AI Process Assurance compares the expected workflow with what actually happened. It's how a regulated firm puts AI to work with evidence behind it - and how a board gets to say yes. We do it for insurance, financial services and other regulated industries.
AI Process Assurance is Airclerk's approach to governing AI-assisted work: compare the path it was supposed to follow with the path it actually followed. Airclerk defines the expected path with a Workflow Charter, records what actually happened inside those instrumented workflows with a Semantic Audit, and shows the difference. The retained result is an AI Workpaper: a business-readable evidence record for every material decision.
The unit we assure is a material AI-assisted decision: a recommendation, action, communication, approval or outcome that a regulated team may later have to explain. The workpaper is the thing that explains it.
One commercial renewal, from the assistant's first draft of terms to the terms going out. The rows are what a reviewer reads; the flagged rows are where the control did its job.
Illustrative example
An illustration of the format. Not a client record.
Boards are holding both halves of this at once: the pressure to put AI to work, and the accountability if it goes wrong. Those two don't cancel out. They get delegated, as a brief that reads “make this safe so we can proceed.”
Platform logs, chat history and technical traces are useful, but they don't naturally produce a business-readable record of the work. Airclerk's answer is a retained AI Workpaper showing what happened, why it happened, what evidence supported it, what controls applied, and who approved the outcome.
A board can't resolve that tension itself, and it can't write the controls. What it can do is demand that AI-assisted work leaves a record it could inspect, and that exceptions surface before they become incidents.
In practice that demand gets delegated. At an insurer the brief usually lands with the CRO; at a larger firm it may sit with the CISO, at a smaller one with the CFO or a managing partner. The title changes, but the brief doesn't: make AI safe enough to say yes to. AI Process Assurance is the control you stand up to answer that brief, and the workpaper is what you report back up with.
When a regulator, auditor, insurer, board or dispute reviewer asks about an AI-assisted decision, these are the questions on the table. For the work that runs through it, a workpaper answers all of them without anyone reconstructing the story after the fact.
These aren't hypothetical. Regulators in every market Airclerk serves have already put versions of them in writing.
Under CoFI, in force since 31 March 2025, a licensed institution's fair conduct programme must be in writing - effective policies, processes, systems and controls, with methods for regularly reviewing whether the programme is working. The Contracts of Insurance Act 2024 adds an implied term to pay claims within a reasonable time; commencement is by Order in Council, with a backstop of 15 November 2027.
CPS 230 has applied since 1 July 2025: the board is ultimately accountable for oversight of operational risk management, and controls must be monitored, reviewed and tested for design and operating effectiveness, with results reported to senior management. APRA's April 2026 letter to industry applies that framework directly to AI - it expects an inventory of AI use cases and continuous monitoring for control breakdowns.
Under the NAIC's model bulletin on insurers' use of AI - adopted in 24 states plus D.C. as at mid-2026 - an insurer in a market conduct exam can expect to be asked about its development, deployment and use of AI systems. NYDFS Circular Letter No. 7 (2024) tells insurers writing in New York to maintain comprehensive documentation of AI used in underwriting and pricing, available to the Department on request.
Deployers of high-risk AI systems must keep the automatically generated logs under their control for at least six months - longer where other law requires it (Article 26(6)), applying from 2 December 2027 under the 2026 Digital Omnibus. In insurance, high-risk means risk assessment and pricing of life and health cover for natural persons; consumer credit scoring is also captured.
Much of this is supervisory expectation rather than statute, the detail varies by jurisdiction and line of business, and none of it is legal advice. What the regimes share is the assumption underneath: when someone asks, you can show whether your controls operated. The workpaper is built to be that answer.
Two records, one comparison. A Workflow Charter says what should happen. A Semantic Audit records what did. The gap between them is where governance, compliance and operational control actually live.
The required stages, evidence, authority limits and approval gates for a repeatable process - plus the persistent memory that keeps an AI assistant on that path across sessions.
A business-readable record of what actually happened, captured as the assistant works: the steps taken, the evidence used, the decisions made and the approvals recorded.
When the actual path diverges from the charter - a required approval missing, evidence not attached, a step skipped, a gate bypassed - Airclerk flags an exception. That is the moment an audit trail becomes operational control.
A charter carries guardrails on the data the work may touch and on the steps it must follow. You set each one to a level that matches the risk it addresses, not a one-size rule for the whole workflow.
Work holds until a named person signs off. The hold and its outcome land on the workpaper, along with who reviewed it.
Work continues; the right person is told and reviews alongside. The notification and its outcome are retained.
