You may already be legally required to prove what your AI did.
Beyond the headline AI laws sit court rulings, sector rules and older statutes that already demand records nobody can argue with. Each one below says what the law itself demands, links the official text, and lists evidence that satisfies it.
What the law demands: Producing a score is itself an automated decision under GDPR Article 22 when a third party draws strongly on it to grant, refuse or set terms.
Why that means provable records: Anyone who scores people for others is caught by the automated-decision rules, and needs a record of every score and its basis.
What the law demands: The right of access requires a concise, intelligible explanation of the procedure and principles actually applied to the person's data to reach the decision. Handing over a formula is not enough; trade secrets are weighed by the court or authority, not used as a blanket refusal.
Why that means provable records: You must be able to reconstruct each individual decision, after the event, in plain language.
Bridges: unchecked bias made facial recognition unlawful
R (Bridges) v Chief Constable of South Wales Police [2020] EWCA Civ 1058 · official text
What the law demands: Use of live facial recognition was unlawful, in part because the force had not done enough to satisfy itself the software was not biased, as the Public Sector Equality Duty requires.
Why that means provable records: A public body using AI must be able to show it checked the system for bias before and during use.
What the law demands: Public authorities, and anyone exercising public functions, must have due regard to eliminating discrimination and advancing equality of opportunity.
Why that means provable records: Due regard has to be shown, at the time, before a decision. A record made afterwards does not satisfy it.
ATRS mandatory scope and exemptions policy · official text
What the law demands: Central government organisations must publish a record for each algorithmic tool that significantly influences decisions with public effect or interacts directly with the public.
Why that means provable records: Suppliers to government need records their customers can publish.
What the law demands: Anyone can request information held by a public authority, which must answer within 20 working days unless an exemption applies.
Why that means provable records: Records of how a public body's AI reached decisions can be requested by the public, so they need to exist and be reliable.
Data Act: smart contracts need a kill switch and an archive
Regulation (EU) 2023/2854, Article 36 · official text
What the law demands: Vendors of applications using smart contracts to execute data-sharing agreements must ensure robustness and access control, safe termination and interruption, archiving of transaction data, logic and code for an auditable record, and consistency with the agreement.
Why that means provable records: Automated agents that execute agreements need a stop control and an auditable record of every transaction.
Regulation (EU) No 910/2014 (as amended by 2024/1183), Article 41 · official text
What the law demands: An electronic time stamp shall not be denied legal effect or admissibility as evidence solely because it is electronic or not qualified. Qualified time stamps enjoy a presumption of accurate date and time.
Why that means provable records: A timestamp proving when a record existed is admissible evidence across the EU.
Machinery Regulation: self-evolving machines must record their safety decisions
Regulation (EU) 2023/1230, Annex III · official text
What the law demands: Machinery and safety components with fully or partially self-evolving behaviour must record data on the safety-related decision-making process, kept for a year, and log interventions and safety software versions.
Why that means provable records: Robots and AI-driven machines need a tamper-proof decision log before they can carry a CE mark.
Algorithmic trading: records, kill switch and annual self-assessment
MiFID II Article 17 and Delegated Regulation (EU) 2017/589 (RTS 6) · official text
What the law demands: Investment firms trading algorithmically must test algorithms, have kill functionality, monitor in real time, keep records and carry out an annual self-assessment.
Why that means provable records: Every algorithmic order and control action needs a record a supervisor can check.
Regulation (EU) 2022/2065, Articles 17 and 24(5) · official text
What the law demands: Hosting services must give a clear statement of reasons for each restriction of content or accounts, including whether automated means were used, and online platforms submit these to the public DSA Transparency Database.
Why that means provable records: Every automated moderation decision needs a record of what was decided, why, and whether a machine did it.
Regulation (EU) 2019/1150, Articles 4 and 5 · official text
What the law demands: Online intermediation services must give business users a statement of reasons before restricting, suspending or terminating them, and set out the main parameters that determine ranking.
Why that means provable records: Marketplaces and app stores need a record of each automated restriction and the ranking logic in force at the time.
What the law demands: Pay structures must rest on objective, gender-neutral criteria; workers can request pay information; and where discrimination is presumed, the employer must prove there was none.
Why that means provable records: AI used to set pay, grades or bonuses needs records showing the criteria applied to each decision.
What the law demands: Products, including connected products with software features, must be safe; manufacturers keep technical documentation, handle complaints and notify accidents through the Safety Business Gateway.
Why that means provable records: Software-driven products need a record of complaints, incidents and the version in use when something went wrong.
Regulation (EU) 2024/2847, Article 14 · official text
What the law demands: Manufacturers must notify actively exploited vulnerabilities and severe incidents with an early warning within 24 hours, a notification within 72 hours and a final report.
Why that means provable records: You need provable timestamps of when you became aware and when you reported.
UK GDPR Articles 22A to 22D, inserted by the Data (Use and Access) Act 2025 · official text
What the law demands: Significant decisions based solely on automated processing must come with safeguards: information about the decision, the ability to make representations, human intervention and the right to contest.
Why that means provable records: Each automated decision needs a record of the decision, the information given and any human review.
What the law demands: Employers using automated employment decision tools must have an independent bias audit within the past year, publish its results and notify candidates.
Why that means provable records: Hiring AI needs audited, dated evidence before use.