Following a significant client loss event, regulators request a complete reconstruction of how your AI portfolio management system generated sell recommendations over the prior 90 days. Your model logging infrastructure captures only final output decisions and timestamps. Which gap in your audit trail architecture presents the most serious regulatory exposure?
Select an answer to reveal the explanation.
Short Explanation
Logging only the final answer without logging what the model saw is like a courtroom with a verdict but no trial transcript. You need input feature snapshots and intermediate inference states at each decision point so you can replay the reasoning regulators require.
Full Explanation
Regulatory frameworks including SR 26-2 (which superseded SR 11-7 in April 2026; the Federal Reserve, OCC and FDIC model risk management guidance), ESMA's AI in asset management guidelines, and the SEC's examination priorities all emphasize documentation and records that let reviewers understand and reconstruct model decisions after the fact. This requirement is not satisfied by logging outputs alone — regulators need a causally complete record that links inputs to outputs through the model's inference logic.
The defensible audit trail for AI investment decisions requires at minimum: (1) a snapshot of all input features at the time of inference, including market data, portfolio state, and any derived signals; (2) the specific model version and parameter state used (model versioning); (3) any pre-processing transformations applied to inputs; (4) the output scores or probabilities, not just the final actionable decision; and ideally (5) post-hoc attribution data showing which features most influenced the output. Items 1 and 2 are the non-negotiable minimum for post-event reconstruction.
The gap involving missing input feature snapshots and intermediate inference states is the most serious because it makes reconstruction structurally impossible, not merely difficult. Without knowing what data the model received, you cannot determine whether the model behaved correctly given its training or whether it received erroneous inputs. This distinction is critical for assigning accountability.
The gap involving failure to log the model version and software release notes associated with each decision is important but secondary — a correctable gap once you have input data. The gap involving lack of real-time monitoring dashboards for model performance degradation during the period addresses ongoing oversight, not post-event reconstruction. The gap involving insufficient documentation of the model's original training dataset composition and labeling methodology matters for model validation but does not address the inference-time audit trail.
Best practice in production AI systems is to implement decision logging middleware that captures the full inference context as a structured record, stored in an immutable append-only log (event store pattern), with retention periods matching applicable regulatory requirements — typically five to seven years for investment-related records.