Why the existing discipline does not cover this
Model risk management practice assumes a model with a specification, a development record and a validation function that is organisationally separate from development. A Text-to-SQL agent has a system prompt, a semantic layer and a foundation model that changes under it — and its “validation” is usually a suite written by the team that built it. The independence requirement that is standard for a credit model is, for the agent answering questions about that portfolio, typically absent.
The defects that cost the most here
- Join fan-out on position or transaction tables — exposure inflates, the number is plausible, and it reconciles against nothing because it is a new question.
- SCD-2 temporal boundary errors — a point-in-time question silently answered with current-row data. The single most dangerous family for anything backward-looking.
- Row access policy leakage — machine-authored SQL taking a path that returns rows the invoking identity could not have selected directly. An entitlements failure, not an analytics one.
- Definition drift — the agent’s reading of a metric diverging from the one the regulator was told about.
What the evidence gives you
A signed bundle with a commitment hash pinning the agent configuration, semantic layer and model version on the date tested, findings classified by consequence, and explicit accounting of everything that could not be verified. Mapped to NIST AI 100-1, NIST AI 600-1 and ISO/IEC 42001 so it can sit inside the governance framework you already run. Mapping · Evidence modes
Data handling
The default evidence mode keeps every raw query, result row and prompt inside your perimeter; only hashes, status, counts, latency and the signed manifest cross the boundary. For regulated schemas where even sanitised export is unacceptable, customer-hosted VDI review is the third mode. Data classification matrix.
Regulatory position
We produce technical evidence, not a compliance determination — your second line and your counsel make that call. On the EU AI Act: Annex III high-risk obligations deferred to 2 December 2027, Annex I to 2 August 2028, Article 50 transparency live from 2 August 2026. claim: external verification required
Further reading in the curriculum: AI evaluation in financial services and a financial services governance case study.