What it means
AI evidence chain of custody records who collected, transferred, accessed, transformed, stored, and analyzed evidence from an AI system or incident.
Why it matters
Model artifacts, prompts, outputs, and telemetry may contain sensitive data and can be altered easily, making documented custody essential for reliable investigation and assurance.
Practical focus
- Define the system boundary, accountable owner, approved purpose, material risks, and decision authority for AI Evidence Chain of Custody
- Use unique evidence identifiers, tamper-evident hashes, controlled storage, transfer receipts, access logging, handling restrictions, and documented analysis copies.
- Collect and protect this evidence: collection notes, hashes, timestamps, custodians, transfers, storage locations, access history, tool versions, and final disposition.
- Exercise this failure scenario as a planned test: a prompt log is exported, edited for readability, and passed between teams without preserving the original or recording transformations.
Common mistakes
- Using the label AI Evidence Chain of Custody without defining the exact systems, data, people, decisions, and time period in scope
- Treating a policy statement or tool demonstration as proof that AI Evidence Chain of Custody operates consistently in production
- Failing to retain collection notes, hashes, timestamps, custodians, transfers, storage locations, access history, tool versions, and final disposition in a form that lets an independent reviewer reconstruct decisions and changes
- Testing only the normal path and never rehearsing what happens when a prompt log is exported, edited for readability, and passed between teams without preserving the original or recording transformations.
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: