/p>\n<p><span data-contrast=\"auto\">Different regulatory frameworks may use different terminology, but they converge one operational requirement: organizations must be able to show how AI decisions are made, who oversees them, and who remains accountable. Compliance therefore cannot stop at choosing a framework or documenting a policy. It requires controls that turn these principles into evidence, from traceable logs and documented review processes to clear ownership of AI-assisted decisions.<\/span><span data-ccp-props=\"{}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"none\">Takeaway: <\/span><\/b><span data-contrast=\"none\">Rules differ by region and keep changing, yet every regime asks for the same thing: traceable decisions with a named human owner and reasons you can state.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><span class=\"ez-toc-section\" id=\"Anatomy_of_a_Defensible_AI_Decision_Record\"><\/span><b><span data-contrast=\"none\">Anatomy of a Defensible AI Decision Record<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">The five parts at a glance<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">A defensible record answers five questions in order. What did the system see? Which version judged it? Why did it achieve that result? Where did the case go next? What did a human do about it? Each question maps one part, and the record is incomplete if any part is missing.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:0,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full\" src=\"https:\/\/smd-wp-website-media.s3.eu-west-3.amazonaws.com\/uploads\/images\/%E2%80%9CThe+AI+Decided%E2%80%9D+Won%E2%80%99t+Satisfy+an+Auditor+in+Compliance\/4.png\" width=\"1672\" height=\"941\" \/><\/p>\n<p>A defensible audit trail cannot depend on employees remembering to document decisions after the fact. Each stage must generate its own evidence as the workflow runs, linking the original inputs to the model configuration, decision logic, escalation path, and human review. The key is to make traceability a property of the workflow, not an administrative task added afterward.<\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Capture the input and the versions<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Start with what the system reads. Store the documents, the extracted fields, and any data pulled from other systems now of decision. Live systems change, so a lookup repeated six months later returns different data and breaks the evidence.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Next, record the version of everything that judges the input. That includes the model, the prompt, the thresholds, and the rule set. Without version data, a team cannot show whether an old decision followed the policy in force on that day.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Record the reasons and the confidence signal<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Reasons turn an output into something an auditor can test. Record the main factors that drove the result, in plain language that a reviewer and a customer-facing team can read. Link each factor to the source document or field.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Add confidence signals as well. Confidence tells the routing logic, and later the reviewer, how much weight the result deserves. Moreover, a recorded confidence value lets a team test later whether low-confidence cases really reached a human.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Log the routing logic<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Every automated workflow decides which cases machines handle alone, and which cases people see. Auditors want to know why a given case took its path. Record the rule that fired, such as a confidence threshold or a risk flag.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">This part often goes missing, because teams treat routing as plumbing. Yet routing is a control. When it silently changes, risk changes with it. Logging the rule, its version, and its trigger makes the control testable.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Capture the human action<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">For cases that reach a person, record who reviewed the case, what the reviewer saw, what they decided, and when. SmartDev\u2019s own <\/span><a href=\"https:\/\/smartdev.com\/fr\/compliance-audit-trail-ai-decisions\/\"><span data-contrast=\"none\">audit trail guide<\/span><\/a><span data-contrast=\"none\"> makes the point that logging what the reviewer saw alongside the decision shows the judgment was informed, not cursory.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Also capture overrides. When a reviewer disagrees with the AI, store the reason. Those notes feed model improvement and give auditors direct proof that oversight is real.