A Few Good Logs

It doesn’t matter what I believe. It only matters what I can prove.

Lieutenant Kaffee was talking about a court martial in A Few Good Men, but the line would look well above the door of any compliance department in 2026. Most large organisations now have a set of AI principles, usually involving the words fair, transparent and accountable, and usually approved by a committee. Those principles are admirable and, when a customer’s loan is declined by a model the bank’s own staff cannot explain, about as much use as a chocolate teapot. “Computer says no” was funny on Little Britain. It is less funny as a submission to the FCA.

Yellow Radio was recently invited as a guest speaker for an episode on this subject for a new podcast series from 1000 Black Voices, and the conversation triggered some thoughts. The theme was defensible AI, which we think of as the branch of responsible AI that has to turn up in court. Responsible AI describes what an organisation intends to do. Defensible AI is the evidence that it kept those promises to its customers, investors, and regulators.

Why now

For a while the argument could be parked on the grounds that the rules had yet to be written, but that is only partly true. The UK has chosen not to write an AI rulebook at all, at least for financial services. The FCA’s Mills Review, published in July, recommends no AI-specific regulation and concludes that existing rules, including the Senior Managers Regime, continue to apply as systems become more autonomous. Firms hoping for a lighter touch should read the small print, because the review also warns that opacity and model drift will make it harder for senior managers to demonstrate meaningful human control, and it puts the standard in a sentence worth remembering: “a useful answer is not enough if the basis for it cannot be reconstructed.”

The courts have reached a similar place by a different road. In Ayinde last year, a case involving five fictitious legal authorities, the Divisional Court made no finding on how they came to be cited, but it took the opportunity to remind lawyers that they have a professional duty to check AI-assisted research against authoritative sources. It went further, telling heads of chambers and managing partners that the court would in future inquire whether their leadership responsibilities had been fulfilled.

Europe has been given more time, but not different rules. The Digital Omnibus, in force since July, pushed the EU AI Act’s deadline for stand-alone high-risk systems, which include credit scoring and recruitment, from August 2026 to December 2027. The requirements for technical documentation, automatic logging and human oversight have been deferred rather than dismantled. Thirteen months is not long to retrofit an audit trail to a system that was not built with one.

Meanwhile Agentic AI has moved from answering questions to taking actions. A chatbot that summarises a policy can at least be checked by the person reading it. An agent that retrieves the policy, interprets it, updates a record and sends a letter has made a chain of decisions, and each link is something an organisation should understand and be able to explain.

What it looks like

The easiest way to see the difference is to imagine the questions an auditor might pose, and the answers each approach can offer.

The question	Responsible AI	Defensible AI
Where did this answer come from?	We use trusted sources	This passage, of this version of this document, as it stood on the day
Was the user entitled to see it?	We respect privacy	The access check that ran before the model saw the data
Did it follow the rules?	The model was instructed to comply	The rule applied, the inputs, the result and the time
Is it fair?	We are committed to inclusion	Outcomes measured by group, and logged over time
Who is accountable?	Our AI governance committee	A named owner, and a record of what the reviewer checked and decided

None of the entries in the middle column is wrong, and an organisation without those commitments has bigger problems. They are simply statements of intent.

How to approach it

Start by deciding what needs defending, because the answer is not everything. An assistant that tidies up meeting notes does not need the apparatus described below. A system that touches a credit decision, a clinical pathway, a hiring shortlist or a benefits claim does, so the first job is an inventory of AI systems ranked by what happens when they are wrong, and an owner for each.

Next comes lineage. Every claim a system makes should trace to a specific version of a specific source. A typical retrieval system chops documents into fragments and selects those that sit closest to the question in mathematical space, and a similarity score of 0.82 does not help an auditor understand why one passage outranked another, or whether it was still in force. Vector search struggles with statements such as “this policy supersedes that one, except in Scotland”. Knowledge graphs, which record such relationships explicitly, are one good answer, and combining them with vector search is increasingly common - as exemplified by TrustGraph.ai. Whatever the architecture, the test is whether an organisation can show what its policy said on any given date.

