The question isn't whether you have records. It's whether you can prove when they existed.

ISO auditors now challenge evidence that cannot be dated independently. Annex A 8.15 requires tamper-evident logs. If your records cannot prove when they were created, the control fails.

HMRC requires contemporaneous evidence of qualifying activity — not retrospective narratives. Invoices satisfy Test 1. They do not satisfy Test 2. The first criminal prosecution of an R&D adviser landed in 2025.

ALCOA+ requires records to be contemporaneous. FDA inspectors treat records that cannot prove their creation date as failing the standard — triggering warning letters, consent decrees, or import alerts.

The HSE fines organisations not for lacking policies, but for lacking evidence that procedures were followed. No harm needs to have occurred. The evidential gap alone attracts a penalty.

GDPR Article 5(2) requires controllers to demonstrate compliance — not assert it. Meta was fined €17M not because controls were absent, but because their operation could not be demonstrated.

The EU AI Act requires high-risk AI systems to maintain logs of training data provenance. Proving what data was used, and when, requires independently verifiable records that cannot be reconstructed retrospectively.

Proving a trade secret existed before an alleged misappropriation requires contemporaneous evidence. Courts apply the Ridgeway standard: you must show the information was a secret at the time it was taken.

Proving prior creation in IP disputes, copyright registration, and derivation proceedings requires evidence that cannot be challenged as backdated. The question is not authorship — it is when.