Replaced manual document review with AI classification and extraction, documented so the tool supported human decisions rather than driving model risk under SR 11-7.
The situation
A financial services firm was reviewing documents manually. Introducing AI into that path raised a governance question before an engineering one: whether the tool would be treated as a model under SR 11-7, and what documentation would be needed either way.
Frameworks that constrained the build
SOC 2 Type IIGLBAFFIECSR 11-7
What we built
AI-powered document classification and extraction replacing manual review
Model documentation structured to demonstrate the tool supported human decisions rather than driving model risk under SR 11-7
Controls and evidence aligned to the firm’s existing SOC 2 programme
Systems and stack
Document classification and extraction pipelineModel documentation package
Outcome
The implementation passed internal compliance review and came through an external SOC 2 audit cycle.
Client names are withheld where engagement agreements require it. Details described here are limited to what those agreements permit us to publish.