The Decision Proof Gap

TL;DR

• AI governance frameworks describe how decisions should be made — but the moment a decision is actually executed, the evidence to defend it almost never exists in a form anyone can verify.
• Existing tools don't close the gap: explainability, logs, policy-as-code, and model cards all sit before the decision or after it, never at the moment it's made.
• The fix is to capture the decision as it happens — a signed, replayable record bound to the policy in force at that moment. This paper calls it a Decision Receipt.

Summary

AI governance in 2026 sits before the decision — approval gates, risk classification — and after it — logs, explainability — but never at the moment a consequential decision is executed. This paper names that structural gap, shows it in survey evidence from the most heavily regulated sector on earth, explains why the four leading candidates (explainability, logs, governance frameworks, model cards) cannot reach the decision boundary by construction, and proposes the Decision Receipt as the missing primitive: a signed, policy-bound, replay-safe record produced at the moment of decision and verifiable by an outside party. It is an argument about a missing artefact rather than an experiment — every figure it carries comes from third-party surveys it cites.

Method

A conceptual white paper, not a study. It fixes three terms in defined roles — the Gap (the problem), the Decision Boundary (where it occurs) and the Decision Receipt (what closes it) — then argues from published multilateral survey evidence and two worked exhibits: a regulatory request that fails today, and the verifiable record that would have answered it.

1. 01Locate the boundaryFix the shape of the problem: input → policy → model → output → missing artefact. Everything before the decision is governed, everything after it is reconstructed, and the decision itself is unevidenced.
2. 02Establish the gap from third-party survey evidenceThe CCAF Global AI in Financial Services Report 2026 — produced with the BIS, IMF, WEF, IDB, CGAP and the Arab Monetary Fund, covering 628 organisations across 151 jurisdictions — and the Thomson Reuters Foundation / UNESCO AI Company Data Initiative, covering 2,972 companies.
3. 03Test the four candidate solutions against the boundaryExplainability, logs, governance frameworks and model cards are each assessed for whether they can reach the moment of decision. Each sits before it or after it.
4. 04Specify the primitive and how it composesWhat a Decision Receipt binds, how verification runs from a self-contained evidence package without access to the issuer's infrastructure, and how receipts compose into Decision Chains that survive vendors and jurisdictions.
5. 05State the boundariesScope and limitations, the implementation overhead the primitive adds, and what changes for regulators, firms, AI operators and the people the systems decide about.

Key findings

• 81% vs 24%81% of financial-services firms run AI in production, while only 24% of regulators collect structured AI data and 5% collect bias data.The asymmetry the paper is built on, drawn from a survey of 628 organisations across 151 jurisdictions conducted in late 2025 and early 2026. The most regulated sector on earth has limited supervisory visibility into deployed AI.CCAF Global AI in Financial Services Report 2026, cited in Executive Summary and §Evidence — Adoption vs Supervision, Fig. 2
• 40% · 52%40% of firms are in advanced deployment and 52% are actively running agentic AI — decisions cascading between machines, above the layer any of the existing controls reach.CCAF Global AI Report 2026, Fig. 2, cited in §Evidence — Adoption vs Supervision
• 65%Two-thirds of firms do not monitor their models for bias, and half use no explainability methods at all.The paper's worked scenario turns on this: a regulator asking a bank to demonstrate fairness across a quarter of AI-driven credit decisions gets a narrative response, because on the firm's side half cannot explain the decisions and on the regulator's side three-quarters do not collect the data that would make the question answerable.CCAF Global AI Report 2026, cited in §Evidence — Adoption vs Supervision
• 38% vs 18%No two stakeholder groups agree on who is liable for AI harm: 38% of regulators say the regulated firm should bear it, only 18% of industry agrees, 35% want case-by-case attribution and 22% favour shared liability.The paper reads the fragmentation as the gap restated. When no party can produce a binding record of who decided what against which authority, every stakeholder rationally reaches for a different theory of liability.CCAF Global AI Report 2026, cited in §Evidence — 'The liability disagreement is the Gap restated'
• 2,972 companiesOutside finance the shape repeats: references to policies, committees and high-level oversight appear more frequently than evidence of operational controls, dedicated resources, escalation pathways or monitoring mechanisms.The same report calls three times for a shift from disclosure of statements of intent to verifiable practice, and never defines verifiable technically. The paper's observation is that the word does the rhetorical work while the engineering is missing.Thomson Reuters Foundation / UNESCO AI Company Data Initiative, cited in §Evidence — 'Outside finance, the same shape'
• The four leading candidate solutions fail by construction rather than by immaturity — explainability, logs, governance frameworks and model cards each sit before the decision boundary or after it, never at it.§Why Existing Solutions Fail

Limitations

• Not every decision needs a receipt.Low-stakes, reversible, uncontested decisions — a recommendation engine surfacing a film, a search-result ranking — do not warrant the cost of signing and storage. The primitive is for decisions that can be challenged: credit, hiring, benefits, trades, agentic transactions, clinical triage, procurement awards.
• The primitive scales, but it does not arrive free.A signing step adds a few milliseconds. For decisions made at sub-millisecond cadence — high-frequency trading microstructure, real-time ad auctions — the architecture has to be designed around batched or deferred signing.
• The receipt is itself sensitive.A signed record of a medical triage or a benefit denial is regulated personal data. Storage, access control and retention have to be engineered. Receipts constrain logs by capturing the minimum required to prove a decision; they do not eliminate the privacy surface.
• The signature proves non-repudiation, not honesty.A firm holding its own signing key can sign whatever it wants. Receipts become trustworthy through external anchoring and through the obligation to emit one for every decision in scope — both governance choices, not properties of the primitive.
• Receipts establish what the system did, never that it was right.They record what was decided against the policy in force. They do not establish that the policy was right, that the inputs were appropriate, or that the outcome was normatively correct. Correctness stays a separate question for policy validation and model risk management.
• The paper argues from third-party survey evidence, not from its own experiment.The figures come from the CCAF and TRF/UNESCO reports; the exhibits are illustrative. The empirical work on this substrate is the three procurement experiments published separately as MRP-2026-02, -03 and -04.

Data and reproduction

This paper is an argument about a missing artefact, not an experiment. It carries no dataset of its own, and every figure in it is drawn from the third-party surveys it cites. The empirical work that applies the primitive it proposes is published as MRP-2026-02, MRP-2026-03 and MRP-2026-04, and each of those pages links its own corpus. Licences differ by layer: this PDF, deposited on Zenodo, is CC BY-NC 4.0, while repository code is MIT, the in-repository writeups are CC BY 4.0, and the receipt corpora are Open Government Licence v3.0 derived.

• Research repository — github.com/MeshQu/meshqu-research ↗

  The public research surface: harnesses, pre-registered predictions, signed receipt corpora and writeups for the three experiments.

• Receipt-Anchored Evaluation — the method ↗

  How the record this paper argues for is actually produced and checked, written up as a reusable method rather than a product description.

• DATA_LICENSE.md — licensing across the layers ↗

  Which licence applies where across the research repository, and the Open Government Licence attribution line the source records require.

Citation

Carter, S. (2026). The Decision Proof Gap. MeshQu White Paper WP-PROOF-01. Zenodo. https://doi.org/10.5281/zenodo.20055736

DOI · 10.5281/zenodo.20055736

The PDF is the version of record. This page summarises it; where the two differ, the PDF governs.

Elsewhere on this site

• AI governance frameworks: where execution proof fits

  AI governance frameworks describe how decisions should be made. Execution proof is the separate artefact that shows a particular decision was made that way — produced as it executes, and checkable by someone who was not there.