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Takeaway:<\/span><\/b><span data-contrast=\"auto\"> A defensible record holds five parts: input, version, reasons with confidence, routing, and human action. The workflow must be written for each part now it happens.<\/span><\/p>\n<h3 aria-level=\"3\"><span class=\"ez-toc-section\" id=\"Human_Oversight_That_Auditors_Believe\"><\/span><b><span data-contrast=\"none\">Human Oversight That Auditors Believe<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Why rubber-stamping becomes a finding<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">A human in the loop only helps if the human can disagree. When reviewers approve nearly everything within seconds, an auditor reads that pattern as automation bias. Oversight exists on paper but not in practice.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Article 14 names this risk directly. The <\/span><a href=\"https:\/\/www.euaiact.com\/blog\/eu-ai-act-human-oversight\"><span data-contrast=\"none\">EU AI Act oversight guide<\/span><\/a><span data-contrast=\"none\"> adds that an organization cannot satisfy the article with a written procedure alone, because the system must make meaningful checking possible. Design for real review from day one.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Show reviewers evidence, not only a score<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Reviewers decide better when they see the source documents besides the AI\u2019s reasons. A screen that shows only \u201capprove\u201d and a score invites a click. A screen that shows the extracted fields, the flagged inconsistencies, and the confidence signal invites judgment.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Evidence screens also create better records. Because the system logs to what the reviewer saw, the audit trail proves the reviewer had what they needed. That proof protects both the reviewer and the firm.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Set thresholds and escalation rules in advance<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Decide before go-live which cases need a person. Typical triggers include low confidence, high-value cases, missing documents, and conflicting data. Write these rules down, version them, and test them against real samples.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Advance rules prevent drifting. Without them, teams loosen thresholds quietly to clear backlogs, and risk climbs unnoticed. With versioned rules, any change becomes a visible, approved event.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Measure the quality of oversight<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Treat oversight as a measurable control. Track override rates, review time per case, and how often reviewers catch seeded errors. A conformity-assessment guide from Presencis suggests that zero overrides may signal automation bias, while frequent overrides in one category may signal a failing system.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">These metrics give auditors something concrete. They also give managers an early warning. A sudden drop-in review time usually means reviewers are skimming, and a team can fix that before an auditor finds it.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Give reviewers training and authority<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Oversight also needs capable people. The EU AI Act oversight guide notes that Article 26(2) puts competence, training, authority, and support duties on the deployer. Reviewers must understand the system\u2019s limits, and they must hold the authority to overrule it.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Name the reviewer role in the decision record. A named, trained owner turns the abstract duty into a person an auditor can interview. That step often settles the accountability question quickly.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Takeaway:<\/span><\/b><span data-contrast=\"auto\"> Auditors believe oversight when reviewers see evidence, follow versioned thresholds, hold real authority, and show measurable override behavior.<\/span><\/p>\n<h3 aria-level=\"3\"><span class=\"ez-toc-section\" id=\"How_NORA_Builds_the_Decision_Record_into_the_Workflow\"><\/span><b><span data-contrast=\"none\">How NORA Builds the Decision Record into the Workflow<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">What NORA is<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><a href=\"https:\/\/smartdev.com\/fr\/solutions\/nora-ai-adoption-accelerator\/\"><span data-contrast=\"none\">NORA<\/span><\/a><span data-contrast=\"none\"> is SmartDev\u2019s AI Adoption Accelerator. SmartDev describes it as a set of standard services and reusable building blocks that help a business build smart automation faster and more cost-effectively. It packages AI into ready-to-deploy services instead of long-term strategy programs.