Data integrity in the age of AI: why quality starts with certification at the source

"Data integrity" is searched 4,400 times per month in the US with a $24 CPC. The signal is clear: IT departments, data governance teams and compliance functions are budgeting for the problem. Yet the classic definition (backup, encryption, access control) no longer covers the dominant risk of the generative AI era. The threat is no longer subsequent modification of legitimate data. It is artificial creation of data indistinguishable from originals, injected upstream. Historical frameworks like ISO/IEC 27001 and the NIST Cybersecurity Framework were designed to protect integrity ex-post, once data has entered the enterprise perimeter. They were never built to guarantee origin. The question CISOs face in 2026 is different from the one they answered in 2016: how do you guarantee the integrity of data when the attack vector is not a tampered record, but a synthetic one that was never real to begin with?

What is data integrity and why the classic definition no longer suffices

The classic definition: protection from unauthorized modifications

Data integrity, as codified in ISO/IEC 27001:2022 and most enterprise governance manuals, means accuracy, completeness and consistency of data over its lifecycle. The CIA triad treats integrity as one of three security properties. Mechanisms are well known: cryptographic hashes (SHA-256), checksums, version control, role-based access, write-once storage, audit trails. The threat model assumes data enters the system in a known-good state. Controls protect it from corruption, accidental modification or malicious tampering after ingestion.

This model worked when the dominant attack vector was post-ingestion: a database administrator altering a record, a ransomware payload encrypting files, a man-in-the-middle modifying a payload in transit.

What changes with generative AI: indistinguishable synthetic data

Generative AI inverts the threat model. The attack no longer happens after ingestion. It happens before. A synthetic photo of a damaged vehicle submitted to an insurance claim. A deepfake video presented as KYC verification. A fabricated medical image inserted into a clinical trial. AI-generated screenshots used as evidence in litigation.

The integrity controls listed above are blind to this class of attack. A SHA-256 hash certifies that the file has not been modified since it was hashed. It says nothing about whether the original capture was authentic. Encryption protects confidentiality in transit. It does not validate provenance. Access control governs who can read or write. It cannot distinguish a legitimate user uploading a real document from a legitimate user uploading a synthetic one.

The gap is structural. Existing controls treat the file as the unit of integrity. The AI era requires treating the moment of capture as the unit of integrity.

The limits of current frameworks

ISO/IEC 27001:2022: integrity as a security property, not an origin property

ISO/IEC 27001:2022 defines integrity in Annex A controls related to cryptography (A.8.24), secure development (A.8.25 to A.8.34), and information transfer (A.5.14). None of these controls require or describe certified origin. The standard assumes that whatever enters the Information Security Management System has been validated by upstream business processes. Auditors check that hashes match, that backups restore correctly, that access logs are immutable. They do not ask whether the original photo, video or document was generated by a human or by a model.

NIST Cybersecurity Framework: no certified provenance

The NIST CSF 2.0 organizes controls into six functions: Govern, Identify, Protect, Detect, Respond, Recover. The Protect function (PR.DS) covers data security with controls on confidentiality, integrity and availability. Subcategory PR.DS-06 explicitly addresses "integrity checking mechanisms used to verify software, firmware, and information integrity". The mechanism is verification of state, not certification of source. NIST SP 800-53 Rev. 5 reinforces this: control SI-7 "Software, Firmware, and Information Integrity" uses hashes and digital signatures applied within the system boundary. Source authenticity is out of scope.

GDPR Art. 5(1)(f) and EU AI Act Art. 50: transparency required, proof unspecified

GDPR Article 5(1)(f) requires personal data to be processed "in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (integrity and confidentiality)". The text reproduces the classic definition.

The EU AI Act (Regulation 2024/1689), Article 50, introduces transparency obligations for AI-generated or AI-manipulated content: providers must mark synthetic outputs in a machine-readable format, and deployers of deepfake systems must disclose the artificial nature of the content. The regulation defines the obligation but does not prescribe the technical mechanism. Marking synthetic content does not, by itself, certify the authentic content. The two problems are mirror images. The EU AI Act addresses one. The other requires a separate technical layer.

Framework	Integrity covered	Certified provenance
ISO/IEC 27001:2022	Yes (ex-post, in-system)	No
NIST CSF 2.0	Yes (ex-post, in-system)	No
GDPR Art. 5(1)(f)	Required, no mechanism specified	No
EU AI Act Art. 50	Synthetic content marking required	Partial (synthetic side only)

Certification at the source as a new paradigm

Qualified electronic seal and qualified timestamp

Under eIDAS 2.0 (Regulation 2024/1183), a qualified electronic seal is a cryptographic instrument issued by a Qualified Trust Service Provider (QTSP) that binds an electronic document to a legal person. A qualified electronic timestamp binds data to a specific point in time with legal value across the European Union. Both instruments produce evidence admissible in court without further validation.

