Set an AI disclosure rule for regulated payment code

You work on a payments service that is audited every year. You used an agent to write part of a Java module that splits interchange fees, the per-transaction fees that card networks set and card-issuing banks collect. The agent also wrote much of the module's test suite.

Legal and the compliance lead now ask how AI is used in code that touches money. They want you to propose a rule for disclosing it.

What rule do you recommend? Decide what gets disclosed and checked, and where governance turns into theater: controls that look good and catch nothing.