Physical Incident Evidence Preservation
Objective
Preserve comprehensive, tamper-evident, time-stamped evidence of AI system state, sensor inputs, model outputs, actuator commands, and human interactions immediately before, during, and after any physical AI incident.
Control / requirement
(1) Continuous ring-buffer recording — minimum 60-second rolling buffer of: all sensor inputs (raw and processed); all AI model inputs and outputs; all actuator commands; all safety monitor decisions; all human override activations; system health telemetry. Safety-critical systems retain 300 seconds minimum. (2) Incident freeze — on any safety-relevant event, automatically freeze buffer and begin extended logging. Frozen buffer write-protected. (3) Cryptographic integrity — all records SHA-256 hashed and ECDSA signed at point of creation. For Optimized tier: CRYSTALS-Dilithium signing (post-quantum). (4) Regulatory retention — ICAO Annex 13: 5 years minimum; EU AI Act Art. 19: 10 years; DORA Art. 12: 5 years. (5) UAIF® integration — automatically populate UAIF® incident record from evidence package.
Business impact
Without preserved evidence, physical AI incidents cannot be investigated, regulated, or defended in litigation. EU AI Act Art. 19 mandates 10-year record-keeping for high-risk AI systems. Absence of evidence in a physical harm incident shifts the legal presumption to the organisation in many jurisdictions. Insurance coverage for AI physical harm incidents typically requires demonstrable evidence preservation capability.
Validation approach
Test ID: D9-CTL-07-VTS-001 | Test Type: Automated + Manual | Harness: pytest tests/d9_physical_ai/test_physical_incident_evidence.py -v # oda3-gaissf-vts | Pass Criteria: (a) Evidence package produced within 60 seconds of incident freeze trigger containing 100% of required fields; (b) Cryptographic signature verification passes for 100% of records; (c) Ring buffer retained without gap for full defined retention period; (d) Evidence package cannot be modified after freeze without signature invalidation; (e) UAIF® incident record fields auto-populated from evidence package. Test: inject simulated incident; verify evidence package completeness, integrity, and UAIF® field population.
Expected evidence
Not separately specified in the available source.
Mapping and source
Not separately specified in the available source.
Implementation guidance
Translate the requirement into system-specific procedures, responsible roles, technical configurations and review conditions. Retain evidence showing both design and operating performance. Where the source provides no separate implementation instruction, do not infer that a single technical mechanism is sufficient.
Assessment considerations
- Confirm scope and applicability.
- Inspect control design and responsible ownership.
- Test representative operation and adverse conditions where appropriate.
- Evaluate evidence provenance, completeness and contradictory evidence.
- Record limitations and notably absent outcomes.