A financial AI workflow runs AI document analysis on contracts, credit files, and pricing memos by sending the model the structure of the work, not the raw values inside it, so the analysis runs while the confidential operational documents stay inside the institution.
The gap between what a model can do and what a bank will let it touch is where most of this stalls. Even so, in regulated finance the block is rarely the model. It is that the work lives in documents no one is allowed to send anywhere. That constraint now has its own tooling: research toolkits like OnPrem.LLM exist to run models on sensitive, non-public data in offline or restricted environments.
Picture a credit team with forty renewal files to summarize before the committee meets on Friday. Each file is a stack: the signed facility agreement, the counterparty’s last three quarters of management accounts, an internal pricing memo with the spread the desk is willing to hold, and a risk note that names two other clients for comparison. Reading that stack, surfacing the covenants that changed, and flagging where pricing sits against the book is exactly what a capable model does well. It is also the most sensitive paper the institution owns. So the file sits there, and someone summarizes it by hand at 9pm.
The two dead ends in a financial AI workflow
When a financial AI workflow meets a confidential operational document, teams usually reach for one of two moves, and both end badly.
The first is to clean the document before sending it: strip the counterparty name, blank the pricing, redact the comparison clients. What comes back is a summary of a document that no longer says anything. The spread was the point. The named comparisons were the point. Remove them and the model reasons about a hollow shell, and the analyst has to reinsert every removed fact from memory before the output is usable.
The second is to forbid the external model entirely and wait for an internal one that may never match it. Meanwhile the analysts who have a Friday deadline paste excerpts into whatever chat window is open on a personal machine, and now the institution carries an exposure it cannot even see. Both paths share one hidden assumption: that the raw values and the analytical work are the same object. They are not.
How AI document analysis runs on a confidential document
The move is to send the model the structure of the work and reconstruct the result locally. The renewal file keeps its shape. Counterparty A stays a single consistent entity across all four documents. The pricing keeps its relationships: this spread wider than that one, this covenant tighter than last year’s. What changes is that the real name, the real basis points, and the real identities of the comparison clients are substituted before anything leaves, so the model reasons over a faithful skeleton of the deal rather than the deal itself.
The model returns its committee summary against that skeleton, and the institution reconstructs the result inside its own systems, slotting the real counterparty name and the real numbers back where the placeholders were. The analyst opens a finished summary, not a puzzle. None of the original values made the trip out, and the whole flow runs inside the environment the bank already operates: the cloud tenant or on-prem cluster that already holds the data.
This runs on a Context-Preserving Data Layer for AI, in CUBIG’s case LLM Capsule, which holds the structure intact on the way to the model and rebuilds the business meaning on the way back. The substitution is structure-preserving, which is what separates it from plain masking. A masked contract loses its relationships; a substituted one keeps them and only swaps the values. LLM Capsule runs on the CUBIG Syntitan platform.
What the model actually receives
It helps to see what AI document analysis actually receives. The table below contrasts the three ways a credit file reaches a model, using the same renewal stack in each row.
| Approach | What the model sees | Is the output usable? |
|---|---|---|
| Raw upload | Real names, spreads, comparison clients | Yes, but the values left the boundary |
| Plain masking / redaction | Blanks where the facts were; relationships broken | No, analyst rebuilds it by hand |
| Structure-preserving substitution | A faithful skeleton: same entities, same relationships, substituted values | Yes, and values never left |
The third row is the one that lets AI document analysis run. The model gets enough structure to reason well, and the confidential operational documents never leave the institution’s control.
A quick test for your own files
Run this check against a document your team currently will not send to a model:
- If you removed the sensitive values, would the model still have enough to do the work? If not, redaction is not your answer.
- Does the same entity, say one counterparty, appear across several documents that must line up in the output?
- Do relationships between values carry meaning, such as one spread relative to another?
- Would the finished output need the real names and numbers put back before anyone could use it?
- Can the whole flow stay inside the cloud or on-prem environment you already run?
If most of these are yes, you are looking at a workflow that structure-preserving substitution can open, not a redaction problem.
Where it fits
This is one industry view of sensitive AI workflow enablement, the broader practice of running AI on data you are not allowed to expose. The same pattern carries into other regulated settings; see how it plays out for clinical workflows on PHI, where the document is a chart instead of a credit file, and how the boundary changes when the sensitive text lives inside images and scanned pages in visual sensitive data.
One more thing falls out of running the workflow this way. Because the raw contract values and customer identities never leave the boundary, the bank’s own data-privacy and financial-confidentiality obligations have a clean answer, and security and legal reviewers get a concrete basis to approve. Supervisors point the same way: BCBS 239 expects banks to aggregate risk data accurately and completely, leaning on automation rather than manual steps to keep the probability of error low, a standard a workflow that ends in retyping was never going to meet. The systemic view lines up: the Financial Stability Board lists model risk alongside data quality, governance, and cyber risk among the AI vulnerabilities it watches most closely. That approval is a by-product of how the work runs, not the reason to run it.
LLM Capsule is how CUBIG runs AI document analysis on financial documents without the figures leaving. Statements and schedules are substituted in place, so the model reads the real structure while the numbers stay inside your environment.
