The Reconstruction Problem
Your AI governance program is probably fine. That isn't what they're going to ask for.
12
states already running an examiner questionnaire that asks, for every high-risk model: who validated it, when you last tested it, and whether any action has been taken against you for using it. (NAIC AI Systems Evaluation Tool pilot, running to September 2026.)
~24
states now expecting documentation sufficient for a regulator to reconstruct a specific consumer-facing decision — not your governance framework. (NAIC Model Bulletin adoption.)
~6%
of claim payments leak out before anyone asks a compliance question, with inconsistent decisions named among the causes. (Industry benchmark; estimates range from ~3% upward.)
Two of those numbers are about defending a decision. The third is about paying for it. This paper is about the record that does both.
When a regulator, an auditor, or opposing counsel asks about a decision, they don't want your framework. They want to know what the model produced, who decided, whether that person was qualified — and whether you can prove any of it after the fact.
Most organisations can answer the first question. This paper is about the other three.
What's inside
01The reconstruction test — the six things a decision file has to produce, on demand.
02Ten decisions someone will eventually ask you to reconstruct.
03Why an internal log isn't evidence — and what evidence law already says about it.
04The precedent your industry already accepts, from another line of business.
05The four properties a defensible decision record has to have.