Regulators ask how an automated decision was reached. What should your system already have?
Why D is the answer
An audit trail of inputs, retrieved sources, model versions and actions
Traceability has to be recorded when the decision happens. An explanation written later cannot show what really occurred.
In detail
- Traceability has to be recorded when the decision happens.
- An explanation written later cannot show what really occurred.
- Keep records for as long as the rules require.
Use case
An illustrative scenario, not a real incident.
A regulator asks why a loan was declined. The system retrieves the inputs, sources, model version and actions recorded at the time, so the answer rests on evidence.
See it in different ways
mindmap
root((Compliance))
Health data
Contract terms
EU personal data
Lawful basis
Where it is processed
US federal
FedRAMP
All
Data minimization
Audit trailmindmap
root(("Audit trail"))
n1["Inputs"]
n2["What came in"]
n3["Sources"]
n4["What was retrieved"]
n5["Model"]
n6["Which version"]
n7["Actions"]
n8["What it did"]Key point: Record decisions when they happen.
Why the other options are wrong
- A. A prompt that asks the model to explain itself whenever it is requested
- A model's later explanation is not a record of what happened.
- B. A summary written afterward by whichever engineer built the feature
- An engineer's memory is not evidence.
- C. A policy document that describes how the system is meant to behave
- A policy shows intent, not this decision.