Spotting AI-Generated Evidence: A Checklist for Litigators

Treat every key exhibit as something that may have been created or altered by AI, and ask the other side four things early: where the file came from, who held it and how, whether the original file with its metadata exists, and what verification has been done. Escalate to a forensic expert where answers are vague or the file shows red flags.

No visual test or detection tool is conclusive, so the approach is process, not intuition. The National Center for State Courts (NCSC) has published guidance for judges on AI-generated evidence, with two bench cards, one for evidence that is openly AI-made and one for evidence presented as genuine that may not be. The useful move for a litigator is to turn that judge-facing framing into questions for the other side, for your own client and for an expert. Wherever I add practical suggestions beyond the guidance, I say so.

Follow me on Instagram@sagnikteaches

Two kinds of AI evidence, and why the difference matters

The NCSC guidance separates evidence into two categories, and the split shapes your tactics.

Connect on LinkedInSagnik Bhattacharya

Acknowledged AI-generated evidence is disclosed as such by the party offering it. Typical examples are an accident reconstruction video, a 3D model of a scene, or enhanced audio. The question for the court is whether the output is reliable enough to admit and, if so, how a fact-finder should be told it was made. Your work is about the inputs, the method, and whether the tool does what the proponent says.

Subscribe on YouTube@sagnikteaches

Unacknowledged AI-generated evidence is presented as authentic but may be fabricated or altered: a photo of damage that never existed, a voicemail in a voice cloned from public clips, a screenshot of messages that were never sent, a doctored PDF. NCSC's bench card for this category warns that the consequences could lead to miscarriages of justice, and the guide says its cards target questions about source, chain of custody, metadata and verification. Most of the checklist below sits in this second category, because it is where the other side may not volunteer anything.

According to the guidance, evidence can be admitted if it is authentic, relevant, reliable and not unduly prejudicial. Your own rules of evidence decide the precise tests and who bears which burden, so check them for your court before you rely on any of the steps below. Treat what follows as practical guidance, not legal advice on any particular rule.

A checklist for the first look at any key exhibit

Run this on arrival, whether the exhibit comes from your own client or from the other side. Each line says why it matters and how to check.

Provenance questions

1. Who created or captured the item? A named person with a device and a date, not "it was sent to me". Why: authentic items have a human origin you can test.
2. On what device or account? Make, model, app, account. Why: an expert can compare the file against what that device produces.
3. Is this the original file or a copy? Ask for the native file, not a screenshot, forwarded attachment or a download from a platform. Why: copies lose metadata and compression hides edits.
4. Where has it been since capture? Every upload, message app, email and cloud folder. Why: each hop is a chance for alteration and a place where logs may exist.
5. Who has had access? Names and dates. Why: custody gaps matter more when AI tools can alter files quickly.

Technical checks you can do before instructing an expert

1. Hash the file you received. Record a cryptographic hash (such as SHA-256) the moment you receive each exhibit, so later versions can be compared. This is my practical suggestion, and it costs nothing.
2. Look at available metadata. Creation and modification times, device model, software tags, location data. Note what is missing as well as what is present. Why: a file saved by an editing or generation tool may carry a software tag that does not match the claimed source.
3. Look for content credentials. Some cameras, editing tools and AI generators attach provenance data (the C2PA standard is one example). If present, it can show how the file was made; if absent, it proves nothing, because many files never had it.
4. Compare against other evidence. Do timestamps, weather, locations, people and objects match independent records: phone logs, receipts, CCTV, third-party emails? Why: fabricated items rarely align with everything else.
5. Preserve the original. Work on copies and keep a log of who opened what. Why: your own handling must survive the same questions you are asking.

Red flags by type of evidence

These are working indicators, not tests. Many have innocent explanations, and absence of every flag does not make an exhibit genuine. Their use is to decide what to investigate.

Note that these are my own practical indicators drawn from how such media typically fail. The NCSC guidance doesn't list red flags itself; it concentrates on the questions that expose provenance. If you find yourself relying on a visual flag in a witness statement or written argument, step back: the better route is to put the question to the other side and let the answer, or the lack of one, do the work.

Questions to put to the other side

Draft these as a short schedule you can attach to a request for information or disclosure, or raise at a case management conference. Adapt the language to your procedural rules.

Re: Exhibit [number], [description]
1. State who created or captured the item, on what device, on what date.
2. Confirm whether the item produced is the original file as first created.
   If not, identify the original and where it is held.
3. Identify each person or system that has held the item since creation.
4. State whether any editing, enhancement, filtering, compression,
   transcription or AI tool has been used on the item, and identify it.
5. Produce the item in native format with all available metadata.
6. Describe any steps taken to verify the item's authenticity.
7. State whether the item has been or will be the subject of expert
   evidence, and if so by whom.