Then keep the records. That means the prompt, the model and its version, the settings, what was retrieved and every tool the system called, all stored somewhere that shows if they have been altered. A word of caution here on reproducibility, which is often promised and hard to deliver. Setting a model’s temperature to zero does not guarantee the same answer twice, as researchers at Thinking Machines have shown, and models hosted by a third party can change beneath you or be deprecated. The defensible position is to pin versions where you can and to retain a faithful record of what happened, without staking your case on being able to replay it. As open-weight models become more capable, self-hosting them is increasingly viable, and avoids the risk of deprecation.

The most useful design principle is that AI should not mark its own homework. Asking one model whether another has complied with the rules merely gives you two opinions from the same family. A sounder pattern uses the model only as a translator, turning messy text into structured facts, and hands those facts to conventional software that applies the rule: either the interest rate is at or below the cap, or it is not. Where the extraction is ambiguous or a field fails validation, the system should stop and pass the case to a person. Access controls belong in the same deterministic layer, applied before the data reaches the model, since a model cannot leak what it has not been shown.

These measures have limits, and vendors tend to be coy about them. No architecture eliminates hallucination. A rule engine is only as reliable as the facts extracted for it, and an automated score suggesting that an answer follows from its source is useful evidence, not mathematical proof. That is why people remain part of the design, and why their involvement needs evidencing too. The Mills Review is sceptical of human oversight as a safeguard in itself, and rightly so: a reviewer approving four hundred cases before lunch, with no sight of the underlying sources, is a rubber stamp with a pension. Reviewers need the information to disagree and the authority to act on it, and their disagreements should be logged.

Standards such as ISO/IEC 42001 and the NIST AI Risk Management Framework are helpful for organising all of this, and procurement teams increasingly expect to see them. We would map to them last. A certificate describes a management system, not why a particular decision was made.

What happens if you don’t

The direct costs so far have been modest, which is misleading. When Air Canada’s chatbot invented a bereavement refund policy in 2024, the airline argued, remarkably, that the chatbot was a separate entity responsible for its own actions. The tribunal disagreed and awarded CA$650.88 in damages. The sum hardly matters, though the principle that you own what your software tells people matters.

Reputations are more easily dented. Deloitte agreed to a partial refund on a report for the Australian government, worth about A$440,000, after it was found to contain errors including a fabricated quote from a judge. The firm stood by its findings, but a consultancy sells judgement, and it was now discussing its footnotes in the national press. Lawyers have fared worse. Damien Charlotin’s database of court decisions addressing hallucinated material now lists 2,286 cases, with the count rising almost daily.

The larger risks are still working their way through the system. In Mobley v Workday, a US federal court has allowed a collective action alleging age discrimination by AI-assisted hiring tools to proceed. Workday denies the claims and nothing has been decided on the merits, but a case like this requires the data, and an account of how the tool behaved, potentially across years of applications.

That points to the people who bear the cost of indefensible systems, who are rarely those who bought them. A rejected applicant or a declined borrower has little way of knowing that a model was involved, let alone that it was skewed. Fairness that has been measured by group and written down can be challenged and corrected. Fairness that exists only as a pledge cannot. We wrote about who loses out from this in cheaper to build, harder to be heard.

Then there is the cost outside of the courtroom, and for most firms it will be the largest. Projects die in procurement. A promising pilot meets the risk committee, the questions in the table above cannot be answered, and the business case is shelved. In regulated markets, defensibility increasingly decides whether a pilot gets deployed.

The practical first step is cheap. Pick your most consequential AI system, choose one decision it made last month, and try to reconstruct how it got there: the sources, the version, the rules, the reviewers. If that takes an afternoon, you are in better shape than most. If it cannot be done at all, we should talk.

For the regulations and engineering controls in more detail, see our technical companion piece, show your working.

Kaffee, you may recall, won his case because Colonel Jessup lost his temper and confessed on the stand. We would not plan a compliance programme around your AI doing the same, although, given the right prompt, it might confess to anything, with an admission that you’re absolutely right, good catch.