The White House AI Accord Sets an Audit Standard That Only Provable Decisions Can Meet

On September 29, six of the leading AI companies (Google, Anthropic, Meta, OpenAI, xAI and Nvidia) signed the White House Accord on Super Intelligence. 

In it, every company "training and deploying frontier models" commits to four layers of control, each with a clear job:

The accord addresses only the companies that build frontier models, and it adds that "over time, it may make sense to codify these steps into laws or regulations." 

While operators such as banks, insurers and shared-services centers are not named, they should prepare anyway.

There is a clear precedent for requirements like these traveling, because auditors check the work wherever it is done: when a company hands part of its work to someone else, the auditor asks that provider to prove its controls too.

Sarbanes-Oxley is the best-known example. After the act put US companies' financial controls under audit in 2002, providers that ran payroll, claims administration or transaction processing for them had to produce their own audit reports, known today as SOC 1, which the AICPA describes as "specifically intended to meet the needs of entities that use service organizations."

We expect the accord to set the same chain in motion for AI

Once model makers are audited, their enterprise customers' boards, auditors and supervisors will ask the same questions of every automated decision built on those models, and of every automation vendor that runs one.

In Europe the obligation already exists for banks and insurers:

DORA requires contracts for ICT services that support critical or important functions to include "unrestricted rights of access, inspection and audit by the financial entity" (Article 30).

Lawyers at Alston & Bird already advise that companies buying AI tools "should anticipate the Accord's stated controls to appear in security questionnaires, vendor diligence processes, and contract terms."

When an auditor cannot retrace how an automated decision was made, that decision either goes to a person for review or goes out unexplained. Both outcomes are costly: the first gives back the savings automation was meant to deliver, and the second leaves the business carrying decisions it cannot defend to an auditor, a supervisor or a customer.

Auditors will test every automated decision against four criteria

Each layer of the accord exists to answer one question about the system it governs: is a defined control applied, can the company's own people check it, can someone independent verify it, and can failures be found and fixed?

Ask those same questions of a single automated decision, whether it settles a claim, sets a credit limit or releases a supplier payment, and you get four criteria an auditor can test.

The figure below compares the two ways such a decision is made today: probabilistically by an AI model or a person interpreting the policy, or deterministically by logic encoded from it.

Decisions made by interpretation struggle on these criteria. A handler can read the same case differently on different days, and much of today's AI automation hands that interpretation to a language model.

COSO (the Committee of Sponsoring Organizations of the Treadway Commission), whose Internal Control framework is the one most widely used for Sarbanes-Oxley reporting, explains why that fails for AI.

Its February 2026 guidance on generative AI states that "GenAI is probabilistic, not deterministic": a language model produces its answer by sampling from a probability distribution, so the same case can come back with a different answer.

COSO's advice is that controls "should treat outputs as claims requiring validation." Logging prompts and outputs records what the model said, while the auditor is testing whether the decision applied the right clause.

Having a person review every case passes the audit, because the person becomes the control, and it removes most of the value of automating the decision. 

Any decision that no one outside the model can retrace ends up back with a person to review, which is the very work automation was meant to remove.

The five capabilities every auditable decision needs

Meeting the four criteria comes down to five capabilities, one for each stage a decision passes through, from the policy it starts with to the correction it may need later.

Ask any vendor, or your own team, to demonstrate each one on a single decision type using closed cases before anything goes live.

1. Formalized policy. Contracts, policies and SOPs are converted into decision logic that the company's people can read and the system executes, versioned like any controlled document. This is what makes a decision governed by written policy (criterion 1).
2. Deterministic decisions. The logic makes the decision, not the model, so the same inputs follow the same path to the same outcome. This is what lets an independent party re-perform it (criterion 3).
3. Routing by confidence. When the documents or data cannot satisfy a condition, the case goes to a person with the context to decide, instead of the system guessing. COSO recommends the same practice, confidence thresholds with human review below them (criterion 1).
4. A decision record that cites its clause. Every decision stores its inputs, the version of the logic in force and the clause that drove the outcome, so it is proven rather than asserted. This gives the company's own team full visibility (criterion 2).
5. Controlled change. A correction is made once in the logic, reviewed and versioned, and applies to every case from then on. This is what makes issues remediable (criterion 4).

Neurosymbolic AI is the only path to meeting the standard

Building all five capabilities takes neurosymbolic AI, the approach Otera is built on: a neural model that reads, paired with symbolic logic that decides.

COSO points to the same design when it recommends "segregating GenAI assistance from authoritative decisioning," and Otera is named in two recent Gartner reports on neurosymbolic AI, Neurosymbolic AI, a Shortcut to Agentic Systems Governance (August 2026) and Analyst Take: Use Neurosymbolic AI to Power Autonomous Enterprise Architecture (September 2026); the interpretation here is ours, not Gartner's.

Otera's neurosymbolic architecture shifts regulated operations from a probabilistic paradigm, where a model's guess or a handler's interpretation lets the same case come out differently on different days, to a deterministic one.

Language models do the reading: they convert a company's contracts, policies and SOPs into mathematical logic, held in an Agentic Decision Graph that its people read in plain language and the machine executes line for line.

That logic, not the model, makes each decision: every decision carries the clause behind it, cases the logic cannot settle go to a person, and a corrected clause is changed once and applies from then on.

// supplier payment
∀ i ∈ Invoices :
poMatched(i)
∧ goodsReceived(i)
∧ supplierVerified(i)
∧ ¬duplicate(i)
→ releasePayment(i)
// cites its clause

No probabilistic system, human or AI, can run a regulated operation. AI formalizes, code decides. The result is consistent, high-quality decisions, especially for businesses that cannot afford to be wrong.

The controls the accord describes are already how Otera's customers run regulated work.

At Allianz Partners, autonomous claims and invoice processing went live first in the UK and DACH markets before scaling globally, and HFS Research's case study draws the lesson that "every action can be explained, traced, and reversed if required." An international bank runs its trade finance processing with same-day turnaround under full regulatory control, and a global shared-services organization runs its supplier-document operations audit-ready.

Decisions that carry their own evidence are the ones that earn autonomy

The accord asks the most powerful AI companies to prove their controls to someone independent, and the chain of audit it relies on will carry that expectation to every bank, insurer, shared-services operation and other operations-heavy business that lets software decide.

Automated decisions made inside a model will keep a person at every decision that moves money or affects a customer.

Decisions made on logic people can read and retrace can take on the volume, because each one arrives with its own evidence.

GARTNER is a registered trademark and service mark of Gartner, Inc. and/or its affiliates in the U.S. and internationally and is used herein for identification purposes only. All rights reserved. Gartner does not endorse any company, vendor, product or service depicted in its publications, and does not advise technology users to select only those vendors with the highest ratings or other designation. Gartner publications consist of the opinions of Gartner’s business and technology insights organization and should not be construed as statements of fact. Gartner disclaims all warranties, expressed or implied, with respect to this publication, including any warranties of merchantability or fitness for a particular purpose.

About Otera

Otera brings autonomous operations to the enterprises the world depends on. Regulated work that once required humans at every step now runs end to end on governed agents, deciding on deterministic logic the business owns and its people can read and understand. Trusted by Allianz, Erste Group, Siemens, Bayer and SAAB.

‍