Last issue we covered where to start. This one is about the moment that sneaks up on you next: when a tool you were “just trying out” becomes part of how the report is prepared.
The risk with AI in regulatory reporting isn’t a one-off wrong answer. It’s AI being right enough, often enough, that you stop checking - and now an unreviewed black box is sitting inside your reporting process.
Here’s the test. If someone asked, “How do you know this is right, and can you show me how you got it?” - could you answer? If the honest reply is “I used AI,” you don’t have a controlled process. You have a liability with good formatting.
The fix isn’t to ban AI. It’s to treat it like any other step in a controlled process. AI doesn’t remove the need for controls - it just moves where you apply them.
The five controls any AI step needs
Garbage in / garbage out. Feeding complete and accurate data is priority number 1. If you provide bad data, expect a bad result. Review and verify the data provided for AI analysis prior to reliance.
A human review control. Someone competent reviews the output before it’s used, and owns the result. AI drafts; a person signs off.
An audit trail and source grounding. You can reproduce how the answer was reached - the question asked, the source used, the version of the tool. The output ties back to authoritative source (the instructions), not the model’s memory. If it can’t show you the source, it doesn’t get to be the answer.
Scope limits. Decide, in writing, what AI is and isn’t allowed to do in the process. Draft the commentary? Fine. Make the final reporting determination? No.
Change management. Models and tools change. What behaved one way last quarter may behave differently this one. Re-check, don’t assume.
None of this is exotic - it’s the same control mindset you already apply to spreadsheets, feeds, and manual workarounds. AI is just the newest place an uncontrolled step can hide.
If you want a running start on control #3, I keep a free, source-grounded prompt library at your-ai-controller.com/prompts - prompts built to make the model answer from the instruction text and show its source, instead of from memory. Let me know which prompts you use in your own work.
The one-line version
The teams that win with AI aren’t the ones who automate the most or fastest. They’re the ones who automate without weakening the control environment and causing reporting errors. Speed is easy. Speed you can defend is the actual skill.
Next issue: the prompt that gets you an audit-ready answer instead of a confident wrong one.
Prepare regulatory reports? Subscribe for the practical, control-aware version of this. And reply with the AI step in your process you’re least sure you could defend - I read every reply, and it shapes what I write and build next.
Educational only; not official guidance or the views of any employer. Always verify against primary-source instructions.