Your client reports are already being read by machines. Can they be understood?

 No. Reporting Maestro is a governed reporting platform: it prepares data, renders templates, applies controls, manages review and distribution, and holds the system of record. AI can propose, compare and explain within that process. Where controlled commentary is used, the output is a first draft that a named reviewer accepts, edits or rejects, with the evidence visible alongside it. No client-ready text is released without a recorded human decision.

A PDF generated with enough semantic structure, context, provenance and access control for an authorised system to extract and cite its content with materially less ambiguity: navigable structure, data carrying periods and units, grounded narrative, chart alternatives, citable sections and metadata that travels with the file. AI-readable PDF is a ReportingSoft working concept, not an ISO certification. PDF 2.0 (ISO 32000-2), PDF/UA-2 (ISO 14289-2) and Tagged PDF are the formal standards, and institutions should continue to test against the ones that apply to their documents.

 OCR recovers visible characters from a page. It cannot reliably reconstruct the business meaning that was lost when the document was created. It may identify "3.4%" and "MSCI World" without knowing whether 3.4% is portfolio return, benchmark return, contribution, volatility or a footnote threshold. It may not distinguish the current quarter from since-inception results and may recognise a disclaimer without understanding which section it qualifies. The reliable approach is to preserve the meaning while the report is being assembled, since the reporting engine already knows it.

The structural work is the same work. Correct reading order, proper heading hierarchy, real table semantics and alternative text for charts are what accessibility standards require and what machine readability depends on. Institutions in scope of the European Accessibility Act for consumer banking services have a legal driver for that structure. For private banking and institutional mandates the driver is different: retrieval quality, audit evidence and client experience. Accessibility standards alone do not supply the business semantics that client reporting needs, but they are the right foundation.

FINMA Guidance 08/2024 sets out a technology-neutral, proportionate approach to AI risk, covering governance, inventory and risk classification, data quality, testing and monitoring, documentation, explainability and independent review. The NIST Generative AI Profile frames governance, provenance, pre-deployment testing and incident handling as core risk-management activities. Both translate into concrete reporting controls: sentence-level grounding, defined no-generation topics, versioned prompts and rules, regression testing, and an evidence trail linking every statement to the data snapshot and human decision behind it.

 Entitlements are applied before retrieval, not after. An assistant that retrieves another client's report or a restricted annex is an access-control failure, not a model error, so permissions are enforced before the model sees any content. Uploaded document text is treated as data rather than as instructions, so hostile content cannot manipulate a downstream assistant. Approved deployment, data minimisation, encryption, defined retention terms and logging apply as standing conditions.

 No. Prompts, rules, data contracts, evaluation cases and evidence are managed outside any proprietary model interface. You can change model, deployment option or provider without redesigning the reporting process. This limits third-party concentration risk and allows different tasks to be routed to different models under one consistent control framework.