Compliance teams use AI, but few can explain what it tells them

The gap between use and accountability

Enhesa's recent article on AI in compliance surfaces a pattern that compliance leaders will recognise: nearly every team now uses AI, but far fewer can explain or defend what their AI tools tell them ^[1]. The tools are in use. The accountability is lagging.

The problem is a bit like having a very clever intern who gives you answers but never shows their working. The answer might be right, but when someone asks how you got there, you're stuck.

Compliance teams face practical challenges in AI explainability and accountability ^[1]. When a compliance officer uses an AI tool to screen a transaction or assess a risk, and a regulator or an auditor later asks why the system flagged it, the officer needs more than "the AI said so". They need to be able to show what the AI saw, which version of the model ran, and what the logic was.

What the AI Act asks for

The AI Act addresses part of this. Article 12 requires high-risk AI systems to technically allow for the automatic recording of events over their lifetime ^[2]. That means logging what the system did: inputs, outputs, decisions and any human override. For high-risk systems under Annex III, it applies from 2 December 2027 ^[2].

Article 26 places duties on users of high-risk AI, including monitoring the system's operation and keeping the logs they control for at least six months ^[3]. If another law requires longer, that applies instead ^[3].

The law asks for the logs. It doesn't say how you protect them once you have them.

The accountability puzzle

Logs are useful when they're trusted. A compliance team's log of what its AI did is only as credible as the controls around it. If the team that keeps the log could also quietly edit it, an auditor or a regulator will want to know what stops them.

That's where many compliance functions hit a wall. The tools generate logs. The logs sit in systems the compliance team controls. When someone questions a decision months later, the question isn't just what the log says. It's whether anyone could have changed it.

Compliance officers are used to being accountable for decisions. AI shifts part of that accountability onto a system, but the officer is still the one who has to explain it. If the explanation rests on a log, the log needs to hold up.

How a digital witness fits

Here, the thing to seal is each compliance decision as it's recorded: the transaction reference, the model version that assessed it, the risk score, any flags and the officer's review. Sealing takes a fingerprint of the record, not the record itself, so the decision and any personal data never leave the compliance team's systems.

The fingerprint is sealed on WitniumChain, where any later change would show, even one made by us. When a decision is questioned months later, anyone the compliance team shares the record with can check that it's exactly what was written on the day. Calculate the fingerprint again, compare it with the sealed one, and if they match, nothing has changed. Change a single character and it won't match.

A digital witness doesn't show that the decision was right, fair or lawful. It doesn't prove the log is complete. What it does is let the compliance team show that a record hasn't been quietly rewritten since it was sealed. That makes the log easier to defend.

How it would work

1. Each compliance decision record is sealed as it's written, through the REST API, the SDK or the MCP server.
2. The fingerprint goes to WitniumChain; the record stays with the compliance team.
3. When an auditor or regulator asks about a decision, calculate the fingerprint again and check it against the sealed one.

Your system sends a fingerprint of the record, not the record itself, to WitniumChain through the REST API, the SDK or the MCP server, and gets a witness ID back. To check, anyone you share the record with calculates the fingerprint again and compares it with the sealed one. The first 2,000 witnesses a month are free. Read the docs.

What this means for you

If your compliance team uses AI to screen, assess or flag, here are three questions worth asking now:

1. Could you show an auditor which version of the model ran on a given day, and what it did?
2. If a decision made six months ago is challenged, what record do you have, and who could have changed it?
3. When Article 12 applies from 2 December 2027, will your logging be ready, and will the logs hold up when questioned?

Compliance functions are used to being asked hard questions. The new question is whether the AI tools they rely on will help them answer, or leave them stuck.

Sources

1. Enhesa, "AI in compliance: who's getting it right? Key takeaways", 2024, https://www.enhesa.com/resources/ai-in-compliance-whos-getting-it-right-key-takeaways
2. European Commission AI Act Service Desk, Article 12 of Regulation (EU) 2024/1689, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-12
3. European Commission AI Act Service Desk, Article 26 of Regulation (EU) 2024/1689, https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-26