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">SmartDev\u2019s NORA page contrasts that model with AI transformation projects that run 12 to 18 months. Under NORA, SmartDev builds, deploys, and operates the AI for the client, so the client focuses on outcomes instead of AI infrastructure. <\/span><a href=\"https:\/\/smartdev.com\/fr\/solutions\/nora-compliance\/\"><span data-contrast=\"none\">NORA Compliance<\/span><\/a><span data-contrast=\"none\"> applies the same model to regulated workflows.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Structured data before AI reasoning<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Good decision records start with good inputs. SmartDev states that NORA makes enterprise data accessible and structured before any AI reasoning begins. That order matters for audits, because structured inputs give the record something precise to snapshot.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">In SmartDev\u2019s <\/span><a href=\"https:\/\/smartdev.com\/fr\/ai-workflow-automation-for-risk-and-compliance\/\"><span data-contrast=\"none\">risk and compliance white paper<\/span><\/a><span data-contrast=\"none\">, the pipeline starts when customer information, financial statements in PDF or DOCX, or KYC documents enter NORA. From there, the workflow carries that evidence through every later step.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Trigger-based workflows with human oversight built in<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">NORA workflows are trigger-based, and SmartDev says the AI acts proactively with human oversight built in. NORA also performs tasks across a client\u2019s systems through MCP and A2A protocols, according to the NORA page.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">For compliance teams, this design matters in two ways. First, routing rules sit inside the workflow, not in a side spreadsheet. Second, human review is a defined step, not an afterthought. SmartDev\u2019s white paper adds that NORA does not replace the compliance team and instead supports it.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">The audit trail NORA generates<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">SmartDev states that NORA builds an audit trail at every step of the decision workflow. The trail covers AI assessment, confidence scoring, escalation routing, and human review in a single structured log, generated automatically. That maps directly onto parts three, four, and five of the decision records described earlier.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">SmartDev also reports a delivery window of 6 to 8 weeks for a managed audit trail automation, with full ROI typically within 6 to 9 months. Treat those figures as SmartDev\u2019s own claims and validate them against your workflow while scoping. Our <\/span><a href=\"https:\/\/smartdev.com\/fr\/ai-compliance-audit-trail\/\"><span data-contrast=\"none\">audit trail guide<\/span><\/a><span data-contrast=\"none\"> covers the logging detail.<\/span><\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"aligncenter size-full\" src=\"https:\/\/smd-wp-website-media.s3.eu-west-3.amazonaws.com\/uploads\/images\/%E2%80%9CThe+AI+Decided%E2%80%9D+Won%E2%80%99t+Satisfy+an+Auditor+in+Compliance\/5.png\" width=\"1672\" height=\"941\" \/><\/p>\n<p><span class=\"TextRun SCXW181803101 BCX0\" lang=\"EN-US\" xml:lang=\"EN-US\" data-contrast=\"auto\"><span class=\"NormalTextRun SCXW181803101 BCX0\">The critical design choice is that auditability runs through the workflow rather than sitting alongside it. Each stage builds on the evidence captured before it, so reviewers can trace a risk assessment back to its source documents and understand why a case was escalated or handled automatically. This also makes human oversight more meaningful: reviewers receive the evidence behind the recommendation, not just a score to approve or reject.<\/span><\/span><span class=\"EOP Selected SCXW181803101 BCX0\" data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335559738&quot;:240,&quot;335559739&quot;:240}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Proof points and the operating model<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">SmartDev\u2019s published case studies show the pattern in practice. In an insurance KYC engagement in Singapore, an LLM-powered pipeline parses documents, validates against compliance rules, and flags risk. SmartDev reports 60% faster KYC validation, 75% less manual document handling, and 40% fewer review inconsistencies. Read the full story in <\/span><a href=\"https:\/\/smartdev.com\/fr\/case-studies\/cutting-kyc-review-time-without-adding-headcount\/\"><span