Keeping people in control: AI in regulated industries

For banks, investment firms, energy companies and manufacturers, the question about AI is rarely 'can it do the work?' It is 'can we stand behind the work it does?' Regulators, auditors, boards and customers all expect someone to be accountable. That someone has to be a person.

Keeping people in control is not a single feature. It is a set of practical design choices, made from the start. Here are the ones that matter most.

Approval gates

An approval gate is a point in a workflow where the system stops and waits for a person to say yes before it continues. The AI can prepare the work, gather the evidence and recommend an action, but nothing with real consequences happens until someone with the right authority approves it.

The key is putting gates in the right places. Too few, and you carry unnecessary risk. Too many, and people start approving without reading. A good design places gates at the decisions that matter, such as moving money, changing a record or sending something to a customer, and lets routine steps flow.

The AI can prepare the work. A person decides whether it happens.

Audit trails

An audit trail is a complete, time-stamped record of what happened. For an AI system, that means recording what information it was given, what it recommended, who reviewed it, what they decided and when.

This serves two purposes. It lets you answer questions from auditors and regulators with evidence rather than recollection. And it lets you look back at decisions to see where the system and your experts agreed or disagreed, which is how the system gets better.

Explainability

Explainability simply means the system can show why it reached a recommendation. In practice, the most useful form is not a technical description of the model. It is a plain account a reviewer can check: these were the documents used, these were the relevant rules, this is the reasoning, and here is what was uncertain.

If a reviewer cannot see why the system suggested something, they cannot approve it responsibly. Good explanations make approval faster and safer at the same time.

Data that stays in your environment

Many organisations cannot send sensitive information to outside services, whether for regulatory, contractual or simple risk reasons. The answer is to bring the AI to the data, rather than the data to the AI.

That means deploying the system in your own cloud account or on your own servers, using your existing access controls, and keeping data within the boundaries your security team already manages. It should be designed this way from the first day, not retrofitted after a pilot.

Rollback

Rollback is the ability to undo. If a new version of the system behaves unexpectedly, you should be able to return to the previous version quickly. If the system has taken an action that turns out to be wrong, there should be a clear path to reverse it.

Planning for rollback also forces a useful discipline. If an action cannot be reversed, that is a strong signal it needs a person's approval first.

Evaluation by your own experts

The final control is the most important. The people best placed to judge whether an AI system is doing good work are the people who do that work today. Not the vendor, and not a generic benchmark.

In practice, this means:

• agreeing with your experts, in advance, what a good outcome looks like;
• testing the system on real cases from your own workflow;
• having experts review outputs and record where they disagree and why;
• continuing that review after launch, because work and rules change over time.

How Sort AI builds in control

These controls are part of how we work, not optional extras. Our forward deployed engineers embed with your teams, build approval gates and audit trails into the system from the start, and deploy it in your cloud or on-premise. We are SOC 2 Type II and ISO 27001 certified.

We prove each system in production on one queue first, evaluated by your experts, and we stay after launch to keep improving it. People approve anything that matters. That is what lets regulated organisations use AI with confidence.