In the bank I worked for (and for the regulator they were responding to), one of the big pushbacks against using AI for compliance related processes was the "blackbox" effect. If no one understands _why_ the machine made the decision it did you can get into real legal problems if the action is contested by the person affected by that decision. Generally speaking any automated decisions need to be auditable which track specifically which rule was in place when the entity was processed and what decision path was taken based on this rule.

Another thing is that this kind of decision track record should also be visible to the human who will ultimately make the approve or reject decision. If for example your AI system is making a realtime employment check and flags something as problematic - the person checking that record should be able to click through the audit logs and verify that indeed the AI flagged that entry based on the March 2026 version of the ruleset and not the now-outdated January 2026 ruleset and be able to check what the differences in those rulesets are.

So yeah, the TL;DR is that regulators want to see logs.