The model never closes an alert. Auto-closure is where these projects go wrong with a regulator, and it is not a capability question — it is an accountability one. A named human disposes of every alert. The system changes how long that takes and how good the information in front of them is.
Every element is traceable. A case file assembled by an AI system has to show, per element, which record it came from. An examiner will ask, and “the model determined” is not an answer that survives the follow-up question.
Model risk management applies. If your institution operates under a model risk framework, this system is in scope: documented, validated, monitored and periodically reviewed. Building it as though that will be added later is how a pilot fails to reach production.
Measure investigation time, not detection. The success metric is time to disposition and consistency of outcome across analysts, not the alert volume — which the AI system does not change and should not be credited for.