The proof problem that compliance leaders don’t talk about
Every digital file can be edited after the fact. Regulators now ask you to prove that compliance evidence was created when you say it was, not merely that it exists. This paper explains the gap, shows where it is already causing real losses, and sets out two ways to close it, step by step.
Prefer watching
The seven-minute overview
The same argument, presented by David Horne of immut, with a live demonstration of file anchoring and verification. On screen throughout: the actual regulator rulings and a real blockchain record.
In brief
Five things this paper argues
- Every digital file can be edited in seconds, with free tools, leaving no visible trace.
- You cannot reliably tell whether a client’s, supplier’s, or customer’s records are genuine or backdated.
- More regulation raises the cost of compliance without fixing the underlying evidence problem.
- The four things you need to provide real compliance evidence.
- A public ledger can give a record all four, in seconds, for a fraction of a penny.
The problem
Is any digital file actually trustworthy?
A Word document, a Slack message, an email, a database audit log. Each can be altered in seconds with free tools, leaving no trace visible to a reviewer without forensic access to the original system.
Word and Excel. File metadata, including creation date and last-modified date, can be overwritten with free tools such as ExifTool in seconds. Document contents are trivially editable with no forensic record.
Email. Headers record sending time only on the sending server. Body text and attachments are modifiable by anyone with mailbox access. Export-to-PDF workflows strip the original headers entirely.
Slack and Teams. Editing is a designed feature. Administrative accounts can alter message history. Channel exports carry no cryptographic integrity guarantees.
Databases and cloud storage. Version history and audit logs sit on the same infrastructure as the data itself. A sufficiently privileged administrator can alter both the record and the log that recorded it.
AI as the accelerant. Fabricating a convincing compliance document once required skill and inside access. AI has removed both constraints. Realistic invoices, technical reports, and signed-off records can now be generated in minutes, indistinguishable in appearance from genuine ones.
The exposure
Can you trust the evidence your stakeholders give you?
Three sources of risk face every compliance professional: internal records, supply-chain evidence, and documentation provided by customers.
Internal evidence. Employees facing audit or investigation have an obvious motive to present favourable records. Document, quality, and incident systems all sit on infrastructure the business controls. Without independent anchoring, you cannot tell an original record from a revision made after the fact.
Supply-chain evidence. ISO certification, health and safety documentation, GxP batch records, and R&D technical reports can be supplied by a vendor who generated them retrospectively to satisfy an audit. A client may have done nothing wrong. Their supplier may have provided false records that are indistinguishable from genuine ones.
Customer-supplied evidence. In regulated industries, customers supply documentation the business must treat as reliable: disclosure forms, test results, compliance certificates. Each carries the same vulnerability.
Without independent verification, you are letting every stakeholder mark their own homework. The party with the most to gain from a record is the same party that created it, stored it, and dated it. Nothing outside their control confirms that it is true.
Real cases
It is already happening
Six regulators. Five industries. Three continents. In each case the evidence infrastructure failed in one of two ways: genuine records existed but could not be proved; or fabricated records passed as genuine because they were indistinguishable from the real thing.
Fined not for failing to implement security controls, but for being unable to demonstrate to the regulator that those controls were in active use at the time of an NHS data breach.
ico.org.uk ↗
Could not produce records showing that gas risers in 769 high-rise buildings had ever been inspected. The fine was entirely for the absence of provable records, not for any safety failure.
energylivenews.com ↗
Boeing agreed to plead guilty to conspiracy to defraud the United States, for misleading the FAA about the 737 MAX flight-control system. The proposed fine was up to $487.2m. What an organisation tells its regulator is only as good as the records behind it.
pbs.org/frontline ↗
Fabricated clinical and stability data submitted to the FDA to win drug approvals. The company pleaded guilty to seven federal criminal counts.
oig.hhs.gov ↗
False invoices and fabricated expense descriptions used to divert party funds undetected for 12 years. Sentencing: 23 June 2026.
Irish Times ↗
A finance employee authorised 15 transfers after a video call with a deepfake CFO and colleagues. Every other participant on the call was AI-generated from real footage.
CNN Business ↗
Alleged false R&D tax credit reports, including reports written by English literature graduates for a horse stud farm and a butcher. HMRC’s first corporate prosecution under the Criminal Finances Act 2017. Trial: September 2027.
Bureau of Investigative Journalism ↗All charges alleged. No pleas or convictions entered.
