Regulated AI fails its first audit at the retrieval layer, not the model.
A working argument for designing the audit trail before the prompt.
Regulated-AI projects budget risk in the wrong place. The model gets the scrutiny: which vendor, which eval, which guardrail. The part that actually fails the audit ships as an afterthought, and it is this: can a given output be reconstructed, six months later, from the inputs that produced it. In a regulated workload that reconstruction is not a nice-to-have. It is the deliverable.
Audits fail at three seams, and they are always the same three. Prompt provenance: which exact prompt, template version, and system context produced this output? Retrieval lineage: which documents were retrieved, at which versions, and why those and not others? Output attestation: can you prove the answer came from the retrieved evidence instead of the model's parametric memory? A stack that can't answer all three under examination is undocumented, whatever the vendor deck says.
A better model closes none of those seams. A larger context window makes provenance harder: more of the input becomes implicit. More agent autonomy makes lineage harder: the path from question to answer stops being inspectable. Everything the field optimizes for trades against auditability, so audit-trail design can't be retrofitted onto a system optimized for the opposite. It has to be a constraint from the first diagram.
The shape that survives an audit is a three-plane topology. A data plane carries the primary flow: ingest, retrieve, infer. A control plane holds orchestration, agent state, and configuration as versioned objects. A compliance plane runs alongside as a sidecar: an append-only ledger that taps the other two and records signed, hash-chained events. It never sits inline in the data path. The auditor reads the compliance plane and nothing else. Designing it last means designing the system to lie to itself about what happened.
Concretely: a tax-filing agent runs as a typed-tool loop with a fixed turn ceiling, because an unbounded agent has no audit ceiling. Retrieval is scoped per filing period and the router rejects cross-period hits. Every emitted number is forced to cite, then re-validated against its source span before it lands in the return: attestation enforced at write time is cheap, attestation proven after the fact is archaeology. Built this way the agent has no path to emit an unsourced figure. The model never gets trusted with arithmetic, and it never needs to be.
The discipline transfers. LGPD, BCB 4.893, and the EU AI Act Art. 12 logging mandate all ask the same question in different words: show me how this decision was made, and prove the record wasn't edited after. The systems that answer cleanly are the ones where someone drew the compliance plane before they wrote the first prompt.