Question four deserves a note. Many genuine items have been touched by software: a phone enhances low-light photos, a transcription service cleans up audio. Asking about all tools, not only AI, keeps the question neutral and makes an evasive answer easier to see. If the other side refuses, an application for disclosure or an adverse inference may follow, depending on your rules.

A worked example: a damage photo in a contractor dispute

Illustrative only. A landscaping company is sued by a customer who says a retaining wall was left cracked. The customer's lawyer serves a photograph of a deep crack, said to be taken the day after the work. The date taken is a few weeks before the company says the job finished, according to a note the customer attached.

First look: the photo arrives as a compressed image in an email, with no camera data. Provenance question one gets the answer "the customer took it on his phone". Question three asks for the original; the customer then says the photo was sent to him by a neighbour. That changes the story. Question four asks about edits and AI tools; the reply is a vague denial.

The firm hashes the file, then compares the image with the company's own before-and-after photographs, which show the same wall with different brickwork and a gate that does not appear in the customer's photo. Nothing here proves AI involvement, and that is the point. The photo is unsupported, the provenance has already shifted, and the firm can now argue weight on grounds the court will understand, while also asking for native-file disclosure and, if the photo remains central, instructing an expert for a short report. The sequence is proportionate: questions, comparison, then expense.

Four more quick scenarios

A voicemail from a removals firm's customer. A customer claims the firm's manager left a voicemail agreeing to cover a damaged piano. The manager says he never did. Ask for the original audio file from the customer's phone and the call log showing a missed call at that time. If the log shows no call, the voicemail's origin needs explaining. If the log shows a call, you still compare the voice with known recordings through an expert before making any allegation.

A screenshot of messages with a florist. A client offers a screenshot showing the florist agreed a refund. The florist's own phone shows no such messages. Ask for a full export of the conversation from the client's device. A screenshot is easy to fabricate, with or without AI; the question is whether the underlying messages exist on a device or in the app's servers.

A contract PDF in a bookshop's lease dispute. A landlord produces a PDF of a letter said to have been sent in March. The PDF's properties show a creation date in September and a word-processor version that did not exist in March. This is a classic metadata clue, but caution: files are often re-saved, so ask for the original and the sending email before alleging fabrication.

A video call recording. A party offers a recording of a call in which the other side appears to concede a point. Ask which platform recorded it, who pressed record, and for the platform's own log of the meeting. A recording from the platform is stronger than a screen recording made later, because the platform's record can be compared.

Raising the issue without overreaching: a sample letter

Tone matters. An accusation of fabrication, made without a basis, can damage your standing and cost your client when costs or sanctions are decided. A measured letter asks questions, reserves your position and sets a date. An illustrative version:

Dear [name],
Exhibit 7 is a photograph said to show [description]. We have not been
given the original file, the device it was taken on, or any account of
where it has been since it was taken. Given the importance of the image
to your client's case, please by [date]: (a) provide the native file with
all metadata; (b) identify the device and account; (c) confirm whether any
editing, enhancement or AI tool has been applied; and (d) confirm who has
held the file. We make no allegation at this stage. Our client's position
on authenticity is reserved, and we may ask the court for directions.
Yours sincerely, [your name]

The sentence "we make no allegation at this stage" does a lot of work. It keeps the exchange professional, it shows the court later that you gave the other side a chance, and it lets the other side supply the answer that ends the doubt. If they supply it, you have saved your client the cost of an expert. If they refuse, you have a paper trail for any application.

What a good answer looks like, and what a poor one looks like

It helps to know in advance how to read the reply. A good answer is specific and checkable: "Taken by Ms [surname] on her phone at 14:20 on the 3rd; native file attached; phone retained; no edits." You can compare each piece of that against logs and other exhibits. A poor answer is vague, passive or circular: "The image was provided by our client and is genuine", "metadata is not available", "it was received via a messaging app". None of these is proof of anything wrong, but each leaves the questions open, and a pattern of poor answers is what supports an application for disclosure, an order for native production or an expert.

Also notice who answers. If the reply comes from the lawyer rather than the person who took the item, ask for a witness statement from that person that covers the provenance questions. Authentic evidence usually has a witness who can describe, in plain words, how it came to exist.

When to instruct an expert, and how to brief one

Instruct a digital forensics expert when the item is central to a point of liability or quantum, when your first-look checks leave real doubt, or when the other side raises authenticity against your own evidence. The NCSC guidance notes that courts can ask for expert analysis and can order a neutral third-party review, so an agreed single expert may also be an option, subject to your rules.

