How a confidential AI vendor gets through a bank's security review, and stays through every model update.
A start-up runs large language models inside CPU and GPU trusted execution environments and sells inference to regulated customers. The pilot went well. Then the bank's security team sends two hundred questions, and the one that matters is short: how do we know what runs on our prompts?
The vendor attests each node at start. But it ships a new model every few weeks, updates GPU drivers, and adds and removes nodes all day. The evidence the bank checked during the pilot describes software that no longer runs. After TEE.fail, the bank also asks what a valid quote proves when nobody knows who can touch the server.
Each release produces reference values together with the build. The verifier learns them before the rollout. Nodes prove themselves before they take traffic, and the key that decrypts customer data is released only against current evidence. The policy names the cloud regions and operators it accepts, so a quote from an unknown machine is refused. The bank gets a small verifier it runs itself.
A security review that ends with evidence the bank checked itself. And a standing answer to the same question next year, which is what the bank's own regulator asks under DORA.
An illustrative case built from public documentation and common architectures. It describes no particular company.
Working on attested ai? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.