{
  "title": "Input Provenance Notice",
  "statement": "Since 9 November 2026 a published, open and free method has existed for checking, at the moment of use, that data given to an AI system is the data its source stands behind, and for keeping an independently checkable record of that check. From that date it cannot be said that the origin and integrity of an AI system's inputs could not practicably be checked.",
  "method": {
    "since": "2026-11-09",
    "what": "A source hosts one file on its own domain listing the SHA-256 fingerprint of each piece of data it stands behind. A checker fingerprints the input and compares. The answer is sealed and timestamped into Bitcoin.",
    "format": "https://sebbi.pro/x/vsource/spec",
    "gate": "https://sebbi.pro/x/garbagegate/spec",
    "cost": "Free to host, free to check. Only a fingerprint leaves the organisation."
  },
  "principle": "None of these rules has changed. Each one measures conduct against what can reasonably be done. What can reasonably be done has changed.",
  "what_no_longer_stands": [
    {
      "rule": "EU AI Act, Article 10(2)(b)",
      "asks": "Data governance for high-risk AI must cover data collection processes and the origin of data.",
      "now": "Origin can be checked against the source itself and the check sealed. A provider's own note of where data came from is no longer the best evidence available."
    },
    {
      "rule": "EU AI Act, Article 26(4)",
      "asks": "A deployer that controls the input data must ensure it is relevant and sufficiently representative.",
      "now": "Each input can be gated before use and the result kept with the decision. 'We took the supplier's word for it' is no longer the only option."
    },
    {
      "rule": "GDPR and UK GDPR, Article 5(1)(d) and 5(2)",
      "asks": "Personal data must be accurate, every reasonable step must be taken, and the controller must be able to show it.",
      "now": "Checking data against its source before acting on it is a reasonable step that costs nothing, and it produces the proof Article 5(2) asks for."
    },
    {
      "rule": "GDPR and UK GDPR, Articles 25(1) and 32(1)",
      "asks": "Technical measures are judged taking into account the state of the art.",
      "now": "The state of the art now includes a published, free check of input integrity at the point of use."
    },
    {
      "rule": "ISO/IEC 42001:2023, Annex A control A.7.5",
      "asks": "A defined and documented process for recording the provenance of data used in AI systems.",
      "now": "The provenance record can be one that anyone can check, in place of one written and held by the organisation it describes."
    },
    {
      "rule": "England and Wales: the presumption that a computer was working properly",
      "asks": "A court presumes the computer worked unless the contrary is shown.",
      "now": "The presumption says nothing about what was fed in. A sealed input check does, and a party without one can be asked why not."
    }
  ],
  "questions": [
    "Which source did each input to this decision come from?",
    "Did that source stand behind the data, and how do you know?",
    "Was the data checked against the source before the system used it, or afterwards, or never?",
    "Can someone outside your organisation repeat that check today?"
  ],
  "notice_version": "1",
  "sha256": "9ff26fe2c1aaa8cb20ef323827210b20a3c99e21b712620cb7b7d77026a30a98",
  "sealed_utc": "2026-11-11 14:45:28 UTC",
  "sealed_block": 38711,
  "fingerprint_rule": "SHA-256 of the canonical JSON of the notice (keys sorted, separators ',' and ':', UTF-8)",
  "page": "https://sebbi.pro/garbage-in#notice",
  "check_the_chain": "https://sebbi.pro/forever"
}