Algorithmic Expert Evidence: How AI Is Introduced and Challenged in Criminal Proceedings

When the prosecution relies on an algorithm —facial recognition from a security camera, a biometric match, a forensic tool that traces patterns across thousands of messages— the defence lawyer's question is not what the machine says, but how it knows, with what margin of error, and who can verify it. Algorithmic expert evidence is no longer a hypothesis: it is entering criminal proceedings and forcing the defence to master both the law of evidence and the technical weaknesses of the model. As criminal defence lawyers specialising in algorithmic expert evidence, we explain how it is introduced, how it is validated and, above all, how it is challenged.

Which Types of Algorithmic Evidence Reach the Proceedings

Very different instruments coexist under the common label of algorithmic evidence, and the strategy against each one differs:

• Facial recognition: compares a face captured on CCTV with a database and returns a probability of a match. Its reliability depends on image quality and the model's demographic bias.
• Biometric and voice matching: identifies or rules out a person by physical or acoustic features. It operates with decision thresholds that should be known and contested.
• Automated forensic analysis: software that processes large volumes of digital evidence (messaging, records, metadata) and traces patterns that a human review could not cover.
• Predictive models: systems that score risks or profiles from historical variables, with the danger of turning statistical correlations into judgements about the person.

Identifying which model is involved is the first step in challenging it: what is at issue in a facial match (image quality, error rate) is not the same as what is at issue in an automated data analysis (the scope of access, the chain of custody).

How the Evidence Is Introduced and Validated

Algorithmic evidence is not an objective fact that is simply added to the police report: because of its technical complexity it must be introduced through an expert report subject to adversarial challenge. It is not enough for the report to state that the system returned a match or that the tool detected a pattern; the methodology must be known and verifiable. A new evidentiary standard, aligned with Regulation (EU) 2024/1689 on AI (the AI Act) and with the requirements of the settled case law of the Constitutional Court and the European Court of Human Rights, demands that the evidence meet four guarantees:

1. Traceability: which system was used, which version, on what data it was trained and with what validation methodology.
2. Documented error metrics: false-positive and false-negative rates that are known and published, not assumed.
3. Reproducibility: the ability to obtain the same result with an independent methodology.
4. Meaningful human oversight: a human decision-maker who has understood and assessed the result, not a merely formal sign-off.

Absent these guarantees, the evidence does not deserve incriminating weight, and the defence may seek its exclusion and the nullity of any proceedings derived from it.

The Chain of Custody of the Data

Even before discussing the model, one must look at the input data. An algorithm is only as reliable as the evidence it works with: if the image, the audio or the dataset was not obtained, preserved and processed with guarantees, the result is born contaminated. The digital chain of custody is decisive here. It must be possible to reconstruct where the data came from, how its integrity was secured (a hash or digital fingerprint), who handled it and whether it could have been altered between capture and analysis. An undocumented break in the chain of custody undermines the algorithmic result regardless of how sophisticated the model is: if it cannot be guaranteed that the machine analysed exactly what was captured, its conclusion loses probative force.

The Defence's Right to Audit the System

The adversarial principle requires that the defence be able to examine the evidence relied on against it. Translated into the algorithmic field, this becomes the right to audit the system. The defence can articulate it in several moves: requesting from the court the full documentation of the model (architecture, dataset, version, metrics and validation date), seeking the appointment of an independent court expert or producing a party-appointed expert report by an accredited data scientist, and, where appropriate, examining the origin and composition of the training set to detect structural bias.

The usual obstacle is trade secrecy: many systems are owned by private companies that resist disclosing how they work. That secrecy is legitimate, but it does not operate as an absolute shield against the right of defence. The settled case law of the Constitutional Court has given priority to the guarantees of the process where the algorithmic evidence is decisive for the conviction: what is decisive for convicting must be capable of being challenged. If the provider allows no form of verification, the result can hardly, on its own, sustain a conviction.

Reliability, Error Rate and the Presumption of Innocence

No classifier is always right. Every model operates with a false-positive and false-negative rate, and what is decisive in criminal matters is that those rates are known, documented and assessed for the specific case. A facial identification with a high probability in the abstract may carry far less probative weight once the real error rate for low-quality images or for the defendant's demographic group is taken into account. It is also important to distinguish between the system's general reliability and its accuracy in this case: a good average statistical performance does not amount to certainty about the fact being tried.

The defence translates the metrics into their procedural consequence. If the algorithmic evidence was the main basis of the charge and carries a reasonable uncertainty, the presumption of innocence applies: doubt is not resolved by a percentage, it is resolved by the principle in dubio pro reo. A statistical match by the model does not amount to sufficient incriminating evidence and, certainly, does not dispense with assessing the body of evidence as a whole.

The Adversarial Defence, Step by Step

Challenging algorithmic evidence is built early and in an orderly way:

1. Demand for traceability: formally requesting the full documentation of the model and of the input data before the result hardens into the court's conviction.
2. Examination of the chain of custody: verifying the integrity and origin of the evidence the system analysed.
3. Independent algorithmic expert report: instructing an expert to reproduce the result —or an equivalent— and report on reliability, bias and error rate.
4. Adversarial challenge at the investigation stage: introducing the technical debate during the investigation, where a fragile result can still be prevented from becoming the centrepiece of the prosecution.
5. Application to exclude or to reduce probative weight: where the minimum guarantees are missing, seeking nullity; where serious doubts arise, seeking that its weight be reduced.

The AI Act reinforces this strategy by setting obligations of documentation, human oversight and data governance for high-risk systems: a system that fails to meet them is more readily challenged as incriminating evidence. The aim is not to demonise the technology, but to subject it to the same requirements of reliability and adversarial challenge as any other expert evidence. The characterisation is always fact-specific and calls for technical analysis from the outset of the proceedings.