AI Provenance and Evidence
Provenance answers where something came from and who contributed to it. Evidence answers what an organization can still demonstrate afterwards, to someone who was not there and may not be inclined to take its word for it.
Two different questions
Provenance is about origin: which sources a piece of work drew on, which people and systems contributed, what it was derived from, and how it changed along the way.
Evidence is about proof after the fact: whether a durable record exists, whether it was produced as part of normal operation rather than reconstructed later, and whether it is complete enough to answer a question nobody anticipated when the record was made.
A system can have reasonable provenance and still produce poor evidence — for example if the record is overwritten, if it lives only in one supplier's console, or if it cannot show that authority existed at the time.
Why AI makes this harder
When a person writes a document, their authorship is largely self-evident. When a system drafts, summarizes, extracts, classifies or decides, the resulting artefact does not carry that context unless something deliberately attaches it.
The gap tends to be discovered late — during an audit, a dispute, a regulatory request or an incident — which is the worst moment to learn that the record was never kept.
What organizations need to be able to show
That an action was permitted at the time it occurred, not merely that it appeared reasonable in hindsight.
Under whose authority it was taken, distinguishing the person accountable from the system that carried it out.
What contributed to the result, including where automated assistance was involved.
That the record is durable and was produced as a by-product of the work rather than assembled afterwards.
Frequently asked questions
What is AI provenance?
AI provenance is the record of where a piece of work came from: which sources it drew on, which people and systems contributed to it, and how it changed over time.
How can organizations maintain evidence of AI activity?
By producing the record as part of normal operation rather than reconstructing it later, keeping it durable and independently held, and ensuring it captures the authority an action was taken under — not only that the action occurred.
Why is provenance different from an audit log?
An audit log generally records that events happened. Provenance additionally describes origin and contribution — what the work was derived from and who or what shaped it.