Work continues; the event is written to the audit record. Fits low-risk steps, and new workflows you're still calibrating.
A new workflow's guardrails might all start at Log Only, then tighten to Require Approval where the exposure turns out to be real. Whatever the level, the trigger is retained on the workpaper, so dialling a control down never means losing the record.
Two different things happen when a guardrail trips, and the difference matters to whoever reads the record later.
A hold at a Require Approval gate stops the step. In the example above, the terms sat unsent until a named person signed off. The step cannot continue inside the instrumented workflow until that happens.
At Notify & Review and Log Only, work continues and the exception is surfaced on the workpaper for review after the fact: a missing citation, a skipped step, a criterion not met. Someone still has to read it and act.
Neither level catches a person who deliberately goes around the workflow. That is a control the firm owns; see the boundary below.
The platform runs the whole path from finding a use case to proving what it did. It is deterministic, and it holds the record. The AI assistants your people use, Claude, Microsoft Copilot or ChatGPT, reach it through the tools it exposes.
Find the work worth doing. Onboarding and use-case discovery run as guided journeys, so the people who do the work surface the candidates rather than a consultant guessing at them.
Sort the candidates. Nominated reviewers select, merge and vote on use cases, so what reaches governance has already been through the people who understand it.
Decide before it runs. Governance approves a use case before anything is built or used. The vendor register lists the explicit rejections too, so the answer to "did anyone look at this" is on the record either way.
Turn approval into a guardrailed skill. The skills builder turns approved use cases into skills with the controls built in, starting from the domain packs rather than a blank page. This is where the Workflow Charter, the expected path, is set.
Show what happened. A tamper-evident audit trail, the Semantic Audit, compiles into evidence packs: the AI Workpapers a reviewer, auditor or regulator reads. What Prove finds feeds back into Build, so a skill tightens as the evidence shows where it should.
The subscription covers all five. A workflow does not have to use every stage on day one: a firm can start by recording what its existing AI use does in Prove, then bring use cases through Discover, Evaluate and Approve as governance catches up.
Defines what should happen, and remembers it
Records what actually happened, in business language
The retained record you actually keep - and the thing you hand to a reviewer, an auditor or a regulator. Business-readable, not a technical log.
Comparing expected against actual turns a passive record into something that surfaces configured exceptions automatically.
Airclerk doesn't only keep the clean story. It preserves missing approvals, skipped steps, unmet criteria and unresolved evidence gaps, so a reviewer can see what actually happened and how it was resolved.
The charter required human sign-off before a client-facing communication. The audit shows none was recorded. Airclerk flags it.
A claim decision required a policy-wording citation. The decision was drafted without one. The gap is visible, not buried.
A required claims-history review never ran before the renewal recommendation. The workflow moved on anyway - and that shows.
Work transitioned past an approval gate despite unmet criteria. Where that's visible in the instrumented workflow, it's flagged as an exception on the workpaper.
A workpaper is only useful if the people who need it can read it without a data team. These are the readers it's written for.
A procurement or risk team usually wants this drawn before anything else. The workflow is yours, the software is ours, and the service is a contract between us.
Yours. The process, its stages, evidence requirements and approval gates are your firm's, written into a Workflow Charter with your people. Your documents and systems stay the systems of record. When you change the process, the charter changes with it.
Ours, running for you. The five modules, Discover through Prove, and the store the workpapers live in. Hosted by Airclerk with per-tenant isolation, or deployed single-tenant into your own Azure tenant on request. Coverage is per instrumented workflow: it records the work that runs through the workflows and tools we connect, and does not claim to see AI use outside them.
Two parts. Designing the charter, instrumenting the workflow, connecting it to your systems and taking it into production is the implementation project, quoted as a fixed fee with handover written into its scope. The software itself is a subscription for as long as you run it, covering hosting, updates and the support level you choose. Further workflows are scoped separately. Our implementation services are also available without the platform.
Yours to keep. The AI Workpapers produced from your workflows belong to your firm. They are retained and exportable, so a reviewer, an auditor or a successor system can have them without needing us in the room. Raw workflow data and source documents can stay inside your environment throughout.
A defensible record is one that's honest about its own edges. Here are ours.
What we record. The work that runs through Airclerk-connected workflows and tools, captured as the assistant works. Calls to Airclerk tools are recorded directly; other approved tool use is captured where it runs through the instrumented workflow, with reconciliation against platform traces where available.
What we don't claim. We don't pretend to capture work a person does entirely outside the workflow - copying an answer into a document and editing it by hand, or deliberately going around the rails. That's a control you own. Reconciliation against platform traces can narrow the gap over time.
