The EU AI Act requires you to prove what your system was trained on and could do, and when, at every version.

Acquiring, curating, and documenting the datasets used to train foundation models, fine-tuned models, and AI-assisted products.

Timestamp each data licence and dataset snapshot at the moment of acquisition. If a copyright holder, regulator, or court demands to know whether a specific dataset was licenced at the time it was used for training, the blockchain record proves the licence existed before the training run, not that it was obtained retrospectively after a claim.

GEMA successfully sued OpenAI in November 2025 after showing that song lyrics used to train ChatGPT were returned almost identically by the model when requested. The court ordered OpenAI to cease saving the lyrics and pay damages. Thomson Reuters won summary judgment in February 2025 after ROSS Intelligence used Westlaw content without authorisation to train its AI legal research tool.

Versioning trained models, documenting their capabilities and limitations, and recording the approval process before each production deployment.

Timestamp the model card and evaluation results at the moment of each version's deployment decision. Under the EU AI Act's technical documentation requirements for high-risk systems, you must be able to show what the system was capable of at any point in time. An independent timestamp proves the documentation existed before deployment, not that it was reconstructed for a regulatory audit.

The EU AI Act requires high-risk AI system providers to maintain technical documentation sufficient to allow regulators to assess compliance. By August 2026, all in-scope systems must have complete, timestamped documentation covering capabilities, limitations, and performance. Non-compliance carries penalties up to €15M or 3% of global turnover.

Conducting data protection impact assessments and data inventory reviews before training runs that involve personal data.

Timestamp the DPIA and data inventory at the moment the training run is authorised. If a GDPR investigation or EU AI Act audit questions whether prohibited data was processed, the blockchain record proves the data governance review was completed before the training commenced, not that it was reconstructed after the inquiry began.

Processing personal data to train an AI system without a lawful basis and a contemporaneous record of the legal basis assessment is a violation of UK and EU GDPR. Regulators have broad powers to investigate AI training practices. A contemporaneous DPIA and data inventory are the primary evidence that the processing was lawful at the time it occurred.

Conducting and documenting the conformity assessment process for high-risk AI systems before they are deployed in the EU, as required by EU AI Act Article 43.

Timestamp each conformity assessment document at the point of completion. In a market surveillance authority investigation, the blockchain record proves the assessment was completed before the system was deployed, not compiled retrospectively to satisfy an inquiry after an incident.

National market surveillance authorities under the EU AI Act have powers to require withdrawal of high-risk systems that cannot demonstrate conformity. Under Article 65, member states must report product market surveillance actions to the European AI Office. Absence of contemporaneous conformity documentation is grounds for enforcement.

Recording the human oversight measures in place for high-risk AI systems making or assisting with consequential decisions about individuals.

Timestamp the human oversight policy and the records of oversight interventions at the moment they occur. Under GDPR Article 22 and EU AI Act Article 14, individuals have rights in relation to solely automated decisions. An independent timestamp of the oversight record proves the measure existed and was followed at the time of the decision.

Failure to maintain contemporaneous records of human oversight for automated decision-making can lead to ICO or DPA enforcement under GDPR Article 22, and compound enforcement under the EU AI Act for high-risk systems. An individual data subject complaint that finds no oversight records at the time of a decision is treated as evidence of no oversight.

Logging and approving significant changes to AI system behaviour, training data, or architecture before they are deployed to production.

Timestamp each significant change record at the point of approval. The EU AI Act requires providers to log and assess the impact of substantial modifications on the system's compliance status. An independent timestamp proves the change was logged before deployment, not that the record was created after a post-deployment incident raised questions.

A substantial modification to a high-risk AI system that was not logged before deployment may require a new conformity assessment. Without an independent timestamp of the change record, the regulator cannot determine whether the modification occurred before or after the last compliant baseline, and will treat the gap as non-compliance.

Maintaining records of training run parameters, data snapshots, and model checkpoints for audit and reproducibility purposes.

Timestamp training run manifests and data snapshot hashes at the moment each training run is initiated and completed. Model file metadata is controlled by the organisation and can be altered by anyone with file system access. An independent blockchain timestamp proves the training run occurred at the claimed time, satisfying EU AI Act Article 12 logging requirements.

EU AI Act Article 12 requires high-risk AI systems to be designed to automatically generate logs of events at the level of granularity necessary to identify serious incidents. Post-hoc reconstruction of training records is not accepted as equivalent to contemporaneous logging. Absence of auditable training records is a direct route to enforcement.

Preparing model cards, system cards, and transparency disclosures before releasing AI systems to developers, customers, or the public.

Timestamp the model card at the moment it is finalised and before the system is released. Under the EU AI Act's transparency obligations for general-purpose AI models, providers must maintain up-to-date technical documentation. An independent timestamp proves the disclosure existed before the release, not that it was added after a transparency complaint.

The EU AI Act imposes transparency obligations on providers of general-purpose AI models. Providers of models with systemic risk face additional documentation requirements. Non-compliance with transparency obligations carries penalties up to €15M or 3% of global turnover, with the European AI Office empowered to demand documentation at any time.