The regulatory filing went out on a Friday. The team used an AI model to draft sections of the response. The language was polished. The formatting was correct. The citations looked right.
Three months later, the auditor arrived. Not for the filing itself. For the process behind it.
“Who verified the AI-generated content in this document?”
The compliance lead pointed to the review email chain. Four people had replied “approved” or “looks good.” The auditor read the chain, then asked the follow-up question that ended the conversation:
“What specifically did each reviewer check? Where is the record of what they found?”
There was no record. There were emails.
The Question Has Changed
The audit question is no longer “did you use AI?” It is “who verified what it produced, and where is the evidence?”
Two years ago, the compliance risk around AI was usage itself. Organizations worried about whether AI-generated content was permissible in regulated documents. That question is largely settled. Most regulatory frameworks now permit AI assistance with appropriate oversight.
The new question is about verification. Specifically:
- Who reviewed the AI output before it entered the regulated document?
- What did they check? Against what standard?
- What did they find? Were there errors, and were they corrected?
- Where is the record of all of the above?
This is not a hypothetical audit scenario. NIH notice NOT-OD-25-132 states that grants will be terminated and referred to the Office of Research Integrity if AI content is detected without proper documentation. 156 documented lawyer sanctions for AI hallucinations confirm the pattern in litigation. The regulatory direction is clear: AI use is acceptable. Unverifiable AI use is not.
The compliance officer whose team uses AI and cannot produce a verification trail on demand is the compliance officer who will be explaining the gap to the auditor.
Why “We Reviewed It” Is Not Evidence
The difference between a claim and evidence is whether someone outside your team can verify it.
Most organizations have some form of review process. A draft circulates. Team members comment. Someone senior approves. The document goes out. If asked, the team says “we reviewed it.”
This is a claim. It is not evidence.
Evidence, in an audit context, requires four things:
1. The original output. What did the AI produce before any human editing? Without the original, there is no way to verify what was changed and what was accepted as-is.
2. The verification checks. What specific checks were performed? Were citations verified for accuracy? Were claims checked against source documents? Were regulatory requirements cross-referenced? A verification record lists what was checked, not just that something was checked.
3. The findings and corrections. What did the verification process find? Were there errors? What were they? How were they corrected? A clean verification report (no errors found) is evidence. An absent verification report is a gap.
4. The signoff. Who approved the final document? When? With what authority? The signoff is not the email that says “looks good.” It is the documented confirmation that a specific person reviewed the verification findings and authorized the document for external use.
Email chains satisfy none of these requirements. They document that communication happened. They do not document what was verified.
The auditor does not care that you used AI. They care that you cannot prove anyone checked what it produced.
The Expert-Work Gap
IT compliance has mature audit trail tooling. Expert-work compliance has almost nothing.
Search for “compliance audit trail” and the results are dominated by IT infrastructure: system access logs, data handling records, change management documentation. These are well-understood, well-tooled domains.
Search for “who verified the AI output in this expert report” and the results are empty.
Expert-work compliance, where the AI output is a regulatory filing, an expert witness report, a grant application, or a clinical trial document, sits in a gap between IT compliance and professional judgment. The AI produced content that requires domain expertise to verify. The verification must be documented. And most organizations have no tooling or process for this specific requirement.
The compliance officer inherits this gap. They own the quality system. They are responsible for audit readiness. And when the AI-generated content enters a regulated document without a verification trail, they are the ones explaining the absence to the auditor.
What a Defensible Trail Looks Like
A structured verification record maps each AI-generated claim to its verification status, correction history, and signoff.
The Contradiction Register produces this record as a standard deliverable:
DOCUMENT: Regulatory Response, Product X Safety Review
GENERATED: 2026-08-14
VERIFIED: 2026-08-16
CLAIM [1], "No adverse events reported in the Phase III trial"
Source: Clinical Study Report, Table 14.3
Verification: ALIGNED, claim matches source data
Reviewer: [Name], [Title]
Timestamp: 2026-08-15 14:22 UTC
CLAIM [4], "Efficacy comparable to standard of care"
Source: CSR Section 11.4.1
Verification: PARTIAL, source states non-inferiority,
not comparability. Distinction matters for labeling.
Correction: Revised to "non-inferior to standard of care"
Reviewer: [Name], [Title]
Timestamp: 2026-08-15 15:07 UTC
CLAIM [9], "Published literature supports mechanism of action"
Source: Chen et al. (2024), DOI: 10.xxxx/xxxxx
Verification: MISALIGNED, Chen et al. studied a related
but distinct mechanism. Citation does not support
the specific claim as written.
Correction: Citation replaced with Park et al. (2025)
Reviewer: [Name], [Title]
Timestamp: 2026-08-16 09:33 UTC
SIGNOFF
Document cleared for submission: 2026-08-16 11:00 UTC
Authorized by: [Name], [Title]
Verification record retained: [Document ID]Every claim traces to a source. Every source traces to a verification check. Every correction traces to a reviewer. Every signoff traces to a timestamp and an authorized individual.
When the auditor asks who verified the AI output, the compliance officer hands them this record. The conversation is over in minutes, not weeks.
Building the Process Before the Audit
The worst time to build a verification trail is after the auditor asks for one.
The compliance officer reading this has two options:
Option 1: Wait. Continue with the current process. Hope the auditor does not ask about AI verification. Hope the team’s email approvals satisfy whatever standard the auditor applies. Explain the gap if they do not.
Option 2: Build the trail now. Establish a verification process for AI-generated content in regulated documents before the next audit cycle. Define what gets checked, who checks it, what the record looks like, and where it is stored.
The second option costs hours to set up. The first option costs weeks to explain and months to remediate.
The organizations that build the trail before the audit are the ones that pass the audit. The organizations that build it after are the ones writing corrective action plans.
If your team uses AI in regulated documents and the verification process is “someone reviewed it,” the audit trail does not exist yet. Request an architectural audit or reach us at [email protected].