當 AI 使用成為證據問題：具後果的機器參與如何形成新的問責缺口

Evidence Infrastructure Signal 020 追問的不是 AI 是否更聰明，而是機構能否重建 AI 在一次具後果的工作流中做了什麼。當模型參與研究、檢索、預測、分類、風險評估、建議或決策支援時，制度問題已從「輸入了哪些證據」延伸到「哪些證據被取用、如何轉換、形成哪些推論、由誰覆核，以及機器輸出如何影響最後的制度結果」。如果只能保存提示詞、回覆、模型名稱與時間戳，機構可能知道系統曾被使用，卻仍無法說明該使用事件的證據路徑。 本篇把這段距離稱為 Usage Evidence Gap，亦即系統治理紀錄與重建具後果使用事件所需證據之間的缺口。模型可以通過風險評估，部署者可以保留操作日誌，最終決定也可以由人簽核，但 Evidence → Retrieval → Analysis → Transformation → Inference → Recommendation or Action → Institutional Outcome 的中間鏈仍可能不完整。這不是否定既有 AI 治理，而是指出治理文件、技術可觀測性與制度可重建性是三個不同層次。 EIS-020 同時提出 Epistemic Authority Boundary：AI 可以檢索、比較、計算、推論與建議，但證據是否被接受、重大性是否成立、法規解釋是否採用、確信是否達成，以及制度決定是否生效，仍須由具有權限的責任主體授權。Usage Evidence Gap 與 Epistemic Authority Boundary 均為本系列分析用語，不是歐盟、NIST、OECD、UNESCO 或其他來源機構已採用的法定定義，也不表示所有 AI 使用都需要相同紀錄強度。

Evidence Infrastructure Signal 020 does not ask whether artificial intelligence is becoming more capable. It asks whether an institution can reconstruct what happened when AI participated in a consequential workflow. When a model contributes to research, retrieval, forecasting, classification, risk assessment, recommendation or decision support, the institutional question expands beyond what evidence entered the system. The institution may also need to show which evidence was retrieved, how it was transformed, which propositions were inferred, who reviewed the result, and how the machine output affected the eventual institutional outcome. Prompt histories, responses, model names and timestamps may prove that the system was used without proving the evidentiary pathway of that use. This edition describes that remaining distance as the Usage Evidence Gap: the gap between records that establish how an AI system is governed and the evidence required to reconstruct how a consequential use event shaped an institutional outcome. A model can have a risk assessment, