Prove Someone Read It

Two sentences sit near the front of a report to Congress.

The first says portions of the report were developed with the assistance of artificial intelligence. The second says all of that content has been reviewed, verified and approved by staff.

Reviewed. Verified. Approved.

Good words. I believe them.

Now be the reader. You weren't in the room. You don't know which pages the tool helped write, who went through them afterward, or what that person found and fixed. You have three words. Take them or leave them.

That's this chapter. Not whether someone reviewed the work. Whether anyone else can tell.

Here's why it matters to you. One day a stranger opens your file. A client, an inspector, a judge, the other side. The stranger wasn't in the room either, and the stranger asks the second of this book's three questions: did someone who could catch the error check this, and can the file show it?

Saying you reviewed it isn't an answer anyone can test.

A record is.

So what does a real review leave behind? A taxpayer advocate, a board that coordinates financial authorities, the ECB's bank supervisors, the European Commission, a medicines inspectorate, two older federal rules and an engineers' board each hold a piece of the answer. One at a time, then. Watch for four things as we go: who reviewed, what they looked at, what they changed, and what they turned down. That list is mine. I'll come back to it.

A Sign-Off Is Not a Record

The report is the National Taxpayer Advocate's Objectives Report to Congress for fiscal year 2027, and its preface is dated June 24, 2026. The Taxpayer Advocate Service calls itself an independent organization within the IRS.

The two sentences stand between the table of contents and the preface.

Give them their due. They tell you AI was used, who checked it (Taxpayer Advocate Service staff) and why: to ensure accuracy and integrity.

The other side is shorter. The statement names no portion of the report, and it doesn't say how the AI-assisted content was verified.

So what is it? A sign-off. Not a record.

A sign-off tells you someone answered for the work. A record does more. It lets you follow the check, part by part, and see for yourself what the checker found.

I'm not knocking the statement. It says in plain words that AI was used and that people checked. And nothing in the report says what the service keeps behind that line. There may be a full record behind it, but the page doesn't show one, and the page is all a reader gets.

That's the gap this chapter is about. On one side, a line that says a review happened. On the other, a record that shows it.

The Sheet on the Door

You know the sheet that hangs on the back of a restroom door, the one that says when the place was last cleaned. A grid of hours. A column of initials. Nine, ten, eleven.

Look closer. Same pen. Same hand. Same slant from top to bottom, as if somebody signed the whole day in one go.

Was the room cleaned? Maybe. The sheet can't tell you, because it was built to be filled in, and it was.

That's a ticked box. All it records is that a box got ticked.

Now hang that sheet in a bank.

A model scores a loan. A person is supposed to check the score. Beside each file, initials in a row, every one in the same hand.

Banks can end up with that sheet too. And the people who coordinate their regulators have a name for it.

Tick-the-box.

You'll find it in a report by the Financial Stability Board, which coordinates the work of national financial authorities at the international level. Its final report on sound practices for the responsible adoption of AI is dated October 15, 2026. It sets out twelve practices that financial institutions are encouraged to consider. Number ten? Human oversight.

And it draws the line in one word. Meaningful.

Oversight is meaningful, the board says, when people have sufficient ability, authority and incentive to intervene. What it sets against that is oversight that is nominal, or driven by tick-the-box compliance. Nominal. In name only.

Ability. Authority. Incentive. Take one away, and you're back at the restroom door.

So how does a bank show its oversight is the real kind? The board gets practical. Financial institutions, it says, design and develop AI to enable effective and meaningful human oversight, as far as technically possible. That means people. Staff who can assess what the AI puts out and understand its capabilities and limitations.

It means incentives, too. Incentives aligned for thorough, thoughtful review, to prevent automation bias, which the report glosses as overreliance. Its example is performance metrics that reward the quality of oversight decisions.

Then come two lines worth copying out by hand, from the board's list of design steps.

Track when people override the AI's recommendations, and analyze the patterns.

Assess whether the overseers themselves are providing effective oversight.

Look at the first one. An override is a moment when a person looked at what the machine proposed and said no. Write them down. Now you have a trail of no's. A ticked box can't give you that. Neither can a line that says "reviewed."

The second one is somebody checking the checkers.

The limits, then. A banker would raise them before you finished the sentence. The practices aren't a binding international standard, the board says. They're a toolkit. Non-prescriptive and practical, it says, written for financial institutions, with the oversight scaled to the use: its materiality, risk, autonomy, complexity and explainability.

Nor does it demand a person on every decision. One form of oversight it lists has a human approve all decisions made by AI, which it says might be appropriate where accuracy is more important than speed. Another has a person step in periodically. Or only where necessary.

So how much oversight your work needs depends on the risk, and on the rules you work under.

Whether you can show it is another matter.

Write Down Every No

In one corner of banking, it isn't left to encouragement. The law comes into it.

Some banks use their own internal models for credit risk. Under an EU regulation, that takes the European Central Bank's permission. Its say-so. The ECB's guide to internal models, in its June 2026 edition, says how it understands those rules and how it intends to apply them. It isn't meant to replace or overrule the law, it says.

Here is the regulation's sentence, as the guide quotes it. For grade and pool assignments, institutions shall document those situations in which human judgment may override the inputs or outputs of the assignment process.

Institutions must document each override, the guide says, citing the same article. Each one. They must also document the personnel responsible for approving overrides. Then come the guide's own shoulds: all decisions taken throughout the rating process should be recorded, and so should the reasons for any override, in proportion to how severe and how extensive the override is.

Who may approve it, what was decided, and why.

Then the regulation adds one more duty. A big one. As the guide quotes it, it also says institutions shall analyze the performance of those exposures whose assignments have been overridden.

Put simply: go back and see how the overridden cases turned out.

Here it bites. In general, the guide says, too many overrides could be a strong indicator of weaknesses in the model. And if overrides fail to consistently increase the accuracy of the model, the institution should review its override policy and strengthen the criteria to better limit the number and extent of overrides.

So the record can catch a weak machine. And, I'd add, a weak reviewer too. Either way, somebody finds out, because somebody wrote it down.

Mind the scope. This part of the guide is about rating systems for credit risk, under one regulation, at banks with permission to use their own models. It speaks of human judgment, and it doesn't mention AI. Where the guide does take up machine learning, it says these documentation requirements are of particular importance for overrides of models based on it, and that everyone responsible for performing an override should have an in-depth understanding of the risk factors and criteria driving the model's output before the override.

So it's not a rule for every decision in a bank. Fine. But look at what it buys you.

A reviewer who passes everything might be reading every word. Maybe. The file can't tell you. A reviewer with overrides on the record has shown you something a ticked box never will: at least sometimes, a person looked at the machine's answer and changed it, or said no.

What Counts as Reading

But a no only counts if somebody read first. So where does reading stop and nodding start?

The European Commission answered that, because a law made it matter.

The EU's AI Act has a rule about text. Say an AI system generates or manipulates text that is published to inform the public on matters of public interest. Then whoever deploys the system has to disclose that the text was artificially generated or manipulated. There's an exception. It needs two things, both true. The text has undergone human review or editorial control. And a person or a company holds editorial responsibility for publishing it.

So everything turns on one question. What counts as human review?

The Commission answered in guidelines dated November 5, 2026. They are non-binding, they say, and ultimately only the EU's Court of Justice can give an authoritative interpretation of the law. But on this point they're specific.

Human review is the deliberate examination of the substance of the content by one or more people with relevant knowledge and professional judgment on the subject. Fact-checking the accuracy of the content is a minimum requirement that should be part of it. The floor.

Then comes what doesn't count. I like this part even more.

Superficial, solely formal or procedural checks, and the guidelines give spell-checking and grammatical correction as examples. The mere existence of an editorial policy. Automated review processes. And cursory editorial approval without substantive engagement by the human reviewer or the editorial entity. None of those, the guidelines say, can fulfill the conditions for human review or editorial control for the purposes of this exception.

A policy isn't a review. A spell-check isn't a review. A nod isn't a review.

And there's a sentence every reviewer should see. Suppose AI is used to modify, supplement or reformulate the content after editorial sign-off. Then the result must be treated as AI-generated or manipulated all over again. Square one. Any substantive AI intervention after the review, the guidelines say, will cause the exception to become void.

Think of signing a lease. Then somebody replaces page four. Your signature is still there on the last page, in your own hand, but it isn't on that lease anymore.

And the name. For the second condition, the identity and contact details of the person, the company or the function with editorial responsibility should be made publicly available, somewhere easy to find, if they aren't available already.

This is narrow. I'll say so plainly. One exception, the one about human review, in one article of one law, about text published to inform the public. It isn't a rule for your audit file or your tax memo. I use it because it draws a clear public line between reading and nodding.

Over Ninety Pages

Imagine reading people's answers to your inspections for a living. And one of them runs past ninety pages without dealing with what you found.

The UK's medicines regulator, the MHRA, inspects organizations and then reads their written responses. On June 29, 2026, its inspectorate published a post on its blog about what it has been seeing in those responses. A blog post. It describes the agency's "current thinking," and it relates specifically to submissions to the agency's compliance teams following what it calls GxP inspections.

AI tools are being used to draft those responses, the post says. It doesn't blame the tools. Far from it. The technology offers genuine benefits, it says: helping articulate complex technical issues, improving consistency, speeding up routine drafting and enabling innovation. Used properly, AI can support better regulatory outcomes and improve patient safety.

Then the other pile.

Responses with references to agency guidance that doesn't exist. Citations of inappropriate regulatory frameworks. And one inspection response that totaled over ninety pages and did not address the deficiencies identified.

Ninety pages. The deficiencies, still sitting there.

In at least one case, the post says, an AI-generated response to a serious deficiency affecting patient safety contained material inaccuracies, including non-existent references. The time needed to review and respond went from around four hours to over twenty.

Somebody sent that in.

The agency's concern, it says, isn't whether you use AI. It's whether your submissions are accurate, verifiable, and prepared under appropriate oversight. So it sets five principles. All submissions and responses must be factually accurate and verifiable, and technically reviewed by appropriately experienced people. Signed off by someone with authority and accountability. Supported by evidence for factual claims. And appropriate to the specific regulatory context. These expectations apply, the post says, regardless of how you draft.

Two of those five are this chapter's whole subject. Reviewed by appropriately experienced people. Signed off by someone who answers.

Nor is the duty new. The post says so. Organizations have always been responsible for the accuracy of their responses, and the persons responsible for them have always been expected to verify factual claims. These responsibilities, it says, do not change because drafting tools have.

This is the part I'd copy tomorrow. The agency offers organizations the option to disclose AI use. It isn't mandatory. If you choose to, it says, include a brief statement at the start, identify which sections involved AI assistance, and confirm human verification and approval.

Put that beside the two sentences in the report to Congress. I'd call it the same kind of statement, with one thing added.

Which sections.

That one addition changes what a reader can do. Now the reader knows where to look.

And the inspectors do look. When the agency reviews responses, the post says, it assesses the quality of oversight processes, and it lists warning signs of inadequate verification. Factually incorrect statements or non-existent references. Generic language inappropriate to specific circumstances. A lack of organization-specific detail where expected. Citations of regulatory frameworks with no explanation of relevance. Inconsistent technical terminology across submissions. Overly verbose responses failing to deal with the subject matter appropriately.

So the inspector reads the review off the work itself. That's my reading. A reviewer who knew the organization would have caught the generic paragraph. A reviewer who checked would have caught the reference that doesn't exist. When they're still on the page, the page is telling on the review.

And the price? Among other things, where the information supplied is inaccurate, incomplete or overly verbose, the agency may reject the response or return it for another attempt. And it may assess your verification processes.

There it is. Not just: was this checked? Show me how you check.

The reward is in the agency's words too. Inspectors will consider disclosure positively when assessing organizational compliance.

It Didn't Start With AI

What's easy to miss is this. Showing a review is older than any chatbot.

The FDA has a rule on laboratory records for drug makers. Its own note traces it to 1978, with its latest amendment in 2005. No AI.

The rule lists what laboratory records shall include. Among them is a complete record of all data secured in the course of each test. And a record of all calculations performed in connection with the test.

Then come two items that sit one after the other.

The initials or signature of the person who performs each test, and the dates.

The initials or signature of a second person, showing that the original records have been reviewed for accuracy, completeness, and compliance with established standards.

That second mark isn't there to say a second person exists. It's there to show the records were reviewed.

The order matters too. First the list puts the work on the page: the data, the calculations, who ran the test and when. Only then does it ask for the reviewer's mark.

It's the old rule from math class. Show your work, the teacher said. A bare answer can only be marked right or wrong. The steps written out show where it went wrong.

What I take from that order is simple. A reviewer can only review what's in front of them.

That's what keeps those initials from being the sheet on the door, I'd say. Everything they vouch for sits in the same record. A stranger can check it again.

Health claims have their own version.

This one is the US Labor Department's, on claims procedures for employee benefit plans. Its own note traces it to 2000, with changes as late as 2020. Again, no AI.

The rule covers a plan's decisions against a claimant, including a denial, reduction or termination of a benefit, or a failure to pay for one. Then the appeal. When a claimant appeals such a decision at a group health plan, the rule says what the plan's procedures must provide before the appeal counts as a "full and fair review."

Here is what matters for us.

One. The review gives no deference to the first decision. And it is conducted by an appropriate named fiduciary of the plan who is neither the individual who made that decision nor the subordinate of that individual.

You don't appeal a referee's call to the same referee. Or to that referee's assistant.

Two. The procedures provide for identifying the medical or vocational experts whose advice the plan obtained, whether or not it relied on the advice.

Then the file. A claimant is to get, on request and free of charge, reasonable access to all documents, records and other information relevant to the claim.

The rule defines relevant broadly.

It includes what was relied upon in making the decision. What was submitted, considered or generated in the course of making it, relied upon or not. And whatever demonstrates compliance with the administrative processes and safeguards the rule requires.

Read it the way an outsider would. A reviewer who didn't make the first decision. Advisers identified. What they had in front of them. Documents that show the safeguards ran.

A caution, and I mean it.

Both rules speak of people: the person who performs each test, the individual who made the first decision. Neither says a word about software. I'm not telling you how a court or an agency would apply either one to an AI tool.

I'm pointing at the design.

What the Seal Tells a Stranger

Engineers carry the idea in a seal.

Texas's board for professional engineers and land surveyors prints its rules in a handbook, effective June 18, 2026. The handbook calls itself a reference document only. One rule covers sealing procedures. And its first line could have been written for this book.

The purpose of the engineer's seal, the rule says, is "to assure the user of the engineering product" that the work has been performed or directly supervised by the professional engineer named, and to delineate the scope of the engineer's work.

The user of the product. That's our stranger.

So the seal does two jobs. It says who stands behind the work, and it marks how far that person's work goes.

The rule is strict. License holders shall only seal work done by them, or performed under their "direct supervision," or standards or general guideline specifications that they have reviewed and selected. Upon sealing, it says, engineers take full professional responsibility for that work.

Direct supervision has a definition. A demanding one. It is the control over and detailed professional knowledge of the work. It entails that the engineer personally makes decisions, or personally reviews and approves proposed decisions prior to their implementation, and has control over the decisions, through physical presence or the use of communications devices.

Personally. Twice in one sentence.

And then the best line in the rule. When two or more license holders have worked on a plan or document, the seal and signature of each goes on it, with a notation describing the work done under each license holder's "responsible charge."

It works like the credits at the end of a film. Each name sits beside a job. You know who wrote the music, and who did the lighting.

Where does AI come in? The board was asked. On November 14, 2024, it approved a policy advisory opinion on the use of AI software by its licensees. Neither the state's practice acts nor the board's rules directly ban AI software, it says. The software is a tool, and it is acceptable for licensees to use it, with caveats.

The first caveat is this chapter's. It's worded as a should, not a shall.

As with any other software tool, the opinion says, AI software should not be relied upon without oversight and review by the licensee. Licensees are ultimately responsible for any work product they sign and seal. If they use AI software as a tool, they should review the outputs to ensure they are complete, accurate, and consistent with generally accepted engineering and surveying concepts and principles.

Then the board's conclusion. No new opinion.

None will be developed for this request, it says, as the act and the board's rules adequately address the use of AI software at this time. The board will continue to monitor AI software.

Asked about the newest tool, the board pointed at the rules it already had. And the sealing rule is the first one its opinion cites.

To be fair to the rule, it asks for no separate written record of how the work was reviewed. Among the marks it does ask for are the seal and signature with the date, and the notation where two or more license holders worked.

Not Every Rule Asks

There's another side, and it belongs here. Not every rule asks for a record.

On October 9, 2025, FinCEN, the US Financial Crimes Enforcement Network, answered a question jointly with four other federal agencies. Is a financial institution required to document the decision not to file a suspicious activity report?

No.

There is no requirement or expectation under the Bank Secrecy Act or its regulations to document that decision. FinCEN has encouraged it before, the answer adds, but not required it.

Should an institution choose to, the agencies add, a short, concise statement will likely suffice in most cases, although it may consider more documentation in more complex investigations.

Two lessons. A record isn't always required. And a good one can be short.

On a quiet night, a ship's log may say only this.

Calm sea. Nothing sighted.

Four words. Whoever takes the next watch still knows what was looked at, and what was found.

What a Review Leaves Behind

Picture two babysitters. Each leaves you a note.

The first says: All fine.

The second says: He wouldn't touch the peas. The bath ran cold, so we skipped it. Asleep by 8:40, after two stories.

Which one was watching?

You can't prove either note. But the second sitter told you what happened, what got changed and what didn't work. That's hard to write from the couch. If the first one had spent the evening on the phone, that note would read exactly the same.

That's what I'd look for in a file. Not the words that say it was reviewed. The traces a review leaves when it really happens.

So back to my list, now with the documents behind it. No document in this chapter sets it out this way. It's mine, built from theirs.

Who reviewed. I'd ask for a name, not a department. That's my own test.

The lab rule wants a second person's initials or signature. The claims rule, for group health plans, wants the experts identified. The inspectorate wants sign-off by someone with authority and accountability. The seal names the engineer.

What they looked at. The inspectorate's voluntary disclosure identifies which sections involved AI assistance. The seal delineates the scope of the engineer's work. The claims rule reaches what was considered.

A review of the whole file tells a stranger little. Of named pages, against a named source? Something.

What they changed. Of the four, this one rests on the least. The Commission's guidelines define editorial control, the other route to the exception. It is control exercised in practice by a responsible editorial entity with the authority to approve, alter or reject the substance of a text on substantive grounds. I'd expect someone with that authority, who really reads, to alter something now and then. The alterations are evidence.

What they rejected. The no's. That's the override record: the stability board's tracking of when humans override AI recommendations, and the ECB's reasons for any override. An override can be a change or a flat no, so this item and the last one overlap.

A count of rejections isn't a score. But a reviewer who always says yes hasn't shown that saying no was possible.

A clean draft may need no change. Then the reviewer should be able to say why.

Who. What. Changed. Rejected.

The first two are probably habits you already have. The last two are what an AI draft makes worth writing down.

And notice what isn't on the list.

A checkbox.

To be honest about it, none of this proves the reviewer was right. A record is evidence that a person read the work, and how. Whether that person could catch the error is the other half of the question. It gets chapters of its own.

A word for the accountants and tax people reading. This chapter doesn't take up what your own standards say about documenting a review. It looks at how other fields show theirs.

Let the Tool Keep the Log

Companies using "robust processes," AI-assisted or otherwise, meet regulatory standards, the inspectorate says. The engineers' board calls AI software a tool and says it is acceptable to use it, with caveats. Their words, not mine.

The stability board's report goes a step further. Its override tracking isn't only evidence. It's feedback. The patterns in those interventions are meant to refine both the AI and the oversight processes. The way I see it, a record of the review is also how the tool gets better.

Now my own view, which no document here states.

A record like this used to cost time. Somebody had to write down what they looked at, what they changed and why. Software is good at that part. It can note what was edited, what was sent back and when.

It can't do the reading. But it can keep the log while a person reads.

Be honest about what a log proves, though. Take the badge reader on an office door. It records who came in and when, to the second.

It doesn't record whether anyone did a stroke of work.

A log that says who opened a file is that badge reader. It proves the opening, not the reading.

That's why my list asks for what changed and what was sent back. Those are traces made by the act of reviewing, not by walking past.

The Stranger Can't See Your Care

Think back to the two sentences at the front of that report.

Reviewed, verified and approved. I said I believe them. I still do.

But belief is what's left when there's nothing to check. And the stranger owes you none. The stranger wasn't there, doesn't know you, and may be looking for the one weak page in the file.

To that reader, a review nobody can see is no review.

With a stranger, careful doesn't count. It doesn't matter how careful you were, or that you read every line twice. If the file can't show it, the stranger has a signature and a hope.

So put one question to any file where AI did part of the work. Not who signed it. What did the reviewer send back?

If there's an answer, you're looking at a trace of real reading. If the answer is nothing, ask why. A clean draft can happen. But a reviewer who can't say why it was clean has left you a sheet on a door.

There's a harder question behind all of this. A reviewer can read every word. Catch the error. And still not be allowed to stop the work.

Reviewing is one thing. Being able to say no is another.