Not a prediction. A reading of obligations already in force, enforcement trajectories already visible, and technical gaps that regulation will close.
Regulators across the EU have established traceability, auditability and decision evidence requirements that currently outpace the technical capabilities of most regulated institutions. This is not a future risk. It is a present gap — between what the norm requires and what institutions can currently demonstrate.
Algorithmic trading systems must be auditable. Most are not, technically.
High-risk AI systems require decision traceability. Technical standards for compliance not yet universally implemented.
Digital systems in financial entities must be demonstrably robust and auditable. Evidence requirements are structural.
Supervisory attention shifts from policy adoption to technical demonstration. Reconstruction will no longer be sufficient.
This is not a claim about specific vendors or institutions. It is a structural observation: most digital decision systems were not designed to produce verifiable evidence of their own decisions. They were designed to produce outcomes. Logs, timestamps and audit trails exist — but they are born inside the same digital domain they are meant to certify. When challenged technically, they cannot provide the external reference that strong evidence requires.
The gap between these two columns is what Gemacode is designed to close.
Article 13 requires that high-risk AI systems be designed to allow for appropriate human oversight and provide the technical means to ensure that their operation is traceable. Article 17 requires quality management systems that include documentation of decision logic. Most current AI governance frameworks address these requirements at the policy level. The technical evidence layer remains absent.
RTS 6 requires investment firms using algorithmic trading to maintain systems that can produce complete audit trails for all orders, including the parameters and inputs of the algorithm at the time of each decision. The requirement is technical, not procedural. Manual reconstruction is not a compliant response to a technical audit.
The convergence of AI governance, operational resilience and financial risk regulation is not coincidental. Each framework, from its own regulatory logic, is arriving at the same technical requirement: decision systems must produce evidence that can survive independent scrutiny. The institution that resolves this technically is not merely compliant. It is structurally defensible.
Regulators with increasing technical capacity will identify the gap between policy-level compliance and technical evidence capability. Supervisory findings are reputationally and financially material.
In disputes involving automated decisions — employment, credit, trading — the inability to produce verifiable technical evidence of the decision process constitutes a structural legal vulnerability. This is not hypothetical: cases are already in court.
Ref. CJEU C-634/21 · Lokken v. UnitedHealth · CFPB / ECOAWithout a technical evidence layer, every audit cycle requires disproportionate manual reconstruction effort. At scale, this is operationally unsustainable.
Gemacode has developed QEL — a decision evidence architecture designed to address this structural gap. It is not a compliance product. It is an evidence infrastructure: the technical layer that sits between what a decision system does and what a regulator can verify.
The regulatory standard that will eventually formalise this requirement does not yet exist in codified form. That is not a weakness in Gemacode's position. It is the position itself.
Standards are not written in a vacuum. They are written around implementations that already work. The institutions and vendors that define early technical reference architectures do not merely comply with the emerging standard — they shape what it becomes.
Gemacode's research is positioned at that frontier.
Decision evidence architecture requires the intersection of applied mathematics, physical trust anchoring, regulatory mapping and system architecture — developed together, not assembled from off-the-shelf components. The research programme behind QEL represents a multi-year development trajectory. Regulated institutions do not build this. They acquire it, license it, or fall behind the standard.
The institutions that implement this architecture
before the standard is codified
will define what the standard becomes.
Technical mapping of AI Act, MiFID II, AIFMD, UCITS, DORA and Solvency II requirements against QEL architecture is available to qualified institutions. This documentation is not public.
Access subject to qualification review. This page does not constitute legal advice.