data-contrast=\"none\">Cutting KYC review time without adding headcount<\/span><\/a><span data-contrast=\"none\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">In a second case, a BFSI startup received a governed AI platform with full decision traceability from day one. SmartDev reports 50% faster risk assessment and 70% less manual compliance documentation. See <\/span><a href=\"https:\/\/smartdev.com\/fr\/case-studies\/replacing-fragmented-manual-workflows-with-a-governed-ai-platform\/\"><span data-contrast=\"none\">the governed AI platform case study<\/span><\/a><span data-contrast=\"none\">. Moreover, SmartDev says it tests NORA on real applications and compares outputs against the client\u2019s manual assessments before full rollout. After go-live, <\/span><a href=\"https:\/\/smartdev.com\/fr\/\"><span data-contrast=\"none\">NORA Operate &amp; Optimize<\/span><\/a><span data-contrast=\"none\"> covers workflow-scoped monitoring and improvement. Browse more evidence in our <\/span><a href=\"https:\/\/smartdev.com\/fr\/case-studies\/\"><span data-contrast=\"none\">case study library<\/span><\/a><span data-contrast=\"none\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"none\">Takeaway:<\/span><\/b><span data-contrast=\"none\"> NORA structures the data first, routes cases by rule, includes human review as a defined step, and writes one audit log as the workflow runs. SmartDev builds and operates it.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><span class=\"ez-toc-section\" id=\"A_Practical_Path_to_Audit-Ready_AI_Decisions\"><\/span><b><span data-contrast=\"none\">A Practical Path to Audit-Ready AI Decisions<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Inventory every AI-assisted decision<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Start by listing where AI touches a decision today. Include extraction tools, scoring models, screening engines, and any copilots that draft reasons. Many teams discover shadow tools during this step.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:0,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">The MAS guidelines expect firms to keep accurate AI inventories, so this work also supports regulatory readiness. Add the owner name to every line. A decision without an owner will fail the first audit question.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Rank each use case by materiality<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Not every workflow needs the same depth. MAS asks firms to assess materiality across impact, complexity, and reliance, according to the <\/span><a href=\"https:\/\/www.allenandgledhill.com\/sg\/publication\/articles\/31741\/mas-consults-on-proposed-guidelines-for-artificial-intelligence-risk-management\"><span data-contrast=\"none\">Allen &amp; Gledhill summary<\/span><\/a><span data-contrast=\"none\"> of the consultation draft. Credit and onboarding decisions usually rank high, while internal drafting aids rank lower.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Use the ranking to spend effort wisely. High-materiality workflows get the full five-part record and measure oversight. Low-materiality ones get lighter logging.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Define the record for each decision type<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Next, specify the five parts for each high-materiality workflow. Name the fields to snapshot, the version data to capture, the reason format, the routing rules, and the reviewer role. Ask your compliance and audit leads to approve the specification.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Early agreement saves rework. Auditors then test your design against a standard they already accept. For wider context on modernizing the workflow itself, read <\/span><a href=\"https:\/\/smartdev.com\/fr\/ai-legacy-workflows-modernize-first\/\"><span data-contrast=\"none\">why teams should modernize before they automate<\/span><\/a><span data-contrast=\"none\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Pilot one workflow against manual results<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Choose one named workflow with a clear owner. Run the AI in parallel with the manual process, then compare outcomes, reasons, and records case by case. Look for gaps in both accuracy and evidence.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">This step mirrors the approach SmartDev describes for NORA. Parallel runs show where thresholds need tuning before customers feel any impact. They also generate the first sample records for your auditors to review.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Operate it after go-live<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Records and oversight decay without ownership. Assign a team to monitor override rates, review times, routing shifts, and model changes every month. Version every change and keep the evidence.