Authenticating photos under Federal Rule of Evidence 901 when AI edits are easy

Before a photo can be used as evidence, someone has to show it is what they say it is. In federal court that is Rule 901. The rule hasn't changed for AI, but AI editing has changed how often opposing counsel asks the question and what a good answer looks like.

The basic rule

Rule 901(a) asks the party offering a photo to produce evidence "sufficient to support a finding that the item is what the proponent claims it is." The bar is low: enough that a reasonable jury could find the photo genuine. Once that is met, disputes about it usually go to how much weight it gets, not whether it comes in.

Rule 901(b) lists examples of ways to meet the bar. Three matter most for digital photos:

• 901(b)(1), a witness with knowledge. The person who took the photo, or who saw the scene, says it fairly and accurately shows what it shows. This is still the most common route.
• 901(b)(4), distinctive characteristics. Contents, internal patterns and other features of the item, which for a digital file includes its metadata and internal structure.
• 901(b)(9), a process or system. Evidence describing a process or system and showing it produces an accurate result.

Rule 902 adds self-authentication by certification for some electronic evidence. 902(13) covers records generated by an electronic process or system. 902(14) covers data copied from a device or file, authenticated by "a process of digital identification", which in practice usually means matching hash values.

Why AI edits change the practical picture

A witness can say a photo looks like the scene. Fewer witnesses can say, with confidence, that a file was not touched by an AI tool after it left the camera. And "that's a deepfake" is now an easy objection to make. The federal rules committee has studied a possible Rule 901(c) for that situation: the challenger would first have to offer enough evidence to support a finding of fabrication, and only then would the proponent need to show authenticity is more likely than not. As of October 2026 that draft has not been adopted. A bare claim of "deepfake" is generally not enough on its own today either.

Either way, the party who has technical evidence about the file is in the stronger position.

What in a photo file can support authentication

From strongest to weakest:

1. An exact hash match. A SHA-256 hash is a fingerprint of the file. If the hash of the exhibit matches the hash recorded when the photo was collected, the file has not changed by a single bit since then. This is the "digital identification" that 902(14) relies on.
2. Signed Content Credentials (C2PA). Some cameras, phones and AI tools sign a record of how a file was made. A valid signature that is bound to the file, from a signer on the official trust lists, is strong evidence of that history. It can cut both ways: OpenAI's tools, for example, sign a record saying their images are AI-generated.
3. Camera metadata (EXIF). Make, model, capture time and settings can be consistent with a camera capture. They can also be copied, edited or stripped by software, so they support a witness rather than replace one.
4. Signs of processing. Recompression, resizing or a sharing app's re-encoding show something happened to the file. They do not show that the picture's content was changed.

A missing signature or missing metadata proves nothing by itself. Most phones don't sign photos yet, and screenshots or sharing apps strip both. The honest answer in many cases is "unknown", and that is not the same as fake.

Practical steps

• Get the original file, not a screenshot or a forwarded copy. Each copy can throw away the evidence you need.
• Record a hash when you collect it, and keep a simple log of who handled the file and when.
• When you need new photos, have them taken in a way that records how they arrived, for example through a secure request link that records whether the photo was uploaded or taken live, instead of photos sent by text message.
• Check the file for Content Credentials and metadata, and write down what they do and don't show.
• Use a witness with knowledge anyway. Technical evidence supports testimony; it rarely replaces it.

Where PIT fits

PIT reads the file and answers four questions: how it was created, whether it was processed or altered, where it came from, and how strongly that evidence is tied to this exact file. Each answer names the evidence behind it and its limits. Reports are signed and include the file's SHA-256 hash, so anyone can check later that the report is unchanged and refers to the same file.

Whether that is enough to authenticate a particular exhibit is for the court. A PIT report is a starting point for you or your expert, not a substitute for a witness or a qualified forensic examiner.

FAQ

Does a photo need Content Credentials to be admissible?

No. Most authentic photos have none. Content Credentials are one strong kind of evidence when present.

Can metadata alone authenticate a photo?

It can help under 901(b)(4), but metadata is easy to change, so it is usually paired with testimony or other evidence.

What about Rule 707?

Proposed Rule 707 is about the reliability of machine-generated evidence, such as an AI tool's analysis. See our guide to proposed Rule 707.

This guide explains evidence rules in general terms. It is not legal advice, and rules and local practice vary by court. Talk to a lawyer about your own case.