A compliance check that finds nothing has still produced a result, and that result is evidence. If an agent records only its hits, nobody can later show that a customer was screened, a file reviewed or a pattern looked for. Negative results must be filed with the same care as positive ones, stating what was searched, against what and when.
Why is "nothing found" evidence?
Most compliance controls exist to show that something did not happen, or that the firm checked and was satisfied. A screening control proves its worth on the days it clears customers as much as on the days it stops one. An auditor testing that control will ask for a sample of cleared cases and expect to see that each was actually screened.
If the agent only writes a record when it finds something, the absence of a record is ambiguous. It might mean the check ran and found nothing. It might mean the check never ran. It might mean it ran against an empty or stale list. From the outside, all three look the same, and only the first is acceptable.
This is the same reason the agent record must be append-only: the point of the record is to let someone who does not trust the firm verify what happened. Silence verifies nothing.
What should a negative record contain?
Enough for a reviewer to confirm that the check was real and adequate. For each negative result:
- What was checked: the customer, transaction, document or communication.
- What was looked for: the criteria, rules or patterns applied.
- Against which sources: list names and versions, data sets and their dates.
- The scope: what period, which accounts, which fields.
- When: the time the check ran.
- What was not checked: anything excluded, unavailable or out of scope.
The last item is easy to forget and important to keep. If a data source was unavailable when the check ran, a negative result is incomplete, and the record should say so plainly rather than recording a clean pass.
Why is "not found" different from "not checked"?
Because they lead to different conclusions and different actions, and a careless record collapses them.
| Result | What it means | What the record must show |
|---|---|---|
| Not found | The check ran fully and nothing matched | Criteria, sources, versions, scope, time |
| Not checked | The check did not run, or ran without a needed source | Which part was missed and why |
| Partly checked | Some sources or fields were covered, others not | What was covered and what was not |
| Found | Something matched and was passed on | The match, the reason and who received it |
An agent that writes "clear" for both of the first two rows is producing false comfort. It is better for the agent to report "could not complete" and hold the case than to record a negative it cannot stand behind.
What goes wrong without negative records?
Take an illustrative case. A firm's screening agent checks new customers against a sanctions list. Months later, one of those customers is designated. The supervisor asks whether the firm screened the customer at onboarding, against which list version, and whether the name would have matched at that time.
With negative records, the answer is a single entry: screened on this date, against this list version, no match, with the fields compared. Without them, the firm has to reconstruct what probably happened from system logs and configuration history, and the honest answer may be "we believe so". That is a weak position in front of a supervisor.
The same applies to investigations. When an agent is asked to look for hidden connections between customers, as discussed in whether an AI agent can find hidden links between customers, the finding "no links found across these data sets" is valuable, but only if the record shows which data sets were searched.
Does recording negatives create too much data?
It creates more data, and that is a cost worth acknowledging. A screening agent might clear thousands of cases for every hit. Storing a full record for each is more expensive than storing only hits.
The answer is to keep negative records concise and structured, not to skip them. A negative entry does not need narrative; it needs the fields above. Retention rules then apply as they would to any compliance record, a process covered in how to apply record retention schedules with an AI agent. Deleting old negative records at the end of their retention period is fine. Never creating them is not.
How do negative records help audit?
They turn sampling into something meaningful. An auditor can pick any case from a population and see what the agent did, whether it found anything or not. That is the basis of auditing what an AI agent did: every case has a trail, not just the interesting ones.
They also help the firm's own oversight. As detection improves, the volume of findings rises, and the argument that surveillance agents can find more, so people must decide more applies. Negative records are the other half of that picture. They show what the agent looked at and set aside, which is where missed issues hide.
What should you do differently?
Check whether your compliance agents produce a record for every case they handle or only for the ones where they find something. If only the latter, change the design so a negative is a recorded verdict with its criteria, sources and scope. And make "could not complete" a distinct outcome that holds the case for a person, never a silent pass. This is part of treating AI compliance agents as second line, never the last word.
Questions people ask
Should the agent explain why something was not found?
For routine checks, the criteria and sources are enough. For investigations, a short note on what was searched and why nothing relevant appeared helps the reviewer judge whether the search was adequate.
Do negative records need a person's review?
Not each one. Sampling a proportion regularly is usually enough, with closer review of any category where hits later turn up that the agent should have caught.
What if the list or source changes after the check?
The record shows the version used, which is the point. If a later version would have produced a match, that is a reason to rescreen, and the rescreening should be recorded too.