Guide for product builders
FRE 902(13) and 902(14): how your product's records and data copies get certified as evidence in US court
Federal Rules of Evidence 902(13) and 902(14) let records your system generates, and hash-verified copies of data, be authenticated in US federal court by a qualified person's written certification instead of live testimony — if the other side gets advance notice. Your product decides whether that certification is possible.
Published November 2, 2026 by Thiago Vieira. General information, not legal advice; ask a US litigator about a specific case.
The two rules at a glance
FRE 902(13)
Certified records generated by an electronic process or system
A record generated by an electronic process or system that produces an accurate result, shown by the certification of a qualified person.
In your product: Your audit logs, access logs, transaction records, alerts and AI decision records — anything your system produces on its own.
The certification must show: That the process or system produces an accurate result: how it works, that it was working correctly and that the record was not altered.
FRE 902(14)
Certified data copied from an electronic device, storage medium or file
Data copied from an electronic device, storage medium or file, authenticated by a process of digital identification, shown by the certification of a qualified person.
In your product: Exports, forensic images, collected files, mailbox or chat exports and evidence bundles your product copies out of a source.
The certification must show: That the copy is identical to the original, usually by matching hash values (for example SHA-256) computed on the original and on the copy.
What a valid certification needs
Both rules borrow the certification and notice requirements of FRE 902(11) (domestic records) and 902(12) (foreign records in civil cases).
A qualified person
Someone with knowledge of the system or the copying process — a records custodian, engineer or forensic examiner.
Facts a witness would give
The certification must contain information that would be enough to establish authenticity if a witness said it at trial.
Signed under penalty
A written declaration, signed so that a false statement would expose the signer to criminal penalty (the FRE 902(11) and 902(12) format).
Advance written notice
Before the trial or hearing, the other side must receive reasonable written notice and access to the record and certification, so it can challenge them.
What certification does not solve
A certification settles authenticity only. It does not answer:
- Hearsay: the record's content may still need an exception, such as business records under FRE 803(6).
- Relevance and other admissibility objections.
- In criminal cases, the defendant's right to confront witnesses.
- The weight the judge or jury gives the evidence. The other side can still challenge authenticity.
Which of your records fit which rule
| Record your product produces | Likely rule |
|---|---|
| Append-only audit log of user and admin actions | 902(13) |
| Security alerts and detections from your engine | 902(13) |
| AI decision record: input, model version, output | 902(13) |
| Export of a customer's logs with a hash manifest | 902(14) |
| Forensic image or collected file from a device | 902(14) |
| Captured web page or chat with hash at capture | 902(13) for the capture, 902(14) for later copies |
Builder checklist: make your product certifiable
1. Document how the system works
A written, versioned description of how each record is generated, by which component and from which inputs.
2. Show the system is accurate
Keep validation tests, monitoring and known error rates, so a qualified person can state the process produces an accurate result.
3. Version everything
Record the software and model version that produced each record, and keep release history.
4. Make records tamper-evident
Append-only storage with hash chaining; no manual edits, and any correction written as a new event.
5. Use trusted time
Synchronized clocks and trusted timestamps (for example RFC 3161) on each record.
6. Hash at collection
Compute SHA-256 when data is captured or copied, and store the hash separately from the data.
7. Export with a hash manifest
Every export includes file list, hash values, algorithm, time and tool version, plus a way to re-verify them.
8. Log the chain of custody
Who accessed, copied, exported or transferred each item, when and why.
9. Name your qualified people
Decide who in your company (or which forensic partner) can sign, and train them on the system.
10. Keep a certification template
A ready declaration in the FRE 902(11) format, filled from the export metadata, so customers' lawyers can use it.
11. Support retention and legal hold
Documented retention rules and the ability to freeze data when a dispute is expected.
12. Package for notice
One bundle with the record, hashes, custody log and certification, ready to share with the other side ahead of trial.
This checklist is the court-certification slice of our wider Evidence by Design forensic readiness checklist, which also covers methodology under FRE 702 and AI decision records.
Frequently asked questions
What do FRE 902(13) and 902(14) do?
They let electronic evidence be authenticated in US federal court by a written certification from a qualified person instead of live testimony. 902(13) covers records generated by an accurate electronic process or system; 902(14) covers data copied from a device, storage medium or file and verified by digital identification, usually hash values. Both took effect on December 1, 2017.
Does a certification make my product's record admissible?
No. It only settles authenticity, meaning the record is what it claims to be. The other side can still object on hearsay, relevance or, in criminal cases, confrontation grounds, and can still challenge authenticity.
Who can be the qualified person?
Someone who knows the system or the copying process well enough to state the facts a witness would give at trial — for example a records custodian, a senior engineer or a forensic examiner. Startups should decide this in advance and document it.
Is a hash value required under 902(14)?
The rule asks for a process of digital identification. Hash values are the common method today, and the rule's committee note leaves room for other reliable techniques. In practice, compute a strong hash such as SHA-256 on the original and on each copy.
Do these rules apply in state courts?
They are part of the Federal Rules of Evidence, which govern federal courts. Each state has its own evidence rules; some follow the federal model closely and others differ, so check the rules of the court where the case is heard.
Can AI outputs be certified under 902(13)?
The certification has to show that the process produces an accurate result. For AI products that means keeping the inputs, prompts, model version, configuration and output as one verifiable record, plus validation evidence a qualified person can describe.
Why should a startup care before any lawsuit?
Because a certification can only describe what the product already records. US buyers in security, insurance, finance and government increasingly ask vendors to prove what happened, and products built for certification shorten legal and procurement reviews.
Related reading
- Evidence by Design: make product data admissible in US court
- AI agent audit trails that hold up in court
- Tamper-proof logging
- Daubert vs Frye: expert evidence standards
- NIST digital forensics process
Sources
- Federal Rules of Evidence, Rule 902 (Cornell LII)
- Self-authenticating electronic evidence, 2017 amendments (Federal Judicial Center)
Is your product's data certifiable today?
Our court-appointed forensic experts (Brazil and Portugal, 60+ investigations) review what your product records and what it would take for a qualified person to certify it.
Request a free evidence-readiness review