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Go-live is the start of the audit story, not the end. Our guide on <\/span><a href=\"https:\/\/smartdev.com\/fr\/go-live-is-day-one-who-owns-your-ai-after-launch\/\"><span data-contrast=\"none\">who owns AI after launch<\/span><\/a><span data-contrast=\"none\"> explains the operating model in more depth. For a discussion of what to automate in fintech compliance, listen to our podcast on <\/span><a href=\"https:\/\/smartdev.com\/fr\/podcast\/ai-and-automation-compliance-in-fintech-company-what-scales-what-shouldnt\/\"><span data-contrast=\"none\">what scales and what shouldn\u2019t<\/span><\/a><span data-contrast=\"none\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><b><span data-contrast=\"auto\">Takeaway: <\/span><\/b><span data-contrast=\"auto\">Inventory first, rank by materiality, specify the record, pilot against manual results, and then operate with monthly checks.<\/span><\/p>\n<h3 aria-level=\"3\"><span class=\"ez-toc-section\" id=\"Frequently_Asked_Questions\"><\/span><b><span data-contrast=\"none\">Frequently Asked Questions<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Why does \u201cthe AI decided\u201d fail an audit?<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">An auditor tests whether a decision links to evidence, a rule, a model version, and a named owner. A bare model of output offers none of those links, so the control cannot pass testing.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">Does the EU AI Act cover AI credit scoring?<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">Yes. Annex III, point 5(b) lists AI systems that evaluate the creditworthiness of natural persons or establish their credit score as high-risk, with an exception for fraud detection. Article 12 then requires those systems to allow automatic event logging. Confirm current application dates with counsel, because reports show they have moved.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">What should an AI decision record contain?<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">A defensible record holds five parts: the input snapshot, the model and rule version, the reasons with a confidence signal, the routing decision, and the human action with a timestamp.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h4 aria-level=\"4\"><b><span data-contrast=\"none\">How does NORA help with audit-ready AI decisions?<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:80,&quot;335559739&quot;:40}\">\u00a0<\/span><\/h4>\n<p><span data-contrast=\"none\">SmartDev states that NORA builds a structured log at each workflow step, covering AI assessment, confidence scoring, escalation routing, and human review. SmartDev builds, deploys, and operates NORA for the client. Learn more on the <\/span><a href=\"https:\/\/smartdev.com\/fr\/solutions\/nora-ai-adoption-accelerator\/\"><span data-contrast=\"none\">NORA page<\/span><\/a><span data-contrast=\"none\"> or in our <\/span><a href=\"https:\/\/smartdev.com\/fr\/ai-adoption-ito-glossary\/\"><span data-contrast=\"none\">AI adoption glossary<\/span><\/a><span data-contrast=\"none\">.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:270,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<h3 aria-level=\"3\"><span class=\"ez-toc-section\" id=\"Conclusion_Build_the_Answer_Before_the_Auditor_Asks\"><\/span><b><span data-contrast=\"none\">Conclusion: Build the Answer Before the Auditor Asks<\/span><\/b><span data-ccp-props=\"{&quot;134245418&quot;:true,&quot;134245529&quot;:true,&quot;335559738&quot;:160,&quot;335559739&quot;:80}\">\u00a0<\/span><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p><span data-contrast=\"none\">\u201cThe AI decided\u201d describes what happened, but it explains nothing. Auditors, and the regulators behind them, want evidence, versions, reasons, routing, and a human who owns the result. Regions use different words, yet the expectation stays constant.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:0,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">Teams that build the five-part record into the workflow answer audits in minutes instead of weeks. Teams that skip it rebuild decisions from emails and logs, which rarely survives scrutiny. Start with one high-materiality workflow, measure real oversight, and expand from there.