Written by: Karol Sobieraj, Founder & CEO, Digital Colliers
A VentureBeat survey of 107 enterprises put the number at 54%. More than half have already had an AI agent security incident. And yet most finance copilots shipped into production this year still can't answer the one question an auditor will ask first: which agent touched this row, when, and on whose authority?
That gap is the whole story. A chat log is not an audit trail. It's a transcript of a conversation, not a record of what changed in the ledger. If your copilot posts a journal, adjusts an accrual, or reclassifies a vendor, the evidence trail has to live at the row level. Not in a Slack thread. Not in a vector store. In the same system of record the human accountants use.
What breaks when the auditor asks
Picture the walkthrough. External audit sits down with your controller in March. They pick a sample of journals from Q4 and ask for support. Three of them were posted by a copilot running under a service account called fin-agent-prod. The controller can produce the journal. She can produce the prompt that triggered it. What she can't produce is the chain that ties a specific human approver to a specific agent action to a specific GL row.
That's a control failure. Under DORA, which has been in force across the EU since 17 January 2025, ICT-related incident reporting and third-party risk controls now cover the AI tooling your finance team leans on. Under the EU AI Act, high-risk system obligations kick in from 2 December 2027, and Article 50 transparency duties from 2 August 2026. Penalties for high-risk violations run up to €15M or 3% of global turnover. GDPR still sits on top, at up to €20M or 4%. The regulator doesn't care that your copilot is helpful. They care whether you can reconstruct what it did.
The log model that actually holds up
A defensible audit trail for a finance copilot has four things bolted together at every write:
- Agent identity. Not the human's SSO token. The agent's own signed identity, with a version hash of the model and the prompt template.
- Authorising human. The person who approved the action, and the mechanism they approved through (a specific UI click, a signed webhook, an approved policy).
- The row. The exact ledger entry, sub-ledger row, or master data record the agent touched, with before-and-after state.
- The reasoning artifact. A pointer to the prompt, retrieved context, and model output that produced the decision. Immutable. Hash-linked to the row.
The operators shipping this well in 2026 tend to treat the copilot like any other integration. It gets a service principal. It gets least-privilege scopes. Every write goes through the same journal API a human uses, and the API is what stamps the audit record. The copilot doesn't touch the database. It proposes, a human or a policy approves, the system commits, and the commit itself carries the provenance.
Why the SOC team is already pushing back
Security teams have seen this movie. They watched RPA get shoved into finance in 2018 with shared credentials and no logging, and they spent three years cleaning it up. They're not doing it again with agents.
The pattern I keep seeing: SOC blocks the copilot from production until it can prove per-row attribution. Finance escalates. The CFO discovers that the vendor's answer to "show me the audit trail" is a screenshot of a chat window. The project stalls. This is one of the quieter reasons about 95% of enterprise AI projects never reach production or ROI. It's not model quality. It's that the governance surface was an afterthought and the security review killed it in week eleven.
The cost of waiting
Doing nothing has a price, and it compounds. Every month you run a copilot without row-level provenance, you're accumulating journals you can't defend. If the auditor pulls a sample from that period next year, you're re-doing the work by hand. If a regulator opens an inquiry, you're reconstructing intent from chat logs. If a control failure lands in your SOC 1 or ISAE 3402 report, the remediation cost dwarfs whatever you would have spent building the log model correctly the first time.
The finance copilots that survive contact with audit in 2026 will be the ones designed, from day one, so that every write is signed, scoped, and reversible. The ones that don't will get quietly rolled back, and the team will pretend the pilot never happened.