Finland's financial watchdog flags AI logging as banks race to adopt the technology

Faster adoption, slower controls

Finanssivalvonta, Finland's financial supervisory authority, said this week that artificial intelligence is spreading through the country's banks and insurers faster than the controls meant to manage it ^[1]. The regulator's message is straightforward: AI brings efficiency, but it also brings risk, and institutions need to know what their systems are doing.

The statement lands just as two sets of rules converge. DORA, the EU's operational resilience framework for finance, has applied since January 2025 and already asks for logs that are protected against tampering ^[2]. The AI Act will add automatic logging for high-risk AI systems from 2 December 2027, and it says those logs must be kept for at least six months ^[3][4].

That combination is less dull than it sounds, because it creates a question most organisations haven't answered yet: when the people keeping the logs could also change them, how do you show they haven't?

Logs are like receipts

Nobody cares about a receipt until there's a dispute. Then it's the only thing that matters. Logs work the same way. When an AI system declines a loan, flags a transaction or prices a policy, the log is what tells you what happened and when. If the decision is questioned six months later, that log becomes evidence.

The problem is trust. A log kept by the same organisation that made the decision can, in principle, be edited. Access controls and monitoring make that harder, but they don't make it impossible. And when something goes to a regulator, an auditor or a court, the question isn't just whether you have the logs. It's whether anyone else can trust them.

What DORA already asks for

DORA's technical standard on ICT risk management is specific: logs must be protected against tampering, deletion and unauthorised access ^[2]. That applies to all financial institutions covered by DORA, which in practice means banks, insurers, payment institutions and investment firms across the EU.

The rule doesn't say how to protect the logs, but it's clear that storing them and hoping nobody touches them isn't enough. Finanssivalvonta's statement suggests Finnish institutions are still working that out ^[1].

What the AI Act will add

From 2 December 2027, high-risk AI systems under Annex III of the AI Act must technically allow for the automatic recording of events over their lifetime ^[3]. That includes systems used for credit scoring of natural persons, pricing of life and health insurance where risk assessment is done case-by-case, and recruitment or management of workers.

Article 12 says what to log: enough to trace how the system behaved, particularly in situations that could cause harm. It doesn't specify how to keep those logs safe, but Article 19 says providers must keep them for at least six months, and Article 26 says the same for users who control the logs ^[4].

Six months sounds short, but claims and complaints often arrive later. A decision made in March can be questioned in October. By then, the log is the only record of what the system actually did.

What this means for you

If you run AI systems in finance, three questions are worth asking now:

1. Which of your systems will count as high-risk under Annex III when the deadline arrives in December 2027?
2. Are your logs already protected in a way that would satisfy DORA's technical standard on ICT risk?
3. If someone with administrator rights changed a log entry, would that change show up?

Access controls are the foundation. Monitoring helps. But when a supervisor or an auditor asks you to prove a log hasn't changed, neither of those gives you a simple answer.

How a digital witness makes logs checkable

This is where a digital witness fits. The idea is to seal log records as they are written, so any later change shows up, even one made by someone with full access.

Here's how it works in a lending decision. Say the AI scores an application, writes the decision to the log and a human reviewer signs off. At that moment, your system takes a fingerprint of the record—applicant reference, model version, score, timestamp and reviewer ID—and seals it with WitniumChain. The content itself never leaves your systems. Only the fingerprint goes out.

Six months later, the applicant questions the decision. You pull the log, calculate the fingerprint again and compare it with the sealed one. If they match, nothing has changed. If they don't, someone has edited the record, and that's visible to anyone you share it with: the auditor, the regulator or the applicant's lawyer.

The check doesn't require trust, because anyone can do it. That's the point. A supervisor doesn't have to take your word that the log is clean. They can verify it themselves in seconds.

What it doesn't do is show that the decision was right, fair or compliant. It just shows that the record you're looking at is the one that was written on the day. That's often enough to move a dispute from "your word against mine" to "here's what the system did".

You can seal log segments continuously, every few minutes, through the REST API, the SDK or the MCP server. The first 2,000 witnesses a month are free. Full documentation is at witniumchain.com/docs.

How it would work

1. Your system writes a decision record to the log
2. It sends a fingerprint of that record to WitniumChain and gets a witness ID back
3. Later, anyone you share the record with can recalculate the fingerprint and check it against the sealed one

What to watch

Finanssivalvonta's statement doesn't set new deadlines, but it's a reminder that the existing ones are close ^[1]. DORA's logging requirements already apply. The AI Act's high-risk rules for Annex III systems take effect on 2 December 2027, less than two years away.

For systems under Annex I—general-purpose AI used in high-risk applications—the date is 2 August 2028 ^[5]. That sounds distant, but building logging into a system after the fact is harder than doing it from the start.

The European Banking Authority and EIOPA, the insurance regulator, are both working on sector-specific guidance for AI in finance. Watch for that in 2027.