The Traceability Wave Hit AI First. Private Markets Are Next.

Regulators have stopped accepting logs as proof. They want evidence of what ran, what was assumed, and why. The AI world hit this wall first — an entire evidence-layer industry is now being built to retrofit verifiability onto systems that were never designed to produce it. Private markets are next, and the architecture that survives looks nothing like the one most GPs are standing up.

The AI Act is the leading indicator

The EU AI Act entered into force on 1 August 2024. The high-risk obligations that matter for infrastructure — Articles 12 through 15 — apply from 2 August 2026. Article 12 mandates automatic record-keeping across a system's lifecycle. Article 13 requires transparency adequate for deployers to interpret output. Article 14 requires human oversight that is actually actionable. Article 15 requires robustness, accuracy, and cybersecurity — including tamper-evident handling of logs.

The Act is narrower than the headlines suggest. Annex III is the list of high-risk categories, and it covers consumer-facing decisions — natural-person creditworthiness, HR hiring and promotion, insurance pricing for individuals, critical infrastructure. Institutional investment decisions are not on that list. A PE firm underwriting a buyout, a credit fund underwriting a corporate borrower, a family office running portfolio analytics — none of those trigger the high-risk obligations directly. The Act still reaches them in other ways: AI literacy (Article 4, already live), obligations that flow through from GPAI model vendors, transparency for AI-generated content, and any AI used in their own hiring. But the Articles 12–15 record-keeping regime does not apply to the core investment decision.

What matters is what the Act signals. A major regulator has decided, as a matter of law, that probabilistic systems making consequential decisions must produce provable traceability. An entire product category has sprung up to compensate — cryptographically verifiable execution records, project bundles, tamper-evident agent traces. It is a bolt-on to fix a bolt-on: an evidence layer retrofitted onto systems that were never designed to answer for themselves, because the underlying system cannot. The architectural lesson is the part that transfers to private markets. The direct legal obligation, for most GPs, largely does not.

SR 11-7 was conceived in an era of static, largely deterministic models with parameters calibrated periodically and deployed unchanged between reviews. Modern AI systems are dynamic rather than static, probabilistic rather than deterministic, and in some cases agentic, or capable of pursuing objectives with limited human intervention. Validation approaches — conceptual soundness, outcomes analysis, benchmarking — may lose effectiveness when models recalibrate autonomously.

The same question is now being asked of private markets

The Bank of England. In December 2025, the BoE launched its second system-wide exploratory scenario — focused specifically on private markets — with results due in early 2027. The first SWES, published 29 November 2024, had already revealed “mismatches in expectations” among market participants and demonstrated that reconstruction of positions under stress was materially harder than firms believed. The private markets exercise inherits that framing. It is not asking for your returns. It is asking whether your positions, your leverage, and your reasoning can be observed under a shock.

The SEC. The Private Fund Adviser Rules were vacated by the 5th Circuit in June 2024, but the underlying regulatory posture did not reverse. Adviser recordkeeping enforcement under Rule 204-2 continued through 2024 and 2025, with settled charges for misuse of fund assets, overcharging on post-commitment fees, and failure to arrange required independent verification of custody. The category of violations is consistent: the adviser could not prove, on its own records, that what was done matched what was disclosed.

The LP community. ILPA Principles 3.0 (June 2019) already elevated governance and transparency alongside alignment of interests. The direction of travel since — on fee and expense reporting, LPA compliance and assurance, GP-led secondaries, conflicts around parallel vehicles — has been toward written policies, more frequent disclosure, and auditable evidence rather than narrated attestation. LPs are not asking for more PDFs. They are asking for data they can verify.

The portfolio itself. PE-backed US bankruptcy filings hit a record 110 in 2024, and private-equity ownership was associated with 54% of the largest US corporate bankruptcies in 2025. The Steward Health Care collapse in May 2024 — $9 billion in liabilities, the largest hospital bankruptcy in decades — triggered Congressional hearings, state AG action, and a discovery process that reconstructed the decision chain from the outside. Whether or not one accepts the extraction narrative, the pattern is instructive: when the LP, the regulator, or the court shows up, the decision chain is reconstructed by adversaries, not by the GP.

Agentic AI in investment decisions faces the harder exposure

The firms standing up agentic AI on top of their deal or monitoring workflows are often comforted by the fact that their core use case isn't Annex III high-risk. That comfort is misplaced. The exposure that actually matters is not the AI Act. It is the decision-layer question that the BoE, the SEC, and the LP are already asking — and that an agentic system is structurally worse at answering than a spreadsheet.

SR 11-7 — the 2011 Fed/OCC model risk framework — was designed for static, periodically recalibrated models. Agentic systems strain every one of its validation assumptions. When the LP asks why the call was made, “the agent decided” is not an answer. When the regulator asks what assumption was being tested, a prompt trace is not a thesis. A cryptographic bundle proving the agent called the tool it said it called does not prove the investment thesis still holds.

And the moment that agentic stack touches anything Annex III — a hiring workflow, a natural-person credit adjacency, a consumer-facing portfolio company use case — the AI Act obligations do land, in full, on top of the decision-layer exposure that was already there.

Deterministic-first side-steps half the problem

Capital Refinery is built deterministic-first. The covenant ratio is calculated by code. The scenario stress is calculated by code. The KPI deviation from the underwriting basis is calculated by code. Same inputs, same outputs, every time. There is nothing probabilistic happening in the math layer, which means there is nothing to cryptographically prove about hallucination — because there was no hallucination surface to begin with.

What remains is the decision-chain record. Every figure traces to its source document. Every assumption traces to who set it and when. Every decision traces to the alternatives that were considered at the time and the reasoning that was recorded alongside them. That record is not compensating for AI uncertainty. It is documenting the investment decision chain — the object the regulator and the LP are actually asking about.

When AI does appear in the stack — synthesis, narrative drafting, pattern recognition — it is labeled. The user knows which outputs were produced by deterministic computation and which were produced by a model. That labeling is not a product polish. It is the architecture.

What this means for a GP choosing infrastructure in 2026

The AI-first vendors (Hebbia, Dili, the new wave of agentic deal copilots) cannot tell you which of their outputs are deterministic, because almost none of them are. When the AI Act clock runs out in August 2026, they will be building an evidence layer under you.

The monitoring incumbents (iLEVEL, Allvue, Chronograph) have the numbers but not the decision chain. They were never designed to bind the KPI to the IC assumption, the assumption to the memo, or the memo to the person who approved it. When the LP or the BoE asks for the decision chain, the answer is reconstructed from email and memory.

The bolt-AI-on-Excel tools (Endex and its peers) are making spreadsheets smarter. The spreadsheet is still not traceable, and an AI-smarter spreadsheet is not a decision record.

Capital Refinery is the fourth option: a deterministic compute layer with a traceability spine and a labeled AI surface on top. The math is provable because it is arithmetic. The decision chain is provable because it is the data model, not a retrofit. The AI, where it appears, is scoped and marked.

We don't ask you to trust AI with the math. We ask you to trust arithmetic — and we show you every step.