The combination of qualified seal and qualified timestamp, applied at the moment of capture, transforms data integrity from an internal security property into an external legal property. It moves the proof from "we believe this is the original" to "a third-party QTSP attests this content existed in this exact form at this exact time".

Forensic metadata: time, location, device, cryptographic hash

A certified capture event records more than the file content. It records environmental metadata: timestamp from a trusted source, geolocation, device fingerprint, network conditions, sensor readings where available. Each element is hashed and sealed together with the content. The result is a forensic package: a tamper-evident record of the capture moment, not just the captured object.

This is the difference between a photograph and a forensic photograph. The image is the same. The chain of custody is not.

Data protection vs data certification: two complementary layers

Layer	Mechanism	Threats covered	Evidence produced
Data protection	Encryption, access control, hashing, backups	Tampering, unauthorized access, accidental loss	Internal logs, hash comparison
Data certification at the source	Qualified electronic seal + qualified timestamp + forensic metadata	Synthetic data injection, false provenance claims, repudiation	eIDAS-grade legal evidence

The two layers are complementary, not alternative. Protection without certification leaves the synthetic-injection vector open. Certification without protection leaves the certified record exposed to subsequent tampering.

What is TrueScreen and how it enables a certified data integrity framework

TrueScreen is the Data Authenticity Platform that acquires and certifies any digital content (photos, videos, audio, web pages, screenshots, sensor data) at the exact moment of capture or generation. It integrates a qualified electronic seal and a qualified timestamp delivered by a third-party QTSP via API. The output is a certified file carrying forensic metadata, eIDAS legal value, and admissibility in EU courts without additional notarization steps.

TrueScreen does not replace ISO 27001 or NIST CSF controls. It complements them by adding the missing layer: certified origin. An enterprise running TrueScreen alongside its existing security stack can answer two distinct questions for any piece of data: "has this been tampered with since ingestion?" (existing controls) and "was this authentic at the moment of capture?" (TrueScreen). Both answers are required to defend data integrity in 2026.

Adoption scenarios: KYC, clinical trials, evidence collection

KYC certified at the source

European banks and insurance firms operating under PSD2 and AMLD6 face increasing pressure to detect synthetic identities. Standard KYC flows accept ID photos, selfies and proof-of-address documents through customer-facing channels. A growing share of fraudulent onboarding now uses AI-generated identities: synthetic faces matched with AI-generated documents, indistinguishable to human reviewers and to most liveness-detection models.

Certifying KYC inputs at the moment of capture, with forensic metadata and a qualified seal, removes the synthetic-injection vector. The bank no longer asks "does this look real?". It asks "is this attested by a trusted capture event?". The two questions have different answers and different legal weights.

Clinical trial data and FDA 21 CFR Part 11

FDA 21 CFR Part 11 governs electronic records and electronic signatures in pharmaceutical and medical-device industries. It requires controls to ensure the trustworthiness and reliability of records, including audit trails, access controls and electronic signatures bound to specific individuals.

Generative AI introduces a new compliance gap: synthetic clinical images, fabricated patient data, AI-altered trial readings. Part 11 controls validate the record once it is in the system. They do not validate that the record originated from a real patient, a real instrument, a real observation. Certification at the source closes this gap by binding the capture event to a forensic record before the data enters the Part 11-compliant repository.

Evidence and litigation: digital documents with legal value

Digital evidence in EU litigation must satisfy the requirements of Regulation (EU) 2024/1183 for admissibility. A screenshot, a social-media post, a web page captured today as evidence of an event may be challenged tomorrow as a deepfake or a fabrication. Without certified provenance, the burden of proof shifts to the party presenting the evidence, who must demonstrate authenticity through indirect means (witnesses, forensic analysis, expert testimony).

A capture certified at the source carries its own evidentiary weight. The qualified seal and qualified timestamp from a QTSP integrated into the capture flow produce a record that EU courts accept under eIDAS without additional validation.

How to integrate source certification into enterprise data flows

API and SDK as acquisition points

The integration model is not a separate workflow. It is an instrumentation of existing acquisition points. A KYC mobile app, a clinical-trial data collector, a field-inspection tool, a customer-support chat: each point that ingests data from the outside world becomes a capture event. TrueScreen exposes API and SDK endpoints that wrap the acquisition with the certification step. The application logic does not change. The legal status of the output does.

Reference architecture: from collector to certified data warehouse

A reference architecture has three layers. The acquisition layer (mobile apps, browser extensions, IoT collectors, web portals) generates raw events. The certification layer (TrueScreen API or SDK) seals each event with qualified timestamp, qualified seal and forensic metadata. The storage layer (data warehouse, document management system, evidence repository) ingests certified files instead of raw files. Downstream analytics, AI training and reporting consume data that is provably authentic at the source, not just protected after ingestion.

The model scales horizontally: the same certification layer serves KYC, clinical trials, claims, evidence, audit, supply-chain provenance. The cost is one integration point per acquisition surface. The benefit is one consistent legal property across the entire enterprise data estate.