Prove which model answered, and keep the numbers out of it.

That is not an absence of direction. It is a transfer of responsibility. The agencies have said they plan a request for information on AI in model risk management, but until something replaces the footnote, the controls are whatever a bank can defend to its examiner and its board.

Broker-dealers are in a similar position. FINRA's Notice 24-09 said it created no new obligations. Its 2026 oversight report lists, among practices firms may adopt, keeping prompt and output logs and "tracking which model version was used and when." A 2025 notice asked the industry whether the recordkeeping rules themselves need updating for AI-generated communications. In Europe, the AI Act's logging duties for high-risk systems such as consumer credit scoring now apply from December 2027, after this year's omnibus amendment, and financial institutions keep those logs under their existing financial-services record rules.

So the evidence has to be designed by the firm. I think it comes down to three questions.

Models retire. Anthropic gives at least 60 days' notice. Azure retires models 12 to 18 months after launch and, for standard deployments, upgrades to a replacement automatically unless configured otherwise. OpenAI's own August 2025 flagship snapshot is scheduled to shut down in December 2026. Serving infrastructure changes too: routers, safety classifiers and sampling logic are updated around a fixed model, and vendors acknowledge this can shift behaviour slightly.

A record that says "we used the vendor's model" is not an answer. The record needs the exact model identifier, the date, the deployment configuration, and, if you run the model yourself, a hash of the weight files and the runtime version. When the model has retired, the record should still tell an examiner exactly what ran.

This applies to anyone running a shared inference server, including firms that run their own. Self-hosting does not make outputs reproducible by default. What it gives you is the ability to choose: pin the weights, the runtime and the kernels, keep a retired model available for as long as your retention period requires, and run a batch-invariant mode for the workflows that need it. The claim worth making to an examiner is narrow and testable: under these recorded conditions, this output can be regenerated.

A language model should never be the component that computes an interest accrual, a covenant ratio or a capital figure. Those belong in deterministic code whose output is the same every time and can be tested once and trusted. The model's job is to decide which calculation to run, to explain the result, and to draft around it.

That leaves one risk: copying. A model that receives "$1,243,567" from a tool can still write "$1,234,567" in its answer. Close calls like that are exactly where quantization and sampling noise show up. The control is cheap and mechanical. Every figure in the final text is matched against the tool output it came from before anyone sees it. If it does not match, the draft does not ship.

When the regulators do write the next framework, firms that already keep this evidence will find it describes what they are doing. Firms that do not will be rebuilding their audit trail from vendor changelogs.