AI Governance Audit Trail: UK Firms Lead, Lack Proof

Arctera, a data compliance and archiving vendor, said 89% of UK organizations require human sign-off for high-risk AI communications, against 79% worldwide, yet 80% begin investigations without the full data they need. The gap leaves many firms without a complete AI governance audit trail.

The findings come from State of AI Governance 2026, a Hanover Research survey commissioned by Arctera, and its UK cut, “The UK Perspective”. UK respondents reported higher adoption than the global average on every control measured.

For compliance teams at UK banks and large companies, the question is no longer whether a policy exists. It is whether the firm can show a regulator, auditor or investigator how an AI-assisted decision or message came about, step by step, when it is challenged.

The AI governance audit trail gap in UK firms

Arctera compared UK and global respondents on five controls. The UK led on each.

Human sign-off for high-risk AI communications: 89% in the UK, 79% globally.
Staff training on compliant AI use: 85% against 77%.
A formal AI usage policy: 83% against 80%.
Tracking or logging of AI prompts and outputs: 77% against 65%.
Routine audits of AI tools and outputs: 70% against 63%.

The lead is widest on prompt and output logging, at 12 percentage points, and narrowest on formal policy, at 3 points.

Arctera said controls address only half the problem. Firms must also give regulators, auditors, legal teams and internal investigators proof that the safeguards worked once an audit, probe or dispute begins.

That proof is hard to assemble. Records generated by AI controls often sit across separate platforms, departments and channels, and 40% of UK respondents named linking communications across formats and channels as a significant obstacle.

Messaging apps and the reconstruction challenge

Arctera calls the difficulty of retracing every step behind a disputed AI-assisted communication, decision or record the “reconstruction challenge”. For many firms it means manual work to stitch together AI activity, reviews, approvals, edits and the conversations that shaped an outcome.

Monitoring is weakest where staff use personal channels. Some 73% of UK firms described their monitoring of consumer messaging apps as partial or absent. The figures were 59% for personal phone calls and 27% for text messages.

The effect shows in investigations. A third of UK organizations spend more than half their investigation time collecting and reconciling material before analysis starts.

“But controls alone are not enough. When scrutiny comes knocking, organisations need to be able to connect the evidence and show quickly and confidently what happened from beginning to end.”

Soniya Bopache, SVP and General Manager, Arctera

Bopache said UK organizations are moving beyond setting rules for AI use and putting governance into practice through training, human review, prompt and output logging, retention and auditing. In the global release she said policies, training and human review “remain essential, but they are no longer enough on their own.”

How the study measured AI governance and its limits

Hanover Research ran the survey online in May 2026 using a pre-vetted industry panel. The global sample is 500 full-time professionals across the Americas and EMEA, and the UK sample is 100 of them.

All respondents are compliance decision-makers or influencers in finance, healthcare, and energy and utilities. Their organizations employ at least 500 people and generate $50 million or more in annual revenue.

Arctera said the results are unweighted and directional. It applied no conventional margin of error because the sample is nonprobability.

Two points follow for readers weighing the headline. “Outpacing global peers” is a comparison of the share of respondents reporting each control, not an assessment of control quality. The global figures also include the 100 UK respondents.

The sector mix matters as well, because a UK sample that spans three industries is not a view of banks alone. The study reports what respondents said their firms do. It does not test whether the logs are complete.

The global study adds a contrast. It found 55% of organizations have core AI policies, training and review steps, but only 19% have the logging, retention, detection and scoring controls needed to prove what happened. It also found 71% of AI users feel very or extremely prepared to produce a defensible audit trail for AI governance.

What regulators expect from an AI governance audit trail

The UK has no single AI statute. Expectations come from existing rules, and each one rests on records.

The FCA has said it relies on its existing framework for AI rather than writing AI-specific rules. Its observations on AI good and poor practice cover governance and third-party use. Adoption is already wide: the Bank of England and FCA survey showed a surge in generative AI use in UK finance.

Under the Senior Managers and Certification Regime (SM&CR), named senior managers are accountable for their business areas, including systems that use AI. A senior manager asked to explain an AI-assisted outcome needs records that show who reviewed what, and when.

FCA record-keeping rules in its SYSC sourcebook require firms to keep adequate records of their business. For MiFID business they also require firms to record and retain relevant telephone and electronic communications. A message drafted with AI and sent over an unmonitored channel is the kind of gap the Arctera figures describe.

UK GDPR automated decision rules raise the evidence bar

The Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with new Articles 22A to 22D, which took effect in February 2026. Section 80 of the Act, published on legislation.gov.uk, sets out the text.

A decision is “based solely on automated processing” when there is no meaningful human involvement. It is “significant” if it has a legal or similarly significant effect on the person.

For those decisions, Article 22C requires safeguards. The person must be able to get information about the decision, make representations, obtain human intervention and contest it. Rules on automated decision-making therefore turn on what a firm can show about the human role, which a log of reviews and approvals can evidence.

Human sign-off at 89% of UK firms matters here only if it is recorded. A review that leaves no trace does not show meaningful human involvement.

Next steps for an AI governance audit trail

Boards receiving AI reports can ask whether the evidence behind them could be produced for a regulator on request. RegTech Post’s AI governance and board report template pack sets out one format for that reporting.

Arctera sells archiving and compliance software, so its framing favors retention and cross-channel search. The Hanover figures stand as a directional benchmark of what UK compliance staff said about their firms in May 2026.

The full UK report is available from Arctera. The company’s global study is the benchmark against which it measures the UK results.