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:0,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<p><span data-contrast=\"none\">SmartDev can help you take that first step. NORA records each decision as the workflow runs, and our team operates it after go-live. <\/span><a href=\"https:\/\/smartdev.com\/fr\/contact-us\/\"><span data-contrast=\"none\">Contact SmartDev<\/span><\/a><span data-contrast=\"none\"> to discuss your workflow or read more on our <\/span><a href=\"https:\/\/smartdev.com\/fr\/blogs\/\"><span data-contrast=\"none\">blog<\/span><\/a><span data-contrast=\"none\"> and in our <\/span><a href=\"https:\/\/smartdev.com\/fr\/white-paper\/\"><span data-contrast=\"none\">white papers<\/span><\/a><span data-contrast=\"none\">. Teams in banking and payments can also explore our <\/span><a href=\"https:\/\/smartdev.com\/fr\/industries\/payments-fintech\/\"><span data-contrast=\"none\">Payments and Fintech<\/span><\/a><span data-contrast=\"none\"> expertise.<\/span><span data-ccp-props=\"{&quot;134233117&quot;:false,&quot;134233118&quot;:false,&quot;335557856&quot;:16777215,&quot;335559738&quot;:0,&quot;335559739&quot;:270}\">\u00a0<\/span><\/p>\n<\/div>\n\n\n\n\n\t\t\t<\/div> \n\t\t<\/div>\n\t<\/div> \n<\/div><\/div>","protected":false},"excerpt":{"rendered":"TL; DR:\u00a0 Auditors test decisions, not models. \u201cThe AI decided\u201d gives them nothing to test.\u00a0...","protected":false},"author":45,"featured_media":41899,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[236,100,518,49],"tags":[528,278,736,198,693,735,401,737],"class_list":["post-41894","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ai-adoption","category-blogs","category-nora","category-technology","tag-ai-compliance","tag-ai-governance","tag-audit-readiness","tag-bfsi","tag-eu-ai-act","tag-explainable-ai","tag-human-in-the-loop","tag-mas-ai-guidelines"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.7 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>\u201cThe AI Decided\u201d Won\u2019t Satisfy an Auditor in Compliance | SmartDev<\/title>\n<meta name=\"description\" content=\"\u201cThe AI decided\u201d fails every audit. Learn what regulators expect behind AI compliance decisions and how SmartDev\u2019s NORA builds the evidence trail.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/\" \/>\n<meta property=\"og:locale\" content=\"fr_FR\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u201cThe AI Decided\u201d Won\u2019t Satisfy an Auditor in Compliance | SmartDev\" \/>\n<meta property=\"og:description\" content=\"\u201cThe AI decided\u201d fails every audit. Learn what regulators expect behind AI compliance decisions and how SmartDev\u2019s NORA builds the evidence trail.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/\" \/>\n<meta property=\"og:site_name\" content=\"SmartDev\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.youtube.com\/@smartdevllc\" \/>\n<meta property=\"article:published_time\" content=\"2026-10-21T08:57:59+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/smartdev.com\/wp-content\/uploads\/2026\/10\/fi.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1254\" \/>\n\t<meta property=\"og:image:height\" content=\"1254\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Phuong Linh Mai\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@smartdevllc\" \/>\n<meta name=\"twitter:site\" content=\"@smartdevllc\" \/>\n<meta name=\"twitter:label1\" content=\"\u00c9crit par\" \/>\n\t<meta name=\"twitter:data1\" content=\"Phuong Linh Mai\" \/>\n\t<meta name=\"twitter:label2\" content=\"Dur\u00e9e de lecture estim\u00e9e\" \/>\n\t<meta name=\"twitter:data2\" content=\"18 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/\"},\"author\":{\"name\":\"Phuong Linh Mai\",\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/#\\\/schema\\\/person\\\/b9eaeca0be27896c3cb3cae5dea95399\"},\"headline\":\"\u201cThe AI Decided\u201d Won\u2019t Satisfy an Auditor in Compliance\",\"datePublished\":\"2026-10-21T08:57:59+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/\"},\"wordCount\":3826,\"publisher\":{\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/smartdev.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/fi.png\",\"keywords\":[\"AI Compliance\",\"AI Governance\",\"audit readiness\",\"BFSI\",\"EU AI Act\",\"explainable AI\",\"Human-in-the-Loop\",\"MAS AI guidelines\"],\"articleSection\":[\"AI Adoption\",\"Blogs\",\"NORA\",\"Technology\"],\"inLanguage\":\"fr-FR\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/\",\"url\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/\",\"name\":\"\u201cThe AI Decided\u201d Won\u2019t Satisfy an Auditor in Compliance | SmartDev\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/smartdev.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/fi.png\",\"datePublished\":\"2026-10-21T08:57:59+00:00\",\"description\":\"\u201cThe AI decided\u201d fails every audit. Learn what regulators expect behind AI compliance decisions and how SmartDev\u2019s NORA builds the evidence trail.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/#breadcrumb\"},\"inLanguage\":\"fr-FR\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/#primaryimage\",\"url\":\"https:\\\/\\\/smartdev.