·3 min read
The copilot is not the audit trail
A banking assistant that cannot reconstruct who asked, what was retrieved and what was sent is a finding, not a feature.
Photo: Sean Pollock on Unsplash
Banks already run models. The new problem is language systems that write into customer channels and internal memos without leaving a file the auditor can follow.
JPMorgan has been public for years that AI sits inside the firm. That is not a licence for a team to paste a general chatbot over a product FAQ and call it transformation.
McKinsey’s State of AI keeps showing the same gap: value shows up where use cases have owners, data rights and evaluation. Copilots without those three become shadow process.
An audit trail is not a chat export. It is the question, the documents retrieved, the version of the policy, the person who sent it, the time. If any of those are missing, you cannot reconstruct a complaint.
Grounding belongs on the approved corpus: the product PDS, the credit policy, the last circular. Fine-tuning on “how we usually phrase this” will bake in drift the compliance team already fought.
Human review should be risk-based. A balance enquiry is not a lending decision. Put the stop on the classes that create a customer commitment.
If internal audit cannot replay last month’s answers, the copilot is not in production. It is a rumour with a budget.
The TruFyre Way
The copilot is not the audit trail. TruFyre records the retrieval set, the draft and the named owner so second-line can replay the answer.