Glass-Box or No Box: Why Auditable AI Is the Only AI an Institution Can Deploy

The regulators got there before the vendors did

In March 2024, the U.S. Securities and Exchange Commission settled charges against two investment advisers for making false and misleading statements about their use of artificial intelligence — the enforcement pattern the industry now calls "AI-washing." The message was not subtle: claims about AI in the investment process are securities-law statements, and a firm had better be able to substantiate what its models actually do.

Substantiation is a records problem. The recordkeeping baseline for broker-dealers, SEC Rule 17a-4, requires electronic records to be preserved in a non-rewriteable, non-erasable format or — since the 2022 amendments — under an audit-trail alternative that can reconstruct an original record after any modification. FINRA Rule 4511 layers the general books-and-records obligation on top. (VegaTrade is not a broker-dealer; these rules matter here because they define the evidentiary standard institutions and their counsel already expect from trading records.) Neither rule says a word about machine learning, and that is precisely the point: when an AI system participates in a regulated workflow, its decisions become records like any others. If you cannot produce them — complete, unaltered, attributable — the fact that a model made the decision is not a defense. It is the problem.

Now run the thought experiment every operational-due-diligence team is already running. An allocator asks a fund: "On the day your AI cut net exposure, what did it know, what did it conclude, and who approved the change?" A firm running black-box AI answers with a policy document and a shrug. A firm running auditable AI answers with a database query.

What "auditable AI" has to mean — concretely

The phrase is easy to wave at. Here is the standard we hold ourselves to at VegaTrade, stated so it can be checked rather than admired. Auditable AI means four properties, all of them structural:

1. Capture at the moment of decision, not at reporting time. Every AI inference emits a record before the answer exists — prompt context, model identifier, sampling temperature, a cryptographic hash of the canonical inputs — and a paired record when it completes: the output, the reasoning, and a reproducibility-class discriminator that says honestly whether this inference can be re-run bit-for-bit or only re-derived. Records assembled after the fact are reconstructions; records captured at decision time are evidence.

2. Tamper-evidence by construction. Decision records belong in an append-only, hash-chained store — each row linked to the last, the chain root signed daily in a hardware security module, segments archived to write-once storage with multi-year retention. This is the same architectural shape the 17a-4 audit-trail alternative gestures at, applied to AI decisions as a first-class record type. A chain either verifies or it does not; there is no "trust our logging."

3. Replayability. The test of an audit record is whether a reviewer can reconstruct the decision from the record alone — years later, on cold storage, byte-identical. If your platform's answer to "show me" involves a data engineer, three log systems, and a week, you do not have auditable AI; you have telemetry.

4. Supervised authority. The model proposes; a human approves; both facts are chained. AI-authored strategy changes should be bounded parameterizations inside a constrained grammar — never free-form code — landing in an approval queue where a named operator accepts or rejects, and where the approval itself is an audit event. An AI that can expand its own authority is an audit finding waiting to be written.

Why black-box AI fails diligence even when it works

The black-box objection is usually framed as a performance debate. It is not one. A black-box system can be profitable and still be undeployable for an institution, because the institution's obligations run through questions the black box cannot answer:

Attribution — when the regulator or the risk committee asks who decided, "the model" is not a name. Reproducibility — when the same inputs cannot be shown to produce the same decision, every backtest becomes unfalsifiable and every incident review becomes archaeology. Boundary integrity — when the AI's outputs flow into execution without a deterministic gate between them, a model error is a trading error at market speed. The literature on quantitative self-deception is blunt about how easy it is to fool yourself with an unaccountable pipeline: see Bailey and López de Prado on the deflated Sharpe ratio and the probability of backtest overfitting — both of which we encode as hard validation gates, not as reading-group material.

This is also why we keep the model categorically away from the order path. In our two-loop architecture, large-language-model reasoners — Anthropic's Claude and Google's Gemini, behind a pluggable provider layer — work in a Python slow loop at seconds-to-minutes cadence, producing structured, signed signals. Execution lives in a deterministic C++ hot path that enforces position limits, drawdown stops, rate caps, and a kill switch before any order can reach a broker. No model call happens on the order path, ever. The AI can be brilliant or wrong at leisure; the execution boundary is deterministic either way.

The tax ledger is part of the audit story

One more thing institutions learn the hard way: the audit trail that matters in April is the tax ledger. Lot-level accounting, wash-sale handling under IRS Publication 550's §1091 rules, Form 8949 generation, and 1099-B reconciliation are recordkeeping problems with the same shape as decision capture — provenance, attribution, reconstructibility — and they deserve the same architectural seriousness. A platform that chains every AI decision but shrugs at which tax lot a disposition consumed has only learned half the lesson. (We built the tax ledger into the platform core, with every lot election audit-attributed.)

What it looks like when it's real

Here is the practical difference, on screen. Every AI decision in the VegaTrade console is a row: the action, the exact model identifier that produced it, a reproducibility-class badge, the confidence, the sizing — and a reasoning trace one click away, backed by the chained record described above.

The diligence flip

The institutions winning the AI transition are not the ones with the most exotic models. They are the ones for whom "we use AI" survives a hostile read — from an allocator's ODD team, from a procurement security review, from a regulator with a document request. Build (or buy) AI infrastructure where supervision, capture, tamper-evidence, and replay are properties of the architecture, and that hostile read becomes your best meeting: you stop defending the technology and start demonstrating it.

That is the bet behind VegaTrade. If your fund, desk, or family office is evaluating AI trading infrastructure, bring us the hardest version of the question — we built the platform to be asked.

VegaTrade is a pre-launch technology platform. This essay discusses recordkeeping and system architecture; it is not legal, tax, or investment advice, and nothing here is an offer of securities or a promise of any trading outcome.