How do you make AI commentary trustworthy enough to base a decision on?

THE OBJECTION

“It will confidently make things up.”

Yes, it will. A language model asked to comment on a set of accounts will, sooner or later, name the wrong auditor, restate a figure from the wrong year, or produce a “97% confidence” that means nothing. I’ve watched mine do all three. The question isn’t whether the model can be trusted on its own—it can’t—but what you build around it so that the output can be. Six rules came out of doing that in production. They transfer to almost any software that wants an AI feature.

Rule 1: the AI never owns a number.

Every figure in a report—turnover, net assets, creditors, cash—is extracted by deterministic code from the filing’s own tagged data, before any model is involved. UK accounts are filed as inline XBRL, so for most companies the numbers are machine-readable facts, parsed at effectively zero cost. Where a filing is only a PDF, the pipeline steps down a fidelity ladder: a clean published document if one exists, a scanned image read by OCR as the last resort. Which rung was used is recorded on the report, on two axes—where the data came from and how it was read—so the report can say, honestly, “these figures were read from a scanned copy”.

The model is then handed those figures and cannot overwrite them. Ratios are computed in code too, and passed to the model with the formula, the inputs and the result. That last detail matters more than it sounds, for a reason that comes up under Rule 3.

Rule 2: audit the data before the AI sees it, because the data lies too.

This was the surprise. The machine-readable layer of UK small-company filings is produced without validation. A figure printed in brackets—net liabilities of (46,290)—must carry a negative sign in the tag. Several widely used filing packages tag the displayed magnitude and drop the sign, on every bracketed line in the document. Nobody in the filing chain checks the arithmetic. So a company with net liabilities arrives, in perfectly valid XBRL, as a company with positive equity.

My first fixes were a chain of local corrections, each triggered by the next company whose filing had a slightly different shape. That never ends. The replacement is one balance-sheet solver that treats the signs of signed figures as unknowns and finds the assignment satisfying all the accounting identities at once—using the rendered page as a third source of evidence alongside the tags. When no single assignment works, it refuses to guess: the filing is published as filed, with a caveat, not repaired. Every field carries an interpretation state and its reason, and the report prints them under “How the balance-sheet figures were read”. Run over a corpus of 500 real filings from the Companies House bulk data, it solves 96% of balance sheets in three passes and names the concept behind every contradiction in the rest.

The principle underneath: structured data is valuable evidence and must never be elevated to ground truth without reconciling it against the presentation and the arithmetic. That’s true of any upstream data source you’re about to hand to a model.

Measuring this properly meant profiling every accounts package in the samples—nineteen of them, across 3,625 balance-sheet periods—which produced a dataset in its own right: how each one handles signs, untagged lines and dimensional structure, and how often its balance sheets reconcile. That survey will be published here once the software vendors it names have had notice of it.

Rule 3: a second model is not a proof.

My first answer to the trust question was the obvious one: an independent verifier. A second model, with a different prompt, reads the finished report against the filing and can hold it back from publication. It caught real things—an invented auditor’s name, wrong share counts—when the narrator had been starved of the filing’s prose and confabulated to fill the gap.

Then it started failing in ways that taught me more than its successes.

• It judged correct figures “unverifiable” because I’d given it the wrong evidence. On a FTSE-100 company’s 330-page annual report, the numbers came from 788 tagged facts, but the verifier was handed a 20-page carve of the scanned PDF and told it was “the filing”. From its point of view, the cash-flow statement wasn’t there. The fix was evidence parity: the verifier gets the same tagged facts and the filing’s own text that the report was built from, and a manifest telling it exactly what it is holding and what it isn’t. And it verifies against the raw parser output, never against the generator’s own input—checking a model against the thing it was fed proves nothing.
• It re-derived a ratio and got it wrong. The report said return on average equity was 22.44%, which it is. The verifier recomputed it, got a different answer, and filed “materially overstated”, suggesting a formula that yields 22.44%. Prompt rules saying “do not recompute” did not stop it. A model’s arithmetic is not reliable; only a figure whose working it can see goes unchallenged. Hence Rule 1’s formula-inputs-result.
• It graded by mood. The same report, run three times, drew four warnings, then one, then five—all of them context notes beside figures the verifier itself had confirmed. A tally of model moods had become the customer-facing quality number.

After nine rounds of rules to normalise the verifier’s output, I wrote down the conclusion I’d been avoiding: model-versus-model checking is a treadmill. So in September 2026 the numbers moved out of the model’s hands entirely. A code gate now scans every money, percentage and ratio token in every sentence of commentary and requires each one to trace to a tagged fact, an extracted field, a computed metric, or the filing’s own text. A figure found nowhere is an “unsupported figure”: the one finding that can hold a report, explainable in a sentence, and it never disagrees with itself. The model verifier still runs, but it’s advisory—it can add a caution, it cannot block.

Rule 4: give the AI only the job it is uniquely good at, and make it cite.

Once the numbers are handled in code, what does the model add? The reading of the filing’s prose: the going-concern statement, the auditor’s opinion, related-party dealings, capitalised development judgements, events after the year end, the directors’ own remarks. None of that is a tagged number, and none of the number-only competitors offer it. So the narrative is extractive by rule—every item is a reading of a named part of the filing and cites its passage.

What got dropped is as important. Model-invented “risk flags” whose names and severities changed every run: gone. “Questions for the directors”: gone. The confidence percentage: gone from every surface. The risk rating is rule-based and never AI—each factor shown with its value, the band it fell in and the rule that fired (“current ratio 0.62 is below the 0.75 band for this sector”), with the calibration status printed alongside: “sector thresholds: seed defaults, not yet calibrated”. A grade you can explain is a grade you can defend. A model’s sense of what’s risky in a sector is folk wisdom, not a base rate.

Rule 5: same filing, same words.

If two customers pull a report on the same company and get different commentary, neither can trust either. Generation runs at temperature zero, and the narrative is cached against a key made from the filing’s content hash and the prompt version. Refreshing a report re-extracts the facts and re-runs the deterministic pipeline, but reuses the cached narrative unless the facts changed. Every prompt is versioned, so a change in wording can never silently mix with old output.

Rule 6: tell the reader what you don’t know.

An unverified report is held, and sharing it requires an explicit acknowledgement. The screening panel’s empty state reads “No adverse signals flagged from the external screening checks performed”—deliberately not a clean bill of health. Every report carries its sources, its version, and a staleness banner when the register has moved on.

And there is a review log: one row per report checked by a person against the rendered filing, every defect recorded against the layer that caused it. Unreviewed publishing switches on only after twenty consecutive clean reviews across six filing packages and four balance-sheet shapes. Fifty reports in, nine were clean, the streak stands at zero, and the log says so.