The Trail Behind AI-Prepared Work

Four public bodies have written about what should be shown about AI use. Each writes in its own setting. A court says its users must be ready to identify which parts of their court documents were produced with AI. They must also be able to explain how the output was checked. Two audit regulators describe an audit file detailed enough for an experienced auditor to understand. A data protection authority writes about the compliance documents for AI products. It says they should show the choices and decisions that were made. Here is what each one says, with its limits.

In software, you can trust a result you did not produce in two ways. You run it again, or you trace each step back to its input. Neither comes free. Both have to be built in before the work starts, not added after someone asks.

Saying Where and How the Tools Were Used

The court is the Supreme Court of Victoria, in Australia. Its Practice Note SC Gen 25 covers the use of AI by court users. It commenced on May 14, 2026. It defines a court user to include lawyers and litigants, with or without a lawyer. Lay and expert witnesses are court users too.

Court users must be ready to identify the specific parts of their court documents that were produced using AI. And they must take care that their use of AI does not mislead, directly or indirectly. That means anyone in the case, or the court. It covers the nature of the work done and the content the tool produced.

In the Netherlands, the financial markets authority, the AFM, looked at how audit firms use auditing tools. AI tools were among them. Its report of December 2025 sets out building blocks for the controlled use of auditing tools. Its review was exploratory. It covered eleven audit firms with a regular license for statutory audits. It also covered two firms whose license extends to audits of public interest entities.

The AFM found that nearly all audit firms use AI or generative AI to some extent. For example, they use chatbots to summarize meeting minutes. They also use them, for example, as a sounding board for risk assessments, or to answer simple questions of method. But it was not always clear or visible where and how AI had been applied in the audit. The AFM says it is important that the external auditor knows where AI was used. That way, appropriate responsibility can be taken during the review. Among other questions, it expects firms to ask themselves: "Which procedures receive less human attention due to (Gen)AI tools?"

The Canadian Public Accountability Board calls itself Canada's independent regulator of public company audit firms. In December 2025 it published a paper on the use of technology in audits. The paper says it is important to be open about how technology is used in an audit. That means being open with audit committees and regulators, among others. The board says this openness is essential to the oversight role that audit committees play in supporting audit quality.

Checking the Output

The AFM says the output of AI tools cannot always be reproduced exactly. But outcomes must be verifiable or replicable. When an auditor uses such output as audit evidence, it is essential that the output is verified. One way is to have the tool point to external sources or source documents. Then its outcomes can be traced. If exact verification is not feasible, firms may choose to make the results replicable.

Think of a receipt and a recipe. A receipt you can check against the bank statement. A recipe you can follow again and get nearly the same cake. For a tool's output, the AFM asks for one or the other.

The report also gives an example of bad practice. The tool is a "black box." Its outcomes come without visible reference to specific source documents.

The Victorian practice note says court users must be able to explain how AI output was verified. Content produced with AI must be verified with "meaningful human control." Some checks apply when generative AI was used to produce material for the court. Court users should check that any case law, legislation, textbook or article they cite exists. They should check that it stands for the legal point it is cited for. Extracts and quotes must be checked for accuracy and credited to the correct source. One AI tool cannot be used to confirm what another AI tool produced. Court users may, though, check AI content against original source material. That holds even when the material sits inside a generative AI tool.

Where did the tool work, and how was its output checked? A file that cannot answer both is not a trail yet.

Questions That May Help Guide an Auditor's Use of Technology

The Canadian board's paper sets out questions that, in its words, "may help to guide" auditors' use of technology. Among them: Does the engagement team clearly understand the relevant inputs? Has it evaluated whether the data is accurate and complete? Does it understand how the tool makes decisions? Can the outputs be confirmed through other relevant sources? Can they be explained? Has the team challenged the tool's conclusions enough?

I would put the last question first. Has the team challenged the tool's conclusions enough? I read the other questions as ways to make that challenge possible.

Examples of Testing Limited to What a Tool Flagged

In October 2025, the Canadian board published its report on its 2025 interim inspections. It lists examples of deficiencies found when a technology-assisted audit tool provided the primary source of audit evidence. In one example, the auditors tested whether recorded amounts were complete and accurate. But they tested only the transactions the tool flagged as higher risk or outliers. In one instance, the report says, that left about 98% of the revenue in the company's financial statements without further audit procedures.

That finding has limits. The board chooses files and audit areas by risk. It says that method is not designed to select a representative sample of a firm's audit work. Its results should not be extrapolated to all of a firm's audits. They should be read as a sign of how firms handle their most challenging audit situations.

The board's paper of December 2025 also describes one tool. Substantive testing was generally limited to transactions flagged as higher risk or outliers. The transactions the algorithm judged low risk got no further testing. That raised two concerns for the board. One was the transparency around how the tool set its risk classes. The other was whether the auditor challenged its outputs enough.

Documentation for AI Products

Ireland's Data Protection Commission published a report in September 2026. It shares what the commission learned from supervising AI products and services from 2021 to 2025. It says detailed documentation helps controllers show that they comply with the General Data Protection Regulation (GDPR). It says this follows the accountability principle in Article 5(2). The documentation, it says, should show the choices and decisions the controller made.

Some controllers came to the commission with high-level statements about their compliance. They had no evidence or reasoning behind them. They struggled to finish their engagement with the commission in time for their planned launch. In such cases, the commission asked for the launch to be delayed or paused. The aim was to let it assess compliance thoroughly before any AI training began. Poor documentation may also raise doubts, it adds. The doubts are about how effective and complete an organization's compliance readiness program is.

One of its case studies describes a controller that gave the commission two assessments. One was on data protection impact, the other on legitimate interests. They were organized so that likely questions from the commission were answered right next to the relevant information. The documentation clearly set out the controller's design choices on data protection. Engagement with the commission did not delay the controller.

A File an Experienced Auditor Can Follow

As tools work more on their own, the Canadian board's paper says, supervision and oversight "may need to be enhanced." One example it gives is a clear, written roadmap of the steps the tools took or the decisions they made. In keeping one, it says, auditors need to make sure the audit file holds enough detail. An experienced auditor with no prior involvement should be able to understand it clearly. That means what was done, when and how far, and the results and evidence. It also means the significant matters and judgments behind the conclusions.

The AFM says the documentation requirements for AI tools are equivalent to those for ordinary auditing tools. Documentation must be "sufficiently detailed" for an experienced auditor to understand the work. That means its nature, timing, extent, results and conclusions.

An experienced auditor with no prior involvement is a capable stranger to the work. That is the test I would use for any file of AI-prepared work, audit or not. If that stranger cannot tell what the tool did, what was checked and who decided, the trail is not there yet. However good the work underneath may be.

Who, outside the work, could follow your last file from the first step to the conclusion?