Financial software lives under audit. SOC 2, PCI-DSS, internal model governance — each assumes that every change has a traceable rationale and an accountable author. AI code generation complicates both at once.
What Auditors Actually Check
Auditors rarely read your code line by line. They check that controls exist, that changes are reviewed, and that the evidence chain is intact. The risk with AI generation is not bad code — it is an evidence chain that no longer reflects who decided what, and why.
Keeping the Chain Intact
- Treat the architectural model as the authority; AI generates against it, not around it.
- Capture the decision, not just the diff — an ADR per consequential change.
- Derive control evidence from the model so it cannot drift from the implementation.
The auditor's question is never ‘did a human write this line’ — it is ‘can you show the rationale and the control.’ Structure answers both.
With the architecture as the source of truth, AI velocity and audit readiness stop being in tension. The faster the AI generates, the more code conforms to the controlled structure.