Copilot arrived with Microsoft 365. Claude or ChatGPT may be doing the analytical work. The core systems are shipping their own embedded AI, and agents are next. That can leave a separate technical record around each platform - and the person accountable for the process still has to assemble a business-readable account by hand.
Airclerk sits at the tool layer, not inside any one platform. Within an instrumented workflow it records material actions, evidence references, approvals and workflow state in one workpaper, whichever assistant ran the work. That gives the person asked to make AI safe one control surface, and the board one answer.
The boundary above still holds: coverage is per instrumented workflow, not a tap on everything AI-shaped in the firm. A workflow you haven't instrumented isn't covered. That's a scoping decision you make, workflow by workflow.
Airclerk can be hosted by us with per-tenant isolation, or deployed single-tenant into your own Azure tenant on request. Raw workflow data and source documents can stay inside your environment; Airclerk holds the configured evidence record, workflow state and control comparison. Full security posture on the Trust page.
Source systems, documents, approvals and raw workflow data stay inside the environment your team already governs, where that's required.
Airclerk holds the Workflow Charter, the workflow state and the expected-vs-actual comparison.
The AI Workpaper gives a reviewer a retained, business-readable record of the decision.
Airclerk doesn't decide compliance, liability or suitability. People do. The workpaper is what they read to decide.
You don't need a defined process to begin. Most teams don't have one - their people are already using AI ad-hoc, and that's where the exposure hides. You can't govern what you can't see, so you start by seeing it.
Find where ad-hoc AI is already influencing regulated decisions, handoffs and client outcomes - and rank the patterns that deserve evidence capture or formal governance first.
Retained, business-readable AI Workpapers for the material uses you designate. Enough to evidence what happened, though not to certify the work followed an approved path. No Workflow Charter needed at this tier; the record runs on its own.
For the recurring, material workflows you found, define the expected path - and the exception comparison switches on. This is the one tier that needs a Workflow Charter.
If you need to understand existing AI use before choosing a workflow, we can scope an AI Evidence Readiness Assessment: a paid, fixed-scope look at your real AI use that maps the work, produces sample workpapers on your own material cases, and hands back the first workflows worth governing. It preserves evidence and shows the gaps; it does not certify that work followed an approved path, because without a charter there is nothing to compare against. Fee quoted after a free introductory conversation. Talk to us →
We start narrow: take one high-value workflow and make it a governed, evidenced workflow you can defend.
A free introductory conversation gives us enough to quote the implementation fee, the timeline and the subscription in writing, and the scope is agreed before anything starts. The engagement opens with design: we map your systems and define the charter and controls for the first workflow.
We charter the workflow, instrument the Semantic Audit, wire approvals and evidence, and stand up the workpaper - connected to your systems and your AI environment.
Turn on the control comparison: missing steps, missing approvals and unmet criteria surface as exceptions, and every run leaves a retained workpaper.
A way of governing AI-assisted work by comparing the path it was supposed to follow with the path it actually followed. Airclerk defines the expected path (Workflow Charter), records what actually happened (Semantic Audit), and shows the difference - producing a retained, business-readable AI Workpaper for every material decision run through it.
AI governance sets the rules and accountabilities around AI, and model-risk tooling focuses on how the model behaves. AI Process Assurance starts with the work: did it follow the required path, with the right evidence and approvals. It's the operational record of what happened.
No. The subscription covers the whole platform, Discover, Evaluate, Approve, Build and Prove, and you choose how much of it each workflow uses. Many firms start in Prove, recording what their existing AI use does, and bring use cases through Discover, Evaluate and Approve as governance catches up. The control comparison, expected against actual, is what you get once a workflow has been through Build and runs with Prove switched on.
Airclerk records the work that runs through its instrumented workflows and tools, as the assistant works. It does not claim to capture work a person does entirely outside those workflows, such as copying an answer into a document and editing it by hand. That boundary is deliberate; deliberate human circumvention is a customer-side control, not something Airclerk pretends to catch.
Airclerk implements Claude, Microsoft Copilot and ChatGPT, and the architecture isn't tied to any of them: it connects at the tool layer rather than living inside any one platform. The AI client decides which tools to call; Airclerk records the evidence, state and control around them. The same workpaper comes out of an instrumented workflow, whichever assistant runs it.
Hosted by Airclerk with per-tenant isolation, or single-tenant in your own Azure tenant on request. Raw workflow data and source documents can remain inside your environment. See the Trust page for the full security posture.
If you're putting AI to work on material decisions and the evidence has become the limiting factor, this is the conversation.