Whitepaper
The six audit questions agentic AI will force banks to answer
How data lineage becomes the foundation for defensible AI governance
On April 17, 2026, US regulators issued SR 26-2, the first revision of model risk management guidance in 15 years. Footnote 3 places generative and agentic AI outside its scope, which leaves banks above $30 billion in assets to build their own frameworks. European supervisors reached the same evidence standard by a different route, with the European Central Bank requiring lineage at the data attribute level and the EU AI Act codifying traceability for high-risk systems. Your examiner can ask about any input that fed any decision.
Download the whitepaper
The six questions every examiner will ask
What data did the agent access?
What prompts and policies governed it?
What action did the agent take?
What is the downstream impact when source data changes?
Who approved the data, prompts, and policies?
Can you reconstruct any agent decision on demand?
One evidentiary foundation answers all six.
What’s in the whitepaper
The paper works through each question in turn, then sets out what a lineage layer needs to answer them:
Attribute-to-policy traceability, from source column to the policy that authorizes its use
Bi-temporal time states, so you can recover what was authoritative on any past date
Visual modeling for mainframes and packaged systems that no scanner can crawl
The five regulations that set the baseline: BCBS 239, the ECB Guide on risk data aggregation, DORA, the EU AI Act, and SR 26-2
The reconstruction test: what you hand an examiner who names one agent decision and one date
Most banks already run both a catalog and a lineage tool. The paper explains why reconstruction belongs to the lineage layer.
Pages
Diagrams
Regulations
Cited sources
Your BCBS 239 evidence expires the day you file it
Three criteria that make regulatory data lineage reusable
The EU AI Act deadline has moved, but data lineage can’t wait
The deadline for high-risk AI compliance under the EU AI Act may well have been pushed back.
Knowledge Models Webinar
Data context has never been more critical – or more complex. In this exclusive webinar for EDM Association members, Solidatus...