Give the expert: the native file or the best copy, the hash you recorded, a short chronology of how it reached you, the other side's answers to your questions, and the specific issue (is it consistent with the claimed device, has it been edited, is it a synthetic voice). Ask for a statement of method, limits and any error rates, and for the opinion to be framed in terms the court can follow. Ask for a quote and a timetable early, because forensic work on video can take weeks and cost far more than a photo or document.

Avoid commissioning an expert report that rests on a single detection tool's score. A score is a lead. A report needs reasons that survive cross-examination.

Defending your own client's genuine evidence

The same technology creates a second problem: genuine evidence being dismissed as "just AI". Prepare for this at the point of collection.

• Collect originals promptly, from the device, not through a messaging app.
• Record who collected it, when and how, with a signed note.
• Take a hash at the moment of collection.
• Gather corroboration: logs, receipts, independent witnesses.
• Keep the device if you can, or take a forensic image.

A client who has deleted the original and only has a forwarded copy has weaker evidence than one who kept the phone. Tell clients early, in your preservation letter, not to edit, enhance or "tidy up" files, even with a harmless app. An enhanced copy can be treated as an altered one.

Using AI yourself, carefully

Lawyers also use AI to summarise bundles or build chronologies. Keep this separate from evidence handling: never feed exhibits into a tool that edits or "improves" them, and keep AI-produced summaries labelled as working notes, not evidence. For the drafting side of the same discipline, see AI legal brief writing: a draft and cite-check routine, and for building event timelines tied to documents, AI legal chronologies linked to evidence.

If you are advising a business client on the wider risk of fake voices and videos reaching them outside court, how to spot deepfake voice and video scams is the practical companion. And if you would like to build a routine for your firm's exhibits with someone who has set up document workflows, that is part of my AI implementation consultation, available through the contact page.

A one-page version to pin up

1. Hash on receipt. Keep the original untouched.
2. Ask: who, what device, when, original or copy, custody, tools used, verification.
3. Look for native files and metadata; note what is missing as well as what is present.
4. Compare with independent records.
5. Escalate to an expert where the item is central and doubt is real.
6. Raise authenticity early and in proportion.
7. Protect your own client's evidence the same way.

The technology will keep changing, so treat the checklist as a living document: review it every six months, check the latest guidance from your own court system and professional body, and add any new question that a real case teaches you.

Questions litigators ask about AI-altered evidence

Can I tell a fake from a real photo by eye?

Not reliably. Visible flaws such as odd hands or warped text are signs worth noting, but modern tools often produce clean images, and ordinary editing or compression can mimic the flaws. Use visual impressions to decide what to investigate, never as the finding itself.

Does missing metadata prove a file is fake?

No. Messaging apps, screenshots and social platforms routinely strip metadata from genuine files. Missing metadata is a reason to ask for the original file and its provenance. Present metadata can also be edited, so it is evidence to weigh, not proof of authenticity.

Do AI detection tools settle the question?

No tool gives a certain answer, and results can change between versions. A detection score is a lead for a qualified forensic examiner, who can explain the method, its error rate and its limits. Avoid relying on a score without an expert willing to testify.

Should I assume the other side's evidence is fake?

No. The aim is a proportionate challenge that is raised early. Most evidence is genuine, and unfounded allegations cost credibility and money. Ask the standard provenance questions of every key exhibit, then escalate only where answers or the file itself raise doubt.

Further reads

• AI Agents for Auditors: Chasing Evidence Requests From Clients — Chasing evidence requests in another document-heavy process.
• Can AI Help With an Airbnb Damage Claim? Evidence and Wording — Gathering photo evidence for a small damage claim.
• How to Label AI-Generated Images and Video on Social Media — How platforms expect AI imagery to be labelled.
• AI Client Intake for Law Firms: Qualify Enquiries Out of Hours — Early intake is where evidence provenance questions start.
• AI for Tax Audit Support: Document Requests, Timelines and Draft Replies — Another document-heavy process with authenticity questions.
• Process Server Software: Dispatch, Proof of Service and Where AI Fits — Nine jobs process server software must do, four tools checked against them, a 140-job cost sum and where AI can help with intake and drafts.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: the National Center for State Courts' AI-generated evidence guide for judges and its bench card page on evaluating unacknowledged AI-generated evidence (ncsc.org), and the C2PA site on Content Credentials, read 4 November 2026. Practical heuristics beyond that guidance are the author's and are labelled as such.