Banks told to slow down on agentic AI, as the *evidence question* comes first

The warning

The UK's National Cyber Security Centre (NCSC) has told banks and other financial organisations to think carefully before deploying agentic AI ^[1]. Agentic AI systems don't just answer questions. They plan, decide and act. They can call tools, query databases, send messages and change records. That makes them useful, and it also means their mistakes can spread quickly.

The NCSC's concern is that organisations don't yet fully understand the security and resilience risks that come with letting AI systems act on their own. The warning went to financial institutions, but the point applies anywhere AI agents are being rolled out.

It's the right warning, and it leads to a question that most organisations haven't yet answered: if your AI agent does something, how do you prove what it did, when and who asked it to?

Why it matters now

AI agents are already being tested in customer service, fraud monitoring and internal operations. Some can approve refunds, book appointments or update records without a human clicking confirm. That's faster, but it creates a new kind of evidence problem.

Say a customer claims an agent changed their standing order without permission, or an auditor asks which version of a credit model an agent used six months ago. Your logs will say what happened, but logs are kept by the same people who could change them. That's fine until someone questions them.

Think of it like a car's dash cam. The recording is useful if it can be shown unchanged, but less so if the driver could have quietly edited out the interesting bits.

Under DORA, financial institutions' logs must already be protected against tampering, deletion and unauthorised access ^[2]. For high-risk AI systems under the AI Act, automatic logging of events over the system's lifetime will be required from 2 December 2027 ^[3]. What neither regulation specifies is how you show a supervisor, an auditor or a court that a log hasn't been changed, when you're the one keeping it.

What this means for you

If you're testing or planning to deploy AI agents, here are three questions worth asking now:

1. What does the agent record, and where? Each instruction it receives, each tool it calls and each result it gets should be logged, with timestamps. If it isn't logged, you can't prove it happened.

2. Who can change the logs? Access controls and monitoring are the foundation, but they don't answer the harder question: how do you show that nobody with the right access actually did change something?

3. Can you show what happened six months later? Disputes, audits and regulatory questions tend to come long after the event. The evidence that holds up is the evidence that can be shown unchanged.

The NCSC's advice is to move carefully. Part of moving carefully is deciding, before an agent goes live, how you'll prove what it did when the day comes that someone asks.

How a digital witness fits here

This is a strong fit for a digital witness. The thing to seal is each step the agent takes: the instruction it received, the tool it called, the result it got and the decision it made. Sealing takes a fingerprint of the record, not the content, so the log itself never leaves your systems.

Say a customer disputes that they asked an agent to cancel a service. You can show them the sealed record: the instruction, the timestamp and the agent's response. They calculate the fingerprint themselves and see that it matches the one sealed at the time. If anyone had changed a single character in the log since then, the fingerprints wouldn't match.

Anyone you share the record with can check it, without having to trust that you haven't quietly rewritten it. That includes auditors, supervisors, customers and, if it comes to it, a court.

What a digital witness doesn't do is authorise the agent's action or make it correct. It shows that the record of what happened is the one written at the time. Whether the agent should have done it is a separate question.

Your system sends a fingerprint of each record to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. The first 2,000 witnesses a month are free. Read the docs to see how it works.

How it would work

1. The agent receives an instruction, calls a tool and records the result.
2. Your system sends a fingerprint of that record to WitniumChain and gets a witness ID back.
3. When the record is questioned, anyone you share it with calculates the fingerprint again and checks it against the sealed one.

What to watch

The NCSC's warning is informal guidance, not a rule, but it points to something regulators are paying attention to. The AI Act's logging requirement for high-risk systems applies from 2 December 2027 for systems in Annex III and from 2 August 2028 for those in Annex I ^[3]. DORA's technical standards on ICT risk, including the requirement to protect logs, have applied since 17 January 2025 ^[2].

For organisations deploying AI agents, the question isn't whether to log what they do. It's whether you can show, when it matters, that the log is the one written at the time.