Chain of custody
The unbroken, accountable line from where a record is created to the organization's ability to retrieve and present it, intact, on demand. Broken most often by an inaccessible vendor boundary or by internal decay (overwrite, undocumented retention, unreadable migration); a record whose chain is broken is, at demand time, evidence you do not have.
Defined in 6 GAGE programs, which carry 15 distinct definitions of it. The wording above is taught in Certified AI Governance Professional (CAIGP).
How each discipline defines it
The same term does different work depending on who is using it. These are the definitions as each program teaches them, unedited.
In investigative and legal contexts, the documented, unbroken record of who has handled a piece of evidence (including a recording) and how, used to establish that evidence has not been altered or tampered with; referenced in this topic as an example of how professionals verify audio evidence through documented process rather than confident listening alone.
The unbroken, accountable line from where a record is created to the organization's ability to retrieve and present it, intact, on demand. Broken most often by an inaccessible vendor boundary or by internal decay (overwrite, undocumented retention, unreadable migration); a record whose chain is broken is, at demand time, evidence you do not have.
A running log documenting what an AI tool generated, what primary source it was checked against, when, and the result (confirmed, corrected, or dropped) for every specific claim in a research file. Protects a researcher who is later asked how a claim was verified.
The record showing that an item of evidence is the item that was collected and did not change in between, through six fields: identifier, description and source, collector with date and time, integrity value, custody transfers, and storage and access.
A documented, verifiable record of who has handled a dataset or model, and what was done to it, at each step from original collection to its current use; the absence of a chain of custody is itself a Layer 1 and Layer 2 provenance gap.
Where it is taught
The exact lessons this term appears in. The first module of every program is free with a free account.
- After the Incident · Rollout, Monitoring, and Incident Response, Certified Agentic AI Governance Professional (CAAGP)
- The vendor's black box: forcing provenance answers from a supplier who has none · Poison, Leaks, and the Adversary, Certified AI Data Governance Professional (CADGP)
- Pipeline forensics: reconstructing what the data did when the logs disagree · Data Incidents, Certified AI Data Governance Professional (CADGP)
- Auditing your own data: provenance, gaps, and quiet poison · Data Reality, Certified AI Governance Professional (CAIGP)
- The conformity file: assembling the evidence for the system you shipped in Module 3 · The EU AI Act: The Executive Map, Certified AI Governance Professional (CAIGP)
- The agent audit trail: logging actions so you can reconstruct any decision it made · Agents Under Command, Certified AI Governance Professional (CAIGP)
- Evidence is designed, not gathered: building systems whose proof exists before anyone asks · Evidence Engineering, Certified AI Governance Professional (CAIGP)
- The evidence annex: wiring every artifact so the Module 13 audit finds a paper trail, not a scramble · Evidence Engineering, Certified AI Governance Professional (CAIGP)
- Incident forensics: reconstructing a failure from logs when memories disagree · Adversarial Governance, Certified AI Governance Professional (CAIGP)
- Assembling the dossier: every artifact, every decision, one evidence file · The Capstone: The Board Audit and Viva, Certified AI Governance Professional (CAIGP)
Where it shows up at work
A definition is where Chain of custody starts. The lessons above teach it inside the competencies below, which are what job descriptions ask for and what the GAGE credential records. Every link here is drawn from the same careers map that builds a role's readiness check.
Collects, labels and preserves the evidence that a control operated, a decision was made, and a claim can be defended to an auditor or regulator.
4 lessons on this page teach it as a primary outcome.
Traces where data came from, what transformed it, who owns each hop and where it flows downstream, so a number can be defended.
3 lessons on this page teach it as a primary outcome.
Tiers vendors by use and impact, requests evidence instead of promises, tests in the customer's context, and plans monitoring and exit.
One lesson on this page teach it as a primary outcome.
Roles that hire for it
Each role page shows the full competency set, what the seat decides, and a readiness check against your own evidence.
- AI Auditorneeds it at depth · 9 open postings this week
- Privacy Analystneeds working knowledge
- Third-Party AI Risk Analystneeds it at depth
- Chief Audit Executive, AI audit editionneeds it at depth
- AI Program Managerneeds it at depth · 11 open postings this week
- AI Governance Analystneeds working knowledge · 3 open postings this week
How job descriptions say it
Postings rarely use the textbook word. These are the phrases the careers map reads as asking for the competencies above.
Where the frameworks place it: EU AI Act Articles 11 and 12; ISO/IEC 42001 Clause 7.5; EU AI Act Article 10; NIST AI RMF MAP 4.
One interview question about it
What evidence would you have ready before an auditor asks about an AI system, and how do you produce it as a byproduct of the work?
Asked of candidates for evidence collection and audit-ready documentation. Answering it in your own words is exactly how a GAGE topic is passed, and the credential records the pass where an employer can check it.
If you come from another field
Some backgrounds already carry this competency, and the readiness check gives credit for it.
- Compliance and regulatory affairs carries it as work you can show: Audit-ready documentation is what you produce.
- Internal audit and IT audit carries it as work you can show: Evidence evaluation is the profession.
- Project and program management carries it as a claim to back up: Decision logs and repositories are familiar.
Terms it appears with
Not an alphabetical neighbourhood: these are the terms taught in the same lessons, ranked by how often they appear together.