Prompt, Prove, Record: How UK Analysts Should Govern AI Copilots

Generative AI has moved from experimentation to routine use in UK investment research. Analysts now ask copilots to summarise broker notes, extract data from annual reports, draft first-pass company profiles and generate screening ideas. The productivity gain is real, but so is the risk of confusing fluent output with investment judgement. For CFA UK members, the professional question in 2026 is not whether to use these tools. It is how to use them while remaining fully accountable for the conclusions that reach a portfolio manager, investment committee or client.

The line that matters: assistance is not accountability

A copilot can help an analyst read faster, structure a problem and challenge a thesis. It cannot own a recommendation. The distinction sounds obvious, but it erodes quietly when a model-generated paragraph survives into a research note without a visible human checkpoint. UK conduct expectations do not disappear because a tool is new. FCA conduct rules, the senior managers and certification regime, UK Market Abuse Regulation and longstanding record-keeping obligations all assume that a named individual can explain and defend the work.

The practical test is simple: if a conclusion were challenged six months later, could the analyst reconstruct the evidence, the model version, the prompt and the human reasoning that produced it? If not, the workflow is not yet fit for professional use.

Four checks before a model output enters the file

A useful governance framework separates the model output from the analyst conclusion. Four gates should apply before any AI-assisted material is treated as research evidence.

First, provenance. Every factual claim should be traceable to a primary or clearly identified secondary source. Copilots can invent citations, misdate filings and blend reported figures with estimates. Analysts should treat generated references as leads, not evidence, and verify each one against the source document. Where a model summarises a long annual report, the summary should retain page or section references so that a reviewer can inspect the underlying text.

Second, model risk. Analysts do not need to become model validators, but they should know which tool they are using, which version, what data it can access and whether outputs are reproducible. A prompt run on a public chatbot is not the same as a prompt run inside an enterprise environment with controlled data retention. Where the output feeds a screening process, sensitivity testing matters: small changes in phrasing should not produce materially different candidate lists without explanation.

Third, conduct and confidentiality. Unpublished results, client information, deal-related material and other sensitive data should not be entered into public models. The risk is not only data leakage but also the inadvertent creation of a record that could complicate market-abuse monitoring. Enterprise tools with appropriate access controls, retention policies and surveillance are preferable. Analysts should also consider conflicts: a model trained on publicly available commentary may simply recycle consensus, which is not independent research.

Fourth, documentation. A short decision log is usually enough: the question asked, the tool and version used, the key output, the sources checked and the analyst judgement applied. The log should identify the human reviewer and note any output that was rejected. This is not bureaucracy for its own sake. It is the evidence trail that makes AI-assisted work auditable and defensible.

A practical workflow for separating grunt work from judgement

The most effective approach is to allocate tasks explicitly. AI can handle more of the preparation; analysts should retain more of the interpretation.

This division matters because the highest-value analyst work is not summarisation. It is framing the right question, weighing contradictory evidence, understanding management incentives and deciding what is already priced in. A copilot can accelerate the first three rows of the table above, but the final row is where investment judgement lives.

A useful habit is to run a red-team prompt after drafting a thesis. Ask the model to identify the strongest bear case, the weakest assumption and the evidence that would falsify the conclusion. The output should then be tested against primary sources. Used this way, AI becomes a challenger rather than an authority.

Conduct in the everyday: inside information and market abuse

UK analysts operate in a regime where information handling is not a back-office concern. A copilot that ingests emails, chat messages or meeting notes can create a misleading record if it blends material non-public information with public research. Firms should be clear about which tools are approved for which datasets, how prompts are retained and how suspicious outputs are escalated.

Analysts should also avoid asking models to predict share prices or generate undisclosed company information. Such prompts are not merely unreliable; they can create conduct risk. The safer pattern is to use AI for structuring public information, testing logic and drafting questions for management, while keeping valuation assumptions and recommendation decisions in human hands.

A short checklist for the investment committee

Before AI-assisted research is signed off, the analyst should be able to answer yes to five questions. Can every material claim be traced to a verified source? Is the model version and prompt recorded? Has the output been tested for consistency and bias? Has confidential or inside information been excluded from public tools? And is there a named human who owns the conclusion?

Generative AI is likely to become more embedded in UK investment workflows, not less. The firms that manage this transition well will not be those that ban copilots or those that defer to them. They will be the ones that make assistance auditable, keep judgement human and treat documentation as part of the research process rather than an afterthought.