Show Your Working: AI Governance Starts With One Number
It is the second week of the quarterly close. Someone in finance types a question into an AI assistant: what was net written premium on the property catastrophe book last quarter? A number comes back in about four seconds.
That is remarkable. Three years ago you would have waited days for an analyst to pull it together. If I were the CFO, I could get quite excited about that.
I could also get nervous. Which treaties are in that number? Is it before or after reinstatement premiums? Is it the same figure in the statutory return and the BSCR, or a close cousin of it? And when the auditor sits down and asks how the board pack was produced, can I show them how the machine got there?
That is AI governance in one question. Not a policy document, not a steering committee.
Can you show the working behind a single number?
Three things you will be asked to evidence
When a board or audit committee asks about AI, the questions tend to come down to three.
Which definition did it use? Net written premium has to mean one thing, owned by one person, everywhere it appears.
Who was allowed to ask, and what could they see? AI access should sit inside the same controls as the rest of your finance data.
Can someone check it? The person reading the answer should know it came from an AI system and be able to see what it ran.
None of these are new. They are the questions your auditors already ask about a spreadsheet. AI asks them faster and more often.
AI governance sits on top of data governance
Here is the part that gets skipped. If net written premium is calculated one way in the underwriting system, another way in the general ledger and a third way in the actuarial model, a perfect AI audit log only proves which of the three you got. You can record every prompt and every answer and still have nothing you can defend.
That is why we start every AI conversation with the semantic model: the governed layer where each measure is defined once, documented, owned, and traced back through lineage to the source system. Get that right and AI governance becomes an extension of controls you already run. Get it wrong and no AI policy will rescue it.
What changed in September
I will speak as a partner here, not for TimeXtender's marketing team. We have built on TimeXtender for our clients for five years, and the 26.3 release on 23 September moves several of these questions from policy into the product.
A number comes with its working. When Xpilot Analytics returns a single figure, a "How this was built" panel shows the SQL that produced it. For a finance team, that is the AI equivalent of a working paper.
The model does not have to improvise the joins. The MCP Server's new structured metrics tool lets the agent declare the metrics, dimensions and filters it wants; the server compiles the SQL and shows it. That is the difference between a model guessing how treaties join to claims and a model asking for a measure you already approved.
AI access goes through your identity provider. The MCP Server now authenticates with Microsoft Entra ID or Auth0 instead of shared keys. Access is tied to a named person rather than a key, so your audit trail can say who asked, provided your query logging captures it.
One set of definitions, two consumers. Xpilot Analytics answers from the same governed semantic model behind your dashboards and reports. If the AI and the board pack disagree, there is one place to look.
People are told they are talking to an AI system. TimeXtender added disclosures across Xpilot chat, rule generation and orchestration error insights, citing Article 50 of the EU AI Act. Worth checking with counsel if you have EU exposure, and a sensible default either way.
Personas are a definition decision too. Administrators can scope agent personas to a workspace, shaping the vocabulary and assumptions the agent uses for finance or actuarial. Decide which assumptions each persona may make, or you rebuild the three-definitions problem inside the AI.
Fabric is getting closer. Fabric Warehouse now has feature support on par with SQL Server as TimeXtender storage, in public preview. Worth planning around if Fabric is on your roadmap; not yet something to run a filing on.
What it does not do
A release is not a control framework. It does not decide who owns the definition of IBNR, write your model risk policy, or tell you which use case your board should approve first. It does not make you compliant with anything; confirm what your regulator expects with your own counsel. What it does is make the evidence cheaper to produce, and that is what governance work has always needed.
If you are moving to INTX
If you are moving underwriting, policy administration, reinsurance and claims onto INTX, you are already redefining your core measures once. That is the cheapest moment you will ever have to govern them for AI as well. INTX executes the transactions. Our job, as INTX's implementation partner in Bermuda, is to make sure the data that comes out of it is defined once, migrated with the history you keep and its lineage intact, and defensible when someone asks where a number came from. More on that at bespoke.bm/intx.
Three questions to ask your team this week
Can we name the owner of our five most-quoted finance measures, and is each one defined in one place?
If someone in finance used an AI tool on our data today, would we know who asked what?
Could we show an auditor the query behind an AI-produced figure in under ten minutes?
If any answer is "not sure", that is where a Governed AI Pilot starts. Four weeks, one use case your board cares about, built on a governed data product with full lineage, and a written safety case your audit committee can read.
