Following a significant client loss event, regulators request a complete reconstruction of how your AI portfolio management system generated sell recommendations over the prior 90 days. Your model logging infrastructure captures only final output decisions and timestamps. Which gap in your audit trail architecture presents the most serious regulatory exposure?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Logging the final answer without logging what the model 'saw' to get there is like a courtroom where you have the verdict but no trial transcript. Regulators need to know: what market data did the model receive at 2:47 PM on March 12th, what features did it compute, and what internal signals drove that sell recommendation? Without input feature snapshots at decision time, you cannot reconstruct the reasoning — and that's the replay tape regulators require.
Full explanation below image
Full Explanation
Regulatory frameworks including SR 11-7 (Federal Reserve/OCC model risk management guidance), ESMA's AI in asset management guidelines, and the SEC's examination priorities all emphasize the ability to reconstruct model decisions after the fact. This requirement is not satisfied by logging outputs alone — regulators need a causally complete record that links inputs to outputs through the model's inference logic.
A defensible audit trail for AI investment decisions requires at minimum: (1) a snapshot of all input features at the time of inference, including market data, portfolio state, and any derived signals; (2) the specific model version and parameter state used (model versioning); (3) any pre-processing transformations applied to inputs; (4) the output scores or probabilities, not just the final actionable decision; and ideally (5) post-hoc attribution data showing which features most influenced the output. Items 1 and 2 are the non-negotiable minimum for post-event reconstruction.
The gap identified in Option B — missing input snapshots and intermediate states — is the most serious because it makes reconstruction structurally impossible, not merely difficult. Without knowing what data the model received, you cannot determine whether the model behaved correctly given its training or whether it received erroneous inputs. This distinction is critical for assigning accountability.
Option A (model version logging) is important but secondary — a correctable gap once you have input data. Option C (real-time monitoring) addresses ongoing oversight, not post-event reconstruction. Option D (training data documentation) matters for model validation but does not address the inference-time audit trail.
Best practice in production AI systems is to implement decision logging middleware that captures the full inference context as a structured record, stored in an immutable append-only log (event store pattern), with retention periods matching applicable regulatory requirements — typically five to seven years for investment-related records.