Witnium logo
WITNIUM. Chain.

News · The Evidence Question

Share

The evidence, explained.

Rules, cases and ideas about proving what happened. Every article is sourced, reviewed by a person and sealed with WitniumChain.

Get access now
Latest articles
FlashImportant today

CRA's *24-hour reporting window* starts when you notice, not when it suits

From 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities and severe incidents through ENISA's Single Reporting Platform within 24 hours of becoming aware. A new workshop addresses how it works in practice.

Today in evidenceFriday, 16 October 2026 · 09:30

Deepfakes, fines and the courts: trust is becoming a technical question

OpenAI and Meta warn US judges about deepfakes. Bank of America pays $1.2 billion. Courts face AI-generated evidence they can't verify.

Vera is an AI-generated presenter. Image and voice are made with AI; the script is taken word for word from the published briefing.
Read the full briefing →
  1. 01

    OpenAI and Meta warn US courts about deepfakes

    OpenAI and Meta have told the US judiciary that deepfakes are now so convincing that determining whether audio and video evidence is real will be increasingly difficult.

    reuters.com
  2. 02

    Bank of America fined $1.21 billion for AML lapses

    The US Treasury has fined Bank of America $1.21 billion for failures in anti-money laundering controls and alleged sanctions violations.

    Compliance Week (subscription)
  3. 03

    Deepfake video of Bhutanese woman posted without consent

    A pornographic deepfake showing a woman's face was reportedly posted online. No one can prove which AI system was used, when the manipulation happened, or who made it.

    AI Incident Database
  4. 04

    EU begins enforcing AI Act transparency rules

    Article 50 of the AI Act is now in force, requiring AI systems to identify themselves and AI-generated content to be labelled. Applies across sectors where AI talks to people or creates public content.

    cineuropa.org
Weekly
Abstract illustration of software becoming a product under EU liability rules

Sector · Legal

Rules · 2026-10-16 · 4 min read

The AI Liability Directive was withdrawn: what *the Product Liability Directive* does instead

The European Commission withdrew its proposed AI Liability Directive in early 2025, leaving the new Product Liability Directive as the main EU instrument for claims over AI-related harm. Software is now a product, liability is strict, and courts can order defendants to hand over evidence.

Abstract representation of a five-year software change trail with sealed records

Sector · Manufacturing

Rules · 2026-10-16 · 4 min read

The Machinery Regulation asks for a *five-year trail* of software changes

From 20 January 2027, machines placed on the EU market must log safety-relevant software changes in a way that can be traced for five years. The regulation also requires protection against corruption and specific measures for machines with self-learning behaviour.

Two overlapping timing mechanisms representing CRA and DORA reporting deadlines

Rules · 2026-10-16 · 4 min read

CRA's 24-hour clock starts when you notice, not when it suits you

The Cyber Resilience Act requires manufacturers to report actively exploited vulnerabilities and severe incidents within 24 hours of becoming aware. DORA already asks financial entities for similar speed. Here's how the two frameworks overlap, and what that means for logs.

Abstract illustration of overlapping waveforms and medical symbols

Sector · Healthcare and medtech

Cases · 2026-10-16 · 4 min read

California health system secretly recorded patients with AI scribe, lawsuit claims

A proposed class action alleges Sharp HealthCare used AI medical scribe technology to record doctor-patient conversations without telling patients. The case turns on a simple question: can the hospital prove what its AI captured, who heard it and how the recordings were kept?

Illustration of a chat bubble and a receipt, representing the record of what a chatbot said

Sector · Advertising and media

Cases · 2026-10-16 · 5 min read

Eight US states sue OpenAI over ChatGPT's *consumer protection* breaches

The lawsuit claims OpenAI's chatbot harms children, deceives users and breaches state consumer laws. It raises a practical question: can you show what your AI promised, if the customer turns up with a screenshot?

Illustration of a conversation bubble next to a receipt, representing the customer's and the organisation's records of what a chatbot said

Sector · Debt collection and credit

Cases · 2026-10-16 · 5 min read

When a chatbot makes a promise: who keeps the record?

Riverty says AI makes debt collection less embarrassing for customers. The company's 100-day AI transformation raises a question every chatbot operator should ask: if a customer turns up with a screenshot, could you show what your AI actually said?

Abstract illustration of a software change timeline with traceable markers

Sector · Manufacturing

Rules · 2026-10-16 · 4 min read

The Machinery Regulation puts *software logs* on the list for 2027

From 20 January 2027, machines placed on the market must log safety-relevant software changes for five years and be protected against corruption. For self-learning machines, the requirements go further.

Abstract illustration showing the transition from physical machinery to software-controlled systems

Sector · Manufacturing

Rules · 2026-10-16 · 4 min read

Is the Machinery Directive 2006/42/EC still valid? What changes on 20 January 2027

From 20 January 2027, Regulation (EU) 2023/1230 replaces the Machinery Directive. It brings stricter requirements for manufacturers, including mandatory logging of safety-relevant software changes and five-year traceability.

Abstract illustration of autonomous AI decision pathways

Sector · HR and recruitment

Ahead · 2026-10-16 · 5 min read

Workday's autonomous AI agents raise questions nobody has answered yet

Workday is rolling out AI agents that will act on their own in finance and HR workflows. The company says customers can set controls. What it doesn't say is how you prove what the agent did, or didn't do, six months later.

Abstract illustration representing AI agent authorisation and governance

Ahead · 2026-10-16 · 3 min read

ServiceNow gives AI agents a passport, and limits on what they can do

ServiceNow has launched AI Passport, a runtime governance layer that controls what AI agents and Model Context Protocol servers are authorised to do at each step of multi-agent workflows.

Timeline showing CRA reporting deadlines at 24 hours, 72 hours and 14 days

Sector · Manufacturing

Rules · 2026-10-15 · 4 min read

ENISA's new reporting platform lets manufacturers seal incident timelines

ENISA has launched a Single Reporting Platform for manufacturers to report actively exploited vulnerabilities and severe incidents under the Cyber Resilience Act. The platform centralises CRA reporting and brings the 24-hour clock into sharp focus.

Abstract illustration suggesting transparency through overlapping shapes

Sector · Advertising and media

Rules · 2026-10-15 · 6 min read

The EU's new *AI content labels*: what deployers must actually do

A Code of Practice sets out how to label deepfakes and AI-generated text under Article 50 of the AI Act. Section 2 is for deployers: the people who publish the content.

Illustration of a 24-hour clock and three connected criteria nodes

Sector · Manufacturing

Rules · 2026-10-15 · 4 min read

CRA's 24-hour rule for exploited vulnerabilities: what the new ENISA guidance says

ENISA has published guidance on reporting 'particularly exceptional circumstances' under the Cyber Resilience Act. It clarifies when manufacturers must send an early warning within 24 hours, and when they have more time.

What's coming

  • 2026-12-02AI Act: marking of AI-generated content (Article 50(2)) for systems placed on the market before 2 August 2026Source
  • 2026-12-09New EU product liability rules apply to products placed on the market after this dateSource
  • 2027-12-02AI Act: high-risk rules for Annex III systemsSource
  • 2027-12-11Cyber Resilience Act: main obligations applySource
  • 2028-08-02AI Act: high-risk rules for Annex I systemsSource
Pass it on

Know someone who should follow this?

Share WitniumChain News with a colleague, your compliance team or your network.

Email

RSS feed