Where AI shows up in your reporting

By Barry Middlebrook · Middlebrook Data & AI Governance

"AI reporting" sounds like one capability. Inside a bank, lender, or insurer it's actually seven — each a different way AI touches a number that ends up in front of a decision-maker or a regulator. Knowing where it shows up is the first step to governing it.

The seven forms

• Self-service & conversational ("ask your data") — business users query in plain English. Goes wrong when the AI guesses what "revenue" means, joins the wrong tables, and answers confidently with no provenance.
• Narrative generation — AI drafts the commentary: MD&A, variance explanations, board-pack write-ups. Goes wrong when it produces a well-written explanation that simply isn't true.
• Agentic workflows — agents pull data, compute, and assemble the pack, sometimes autonomously. Goes wrong when a chain of unsupervised steps leaves no audit trail — and it sits outside your model-risk framework entirely.
• Regulatory & filing assistance — AI prepares or checks filings, disclosures, and SOX evidence. Goes wrong when an error lands in a regulated submission; "the AI did it" is not a defense to an examiner.
• Anomaly & exception reporting — AI flags outliers, control breaks, and fraud signals. Goes wrong when ungoverned inputs make it miss real exceptions or drown you in noise.
• Predictive & forward-looking — forecasts and model outputs feed reports: CECL/IFRS-9 expected loss, stress-test inputs, projections. Goes wrong when model-driven numbers (high-risk under SR 11-7 and the EU AI Act) flow into reports with no lineage.
• Extraction → reporting — AI lifts figures out of contracts, statements, and documents into structured reports. Goes wrong when a misread number is silently structured and trusted.

Different surfaces, one dependency: every form of AI reporting is only as trustworthy as the governed data beneath it.

The one thing they all share

Notice the pattern — every failure above is a data and control failure, not a clever-model failure. Which means you don't govern seven things; you govern one foundation, and all seven get safer at once: a semantic layer so each metric is defined once; lineage so any number traces to source; least-privilege access so AI only reaches certified data; human oversight on high-stakes outputs; and evidence captured as you operate.

Govern the foundation, and "AI reporting" stops being a category of risk and becomes a category of advantage — wherever it shows up.

The AI you can't see is your real exposure

Read back through those seven forms and the uncomfortable truth lands: AI is already touching your numbers across several of them right now — and most of it is ungoverned. The danger isn't the AI you've inventoried and risk-tiered; it's the gap between the AI you know about and the AI actually running in your reporting. That gap is your headline exposure today, and it doesn't shrink on its own — it only stays invisible until something forces it into the light.

The forms of AI reporting you haven't mapped are exactly the ones that surface during an exam.