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/fi.png\",\"contentUrl\":\"https:\\\/\\\/smartdev.com\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/fi.png\",\"width\":1254,\"height\":1254},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/smartdev.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u201cThe AI Decided\u201d Won\u2019t Satisfy an Auditor in Compliance\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/#website\",\"url\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/\",\"name\":\"SmartDev\",\"description\":\"Al Powered Software Development\",\"publisher\":{\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/#organization\"},\"alternateName\":\"SmartDev\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"fr-FR\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/#organization\",\"name\":\"SmartDev\",\"alternateName\":\"SmartDev\",\"url\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/smartdev.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/SMD-Logo-New-Main-scaled.png\",\"contentUrl\":\"https:\\\/\\\/smartdev.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/SMD-Logo-New-Main-scaled.png\",\"width\":2560,\"height\":550,\"caption\":\"SmartDev\"},\"image\":{\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.youtube.com\\\/@smartdevllc\",\"https:\\\/\\\/x.com\\\/smartdevllc\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/4873071\\\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/#\\\/schema\\\/person\\\/b9eaeca0be27896c3cb3cae5dea95399\",\"name\":\"Phuong Linh Mai\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"fr-FR\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/502598910fac2a78348faf70dc3838a062ac01a6bcf41b91f6ad7cc626b26114?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/502598910fac2a78348faf70dc3838a062ac01a6bcf41b91f6ad7cc626b26114?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/502598910fac2a78348faf70dc3838a062ac01a6bcf41b91f6ad7cc626b26114?s=96&d=mm&r=g\",\"caption\":\"Phuong Linh Mai\"},\"description\":\"As a Marketing Intern at SmartDev and an International Economics student at Foreign Trade University, I specialize in bridging data-driven strategy with creative storytelling. My focus centers on building impactful brand and B2B content strategies tailored for the evolving IT and tech landscape. Driven by curiosity in emerging trends like GEO and market dynamics, I aim to deliver innovative solutions that drive tech-driven growth and meaningful brand positioning.\",\"url\":\"https:\\\/\\\/smartdev.com\\\/fr\\\/author\\\/linh-maiphuong\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u201cThe AI Decided\u201d Won\u2019t Satisfy an Auditor in Compliance | SmartDev","description":"\u201cThe AI decided\u201d fails every audit. Learn what regulators expect behind AI compliance decisions and how SmartDev\u2019s NORA builds the evidence trail.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/","og_locale":"fr_FR","og_type":"article","og_title":"\u201cThe AI Decided\u201d Won\u2019t Satisfy an Auditor in Compliance | SmartDev","og_description":"\u201cThe AI decided\u201d fails every audit. Learn what regulators expect behind AI compliance decisions and how SmartDev\u2019s NORA builds the evidence trail.","og_url":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/","og_site_name":"SmartDev","article_publisher":"https:\/\/www.youtube.com\/@smartdevllc","article_published_time":"2026-10-21T08:57:59+00:00","og_image":[{"width":1254,"height":1254,"url":"https:\/\/smartdev.com\/wp-content\/uploads\/2026\/10\/fi.png","type":"image\/png"}],"author":"Phuong Linh Mai","twitter_card":"summary_large_image","twitter_creator":"@smartdevllc","twitter_site":"@smartdevllc","twitter_misc":{"\u00c9crit par":"Phuong Linh Mai","Dur\u00e9e de lecture estim\u00e9e":"18 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/#article","isPartOf":{"@id":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/"},"author":{"name":"Phuong Linh Mai","@id":"https:\/\/smartdev.com\/fr\/#\/schema\/person\/b9eaeca0be27896c3cb3cae5dea95399"},"headline":"\u201cThe AI Decided\u201d Won\u2019t Satisfy an Auditor in Compliance","datePublished":"2026-10-21T08:57:59+00:00","mainEntityOfPage":{"@id":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/"},"wordCount":3826,"publisher":{"@id":"https:\/\/smartdev.com\/fr\/#organization"},"image":{"@id":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/smartdev.com\/wp-content\/uploads\/2026\/10\/fi.png","keywords":["AI Compliance","AI Governance","audit readiness","BFSI","EU AI Act","explainable AI","Human-in-the-Loop","MAS AI guidelines"],"articleSection":["AI Adoption","Blogs","NORA","Technology"],"inLanguage":"fr-FR"},{"@type":"WebPage","@id":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/","url":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/","name":"\u201cThe AI Decided\u201d Won\u2019t Satisfy an Auditor in Compliance | SmartDev","isPartOf":{"@id":"https:\/\/smartdev.com\/fr\/#website"},"primaryImageOfPage":{"@id":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/#primaryimage"},"image":{"@id":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/#primaryimage"},"thumbnailUrl":"https:\/\/smartdev.com\/wp-content\/uploads\/2026\/10\/fi.png","datePublished":"2026-10-21T08:57:59+00:00","description":"\u201cThe AI decided\u201d fails every audit. Learn what regulators expect behind AI compliance decisions and how SmartDev\u2019s NORA builds the evidence trail.","breadcrumb":{"@id":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/#breadcrumb"},"inLanguage":"fr-FR","potentialAction":[{"@type":"ReadAction","target":["https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/"]}]},{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/#primaryimage","url":"https:\/\/smartdev.com\/wp-content\/uploads\/2026\/10\/fi.png","contentUrl":"https:\/\/smartdev.com\/wp-content\/uploads\/2026\/10\/fi.png","width":1254,"height":1254},{"@type":"BreadcrumbList","@id":"https:\/\/smartdev.com\/fr\/the-ai-decided-wont-satisfy-an-auditor-in-compliance\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/smartdev.com\/"},{"@type":"ListItem","position":2,"name":"\u201cThe AI Decided\u201d Won\u2019t Satisfy an Auditor in Compliance"}]},{"@type":"WebSite","@id":"https:\/\/smartdev.com\/fr\/#website","url":"https:\/\/smartdev.com\/fr\/","name":"SmartDev","description":"D\u00e9veloppement de logiciels aliment\u00e9 par l&#039;IA","publisher":{"@id":"https:\/\/smartdev.com\/fr\/#organization"},"alternateName":"SmartDev","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/smartdev.com\/fr\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"fr-FR"},{"@type":"Organization","@id":"https:\/\/smartdev.com\/fr\/#organization","name":"SmartDev","alternateName":"SmartDev","url":"https:\/\/smartdev.com\/fr\/","logo":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/smartdev.com\/fr\/#\/schema\/logo\/image\/","url":"https:\/\/smartdev.com\/wp-content\/uploads\/2025\/04\/SMD-Logo-New-Main-scaled.png","contentUrl":"https:\/\/smartdev.com\/wp-content\/uploads\/2025\/04\/SMD-Logo-New-Main-scaled.png","width":2560,"height":550,"caption":"SmartDev"},"image":{"@id":"https:\/\/smartdev.com\/fr\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.youtube.com\/@smartdevllc","https:\/\/x.com\/smartdevllc","https:\/\/www.linkedin.com\/company\/4873071\/"]},{"@type":"Person","@id":"https:\/\/smartdev.com\/fr\/#\/schema\/person\/b9eaeca0be27896c3cb3cae5dea95399","name":"Phuong Linh Mai","image":{"@type":"ImageObject","inLanguage":"fr-FR","@id":"https:\/\/secure.gravatar.com\/avatar\/502598910fac2a78348faf70dc3838a062ac01a6bcf41b91f6ad7cc626b26114?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/502598910fac2a78348faf70dc3838a062ac01a6bcf41b91f6ad7cc626b26114?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/502598910fac2a78348faf70dc3838a062ac01a6bcf41b91f6ad7cc626b26114?s=96&d=mm&r=g","caption":"Phuong Linh Mai"},"description":"As a Marketing Intern at SmartDev and an International Economics student at Foreign Trade University, I specialize in bridging data-driven strategy with creative storytelling. My focus centers on building impactful brand and B2B content strategies tailored for the evolving IT and tech landscape. Driven by curiosity in emerging trends like GEO and market dynamics, I aim to deliver innovative solutions that drive tech-driven growth and meaningful brand positioning.","url":"https:\/\/smartdev.com\/fr\/author\/linh-maiphuong\/"}]}},"permalink_manager":null,"_links":{"self":[{"href":"https:\/\/smartdev.com\/fr\/wp-json\/wp\/v2\/posts\/41894","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/smartdev.com\/fr\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/smartdev.com\/fr\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/smartdev.com\/fr\/wp-json\/wp\/v2\/users\/45"}],"replies":[{"embeddable":true,"href":"https:\/\/smartdev.com\/fr\/wp-json\/wp\/v2\/comments?post=41894"}],"version-history":[{"count":1,"href":"https:\/\/smartdev.com\/fr\/wp-json\/wp\/v2\/posts\/41894\/revisions"}],"predecessor-version":[{"id":41901,"href":"https:\/\/smartdev.com\/fr\/wp-json\/wp\/v2\/posts\/41894\/revisions\/41901"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/smartdev.com\/fr\/wp-json\/wp\/v2\/media\/41899"}],"wp:attachment":[{"href":"https:\/\/smartdev.com\/fr\/wp-json\/wp\/v2\/media?parent=41894"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/smartdev.com\/fr\/wp-json\/wp\/v2\/categories?post=41894"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/smartdev.com\/fr\/wp-json\/wp\/v2\/tags?post=41894"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}