An audit trail for AI-assisted document review
Auditors, regulators and clients will ask who checked the AI and against what. What an audit trail for AI-assisted review should record, and what does not count.
Key takeaways
- The guidance so far says the same thing: the professional stays responsible for AI output.
- An audit trail records the source, the evidence, the verdict and the reviewer for each answer.
- A chat transcript shows what the AI said, not that anyone checked it.
- Build the record into the review itself. Reconstructing it later rarely works.
Sooner or later, someone asks how an AI-assisted piece of work was checked. It might be an internal auditor, a regulator, a client, an investment committee or opposing counsel. The question is always a version of the same thing: who checked this, and against what?
"We reviewed it" is not an answer anyone can test. An audit trail is.
What the guidance says
No single rule covers AI-assisted document review across industries, but the guidance issued so far points the same way.
- Lawyers. ABA Formal Opinion 512 (July 2024) says lawyers remain responsible for work done with generative AI, and that uncritical reliance on its output, without an appropriate degree of independent verification or review, could breach the duty of competence. It also expects supervising lawyers to set policies for how their firms use these tools.
- Broker-dealers. FINRA Regulatory Notice 24-09 (June 2024) reminds firms that its rules are technology-neutral: supervision and other existing obligations apply when firms use generative AI, whether the tools are built in-house or bought.
- Banks. The interagency model risk guidance issued in April 2026 (SR 26-2 at the Federal Reserve), which replaced SR 11-7, places generative and agentic AI outside its scope. Banks are left to govern these tools through their own risk management practices, which makes their internal record matter more, not less.
None of this is legal advice, and your obligations depend on your firm and jurisdiction. The common thread is that responsibility stays with the people signing off, and they need to be able to show what they checked.
What the trail should record
| Record | Why it matters |
|---|---|
| The source documents, by name and version | An answer checked against last month's draft proves little about the signed version |
| The question or claim | What was actually asked, in the words used |
| The AI's answer | What the reviewer was asked to accept |
| The evidence: page and passage | Lets anyone repeat the check later without re-reading the document |
| The verdict | Supported, calculated, contradicted, or not in the document |
| Calculations, with their inputs | A derived figure is only as good as the numbers and formula behind it |
| The reviewer's decision, name and time | Approved, flagged or corrected, and by whom |
What does not count
- The chat transcript. It records what the AI said. It says nothing about whether anyone checked it.
- A confidence score on its own. It is the model's estimate, not a reviewer's judgment.
- Screenshots. They show a page, not which answer it supports or who decided it did.
- A highlight without a decision. A highlight shows where a passage is, not that the conclusion drawn from it is right. That call belongs to the reviewer, and the record should show it was made.
Building it into the review
- Decide which outputs need review. Not every answer carries the same risk. Anything that reaches a client, a court, a committee or a regulator does.
- Require a source for every answer. An answer without a page and passage cannot be checked, so it cannot be recorded as checked.
- Record a decision per answer, not a single sign-off for the whole document.
- Export the record with the deliverable. It belongs in the same file as the memo, abstract or summary it supports.
- Keep it as long as the work product. Follow the retention policy you already have for that kind of file.
- Sample approved answers. A periodic second look at approved items shows whether review is working or has become a formality.
The hard part is usually the reviewer's time, not the record. We cover how to keep review fast in Human-in-the-loop AI review.
How CiteLLM records review
In CiteLLM, every answer opens at its source passage, highlighted on the page, with a verdict: supported, calculated, contradicted or not in the document. The reviewer approves or flags each answer, and the evidence report records who decided what and when. You can export a highlighted PDF, only the highlighted pages, or the evidence report with the reviewer's sign-off, and file it with the work it supports.
Frequently asked questions
Does every AI output need human review?
Not necessarily. ABA Formal Opinion 512, for example, ties the degree of verification to the task and the tool. Anything that reaches a client, court, committee or regulator should be reviewed and recorded.
Is a chat transcript enough of an audit trail?
No. It records what the AI said, not what was checked, against which source, or who approved it.
How long should the record be kept?
As long as the work product it supports. Follow the retention policy that already applies to that kind of file.