Auditing AI models: what to track before the regulator asks

The question that sinks a company in an AI audit is not technical: "why did the model decide this, for this customer, on this date?" If the answer depends on reconstructing the past, it arrives too late. Data that is missing on the day of the question does not come back. Traceability gets switched on the first day in production, or it is lost.

This article is management and engineering guidance, not legal advice. Obligations specific to your industry should be confirmed with your legal counsel and data protection officer.

Being right is not enough; you have to show it

In 2019, Apple Card customers, whose card was issued by Goldman Sachs, complained publicly that women were getting much lower limits than their husbands. The New York Department of Financial Services investigated and in March 2021 found no violation of fair lending laws: gender was not a factor in the decisions. Even so, the report pointed to a lack of transparency. The regulator could access the underwriting data; the affected customers could not. Even customer service staff could not explain the decisions.

The lesson applies to any company that uses a model to decide about people. The bank had a defensible model and still spent months under investigation and brand damage, because the explanation was not ready for the people who asked.

What Brazilian law already allows regulators to demand

There is no need to wait for an AI law. Brazil's AI bill, PL 2338/2023, is still awaiting a committee opinion in the Chamber of Deputies as of September 2026. The LGPD, in force since 2020, already includes three provisions that change what you need to keep:

• Article 20 gives data subjects the right to request a review of decisions made solely through automated processing that affect their interests, including credit and consumer profiling. Paragraph 1 requires the controller to provide, on request, clear information about the criteria and procedures used. Paragraph 2 lets the ANPD audit for discriminatory aspects when a company refuses to explain on trade secret grounds.
• Article 37 requires controllers and processors to keep records of their personal data processing operations.
• Article 38 allows the ANPD to require a data protection impact assessment.

The ANPD is also better equipped to enforce. Since Law 15.352/2026, it has been a regulatory agency with financial autonomy and 200 new specialist positions. And regulating Article 20 is on its agenda: Technical Note 12/2025 consolidated the contributions to its consultation on AI and automated decisions.

What regulators elsewhere already ask for

Two international references help calibrate the expected level of detail.

The EU AI Act, in Article 12, requires high-risk systems to log events automatically over their entire lifetime. Deployers must keep those logs for at least six months (Article 26). With the Digital Omnibus, obligations for Annex III systems, which include credit and hiring, now apply from December 2, 2027. If your company serves customers in the European Union, that is a project deadline, not reading material.

In US banking, SR 11-7, from 2011, was for more than a decade the reference for model risk management: documentation, independent validation, monitoring. In April 2026 regulators replaced it with revised, risk-based guidance. The important detail: the new text states that generative and agentic AI models are out of scope because they are new and changing fast. In other words, not even the regulators with the most model-risk experience have a ready-made standard for LLMs today. If you use these models, you need to build your own trail.

The minimum record per decision

For every relevant decision made or supported by a model, record:

1. A decision ID and timestamp.
2. The exact version of what decided: model, weights or vendor identifier, system prompt, business rules applied after the model. With LLMs, the prompt version matters as much as the model version.
3. The inputs used and where they came from, with the source version. With RAG, which documents were retrieved. With agents, which tools were called and with which parameters.
4. The model output and the final decision, kept separate. If a rule or a person changed the outcome, that has to show.
5. The factors that weighed most, in the form that fits the model: feature contributions in a credit model, cited passages in an LLM answer.
6. Human review: who reviewed, when, what they decided and on what basis.
7. What was communicated to the data subject. In 2024, Air Canada was held liable to a passenger who followed wrong information from its chatbot. Without a record of what the agent said, you do not even know whether you have a problem.

What to record beyond the decision

The per-decision log answers "what happened." The audit will also ask "why did you think it was safe." For that:

• A model card: purpose, training data or context sources, known limitations, the population it was tested on.
• Validation evidence before going to production: metrics, bias tests by group when decisions affect people, adversarial test cases for LLMs.
• Ongoing monitoring: data drift, human review rate, appeal rate, complaints.
• Change control: every change of model, prompt or data source, with date, owner and test result.
• An incident log and what was done about each incident.

This also applies to models you buy. In May 2025 a US federal court allowed a collective action against Workday over alleged age discrimination in automated applicant screening, after having already accepted that the tool vendor could be directly liable. If the model belongs to a third party, the contract must guarantee access to the evidence you will need.

An example: a credit decision review request

A fintech declines a loan in its app. Three months later the customer requests a review under Article 20. With the trail in place, the answer takes hours:

1. Look up the decision: date, version 3.2 of the scoring model, the credit policy in force that day.
2. Inputs: declared income, payment history from the credit bureau as queried on that date, account age.
3. Factors: two recent late payments at the bureau and a debt-to-income ratio above the policy limit.
4. Final rule: the policy automatically declines above a certain ratio; there was no human review because the case did not fall into the exception band.
5. Review: an analyst reassesses with updated data and records the outcome.

Without the trail, the same question becomes a task force. The data team tries to work out which model was live, the bureau no longer has the old query, and the reply to the customer is generic. If the customer complains to the ANPD or a consumer protection agency, the company walks into the conversation with no evidence.

The cost of keeping everything

Tracking has a price, and part of it is privacy. Decision logs contain personal data, so the same LGPD rules apply: purpose, restricted access, defined retention and disposal. Keeping the full prompt of every agent conversation indefinitely creates a new risk. Decide what must be stored in full, what can be masked and for how long, and document that decision.

There is also a storage and engineering cost. It is small next to the cost of answering a regulator without data.

A test for this week

Pick five decisions one of your models made or supported three months ago. For each, try to answer: which version decided, with what data, why, and who reviewed it. If you cannot do it within a day, the problem already exists; nobody has asked yet.

ISO/IEC 42001 formalizes these requirements into a management system, and we wrote about it in ISO 42001 as a maturity yardstick. To decide which models deserve this level of traceability, start with the risk tiers described in how to set up an AI governance committee. And if you want help designing the trail and following its rollout, Governance As a Service does that work alongside your team.