Solid top border records were fabricated or a regulator was misled, and the deception was not visible in the documents.
Dashed top border genuine records existed but the organisation could not prove it to the regulator.
The response
The regulator’s answer: more rules
Governments have recognised the evidence gap. Their response has been to add specificity, frequency, and enforcement teeth to existing requirements, while the burden of proof shifts onto the organisation.
| Framework | Instrument | Evidence requirement | Since |
|---|---|---|---|
| ISO 27001 | Annex A 8.15 / Clause 7.5 | Immutable logging of security events; documented information protected against loss of integrity | 2022 revision |
| R&D tax credits (UK) | HMRC Additional Information Form; Criminal Finances Act 2017 | Contemporaneous technical evidence for every claim; criminal liability for advisers who fail to prevent facilitation of evasion | August 2023 |
| Life sciences / GxP | FDA 21 CFR Part 11; ALCOA+ | Records must be attributable, legible, contemporaneous, original, and accurate; at the enforcement peak, 79% of FDA drug GMP warning letters cited data-integrity failures (FY2016) | In force |
| Health and safety (UK) | HSE Sentencing Framework | Absence of records treated as evidence of inadequate management, not mere administrative oversight | In force |
The cost of more regulation on business is not sustainable
More rules raise the cost of compliance. They do not fix the underlying evidence problem. The tools used to produce the evidence, Word, Excel, email, databases, have not changed. The gap between what regulators require and what these tools can prove keeps widening.
The upside
What changes if the evidence can be trusted
Much of the cost in compliance exists to compensate for records that cannot prove themselves. Remove the doubt and the whole cost structure changes.
Cheaper audits
Auditors spend less time corroborating what they cannot take on trust. Verification replaces investigation.
Less regulation needed
Many rules exist only to compensate for records that cannot prove themselves. Provable records reduce the need for more of them.
Lower cost of compliance
Less duplication, less rework, and fewer disputes over what happened and when.
Trust across the chain
Every stakeholder can rely on the same record, so relationships rest on proof rather than assurances.
The organisations that adopt verifiable evidence first turn a cost centre into a competitive advantage. Buyers, regulators, and partners prefer a counterparty whose records prove themselves. Early movers set the standard everyone else is later asked to meet.
The standard
What proof actually requires
Before looking at solutions, it is worth being precise. Evidence must have four properties to satisfy a sceptical third party. A document on a company file server has none of them.
- Contemporaneous
- Created at the moment of the activity it describes, not retrospectively. Timestamp accurate to the second. Not creatable after the fact.
- Tamper-evident
- Any change after creation is detectable by anyone, not just by a forensic examiner with access to the original system.
- Independently verifiable
- Verifiable by the challenging party without relying on the organisation that created it, the software used, or any intermediary.
- Court-ready
- Meets the evidentiary standard of the relevant jurisdiction and has been accepted in that jurisdiction’s proceedings.
How to fix it
Two ways to give a record those four properties
The first uses people and coordination. It works in principle and is worth understanding, because it shows what proof really demands. The second achieves the same result automatically.
The thorough way: independent witnesses
Send a copy of each significant record to several independent parties at the moment of creation. If the record is ever challenged, ask every party to produce their copy at the same time. This mirrors the rule of corroboration in Scots law: no one can be convicted on a single witness alone. Independent agreement between parties with no reason to fabricate the same story is a reliable indicator of truth.
- Make the record and copy itAt the moment the document is created, produce identical copies for several genuinely independent parties: a solicitor, an accountant, a trade association, a client.
- Send all copies at onceDistribute every copy simultaneously, so each custodian receives the same document on the same date.
- Each party stores it, unchangedEvery custodian keeps their copy indefinitely, in a format they can retrieve later, recording the date received.
- Reconcile on challengeIf the record is ever disputed, ask all parties to produce their copies together. If every copy matches, the agreement corroborates that the record has not been altered.
- Conceptually simple and needs no technology.
- Uses independent parties you may already work with.
- Slow and costly at scale: every document, multiplied by every custodian.
- Each custodian must store and retrieve it, reliably, indefinitely.
- Still requires trusting each custodian, the very problem it set out to solve.
The simple way: anchor it once
The same corroboration principle, achieved automatically. A public blockchain becomes the always-available, always-neutral witness. It cannot be persuaded, pressured, or compromised, and a regulator can check a record against it directly, without going through the company that produced it.
- Create a one-way code of the fileA cryptographic hash, a short code unique to the exact contents of the file, is generated from it. Change one character and the code changes completely. The file itself is never placed on the blockchain. Only this one-way code is.
- Record the code on a public blockchainThe code and a timestamp accurate to the second are written to a public blockchain. That record is permanent and cannot be altered, deleted, or suppressed by anyone, including the company that created it.
- Receive the certificateA certificate is issued, referencing the permanent on-chain record. The whole process takes under 30 seconds and costs a fraction of a penny.
- Anyone can verify, independentlyTo check a document, a regulator or any third party re-generates the code from the file and compares it against the blockchain. If the codes match, the file is identical to the one recorded at that date. They never have to take the company’s word for it.
- Seconds per file, at a fraction of a penny.
- Verifiable by anyone, including a regulator, directly, with no intermediary to trust.
- The file is never placed on the blockchain, only a one-way code of it.
- Already accepted as evidence across 88 countries.
- Needs a tool to generate the code and record it.
- Relies on the public blockchain remaining available, which it is designed to do.
See it against your own framework
If it helps, David Horne will hash a file with you and walk through how the certificate maps to the standard you advise on. Fifteen minutes, no slides. Or prove a file yourself first.
Standing in court
Already accepted as evidence
A blockchain-anchored timestamp is not a novelty awaiting a test case. Courts across three legal traditions have accepted it, and an immut certificate is recognised across 88 countries and 171 jurisdictions.
- China Internet Courts. Blockchain timestamp evidence accepted since 2018, formalised by the Supreme People’s Court in September 2018.
- United States v. Sterlingov. US District Court for the District of Columbia, 2024.
- AZ Factory v. Valeria Moda. Tribunal Judiciaire de Marseille, 20 March 2025. The first European judgment to accept a blockchain timestamp as standalone proof of authorship, recognised across all 27 EU member states under eIDAS Article 41(2).
Public proof. Private work. Your file never goes on the blockchain. Only a one-way code of it does.
The method, in one line
Contact
djh@immut.io · +44 (0) 7876 716 098
References
Sources
- The Journal and Irish Times, reporting on Peter Murrell’s guilty plea, 25 May to 2 June 2026. Operation Branchform background.
- Meridian Discovery, “Date Forgery Analysis: Timestamp Resolution” and “Word Forensic Analysis: Compound File Binary,” meridiandiscovery.com.
- US Department of Justice, “Boeing Agrees to Plead Guilty to Federal Felony Charge,” 2024. justice.gov. (737 MAX conspiracy to defraud the FAA; proposed fine up to $487.2m. The plea agreement was later rejected by the court.)
- HHS Office of Inspector General, “Generic Drug Manufacturer Ranbaxy Pleads Guilty and Agrees to Pay $500 Million,” 13 May 2013. oig.hhs.gov.
- Bureau of Investigative Journalism, “HMRC Charges First Company Ever Under Landmark Tax Evasion Powers,” 7 August 2025. All charges alleged; no convictions entered.
- CNN Business and Fortune, reporting on the Arup deepfake loss, Hong Kong, 16 to 17 May 2024.
- UK Information Commissioner’s Office, Advanced Computer Software Group Ltd penalty notice, 2025. ico.org.uk.
- UK Health and Safety Executive, National Grid Gas plc enforcement, 2021. hse.gov.uk.
- LAist and CalMatters, reporting on AI-fabricated citations in US court filings, 2025. Stanford RegLab research on AI hallucinations in legal filings.
- Barbara Unger, Unger Consulting Inc., annual analyses of FDA drug GMP warning letters (79% FY2016, 68% 2017, 57% FY2018; compounding-pharmacy letters excluded). pharmaceuticalonline.com. FDA, “Data Integrity and Compliance With Drug CGMP: Questions and Answers, Guidance for Industry,” December 2018. fda.gov.
- US Chamber of Commerce, Small Business Index, Q4 2024.
- Thomson Reuters, Cost of Compliance Report, 2023.
- BusinessEurope, “Mapping of Regulatory Burden,” January 2025.
- Criminal Procedure (Scotland) Act 1995; Scottish Law Commission Discussion Paper No. 174, “Corroboration,” 2019.
- immut certificates recognised under the UNCITRAL Model Law on Electronic Transferable Records 2017, the UK Electronic Trade Documents Act 2023, and eIDAS Regulation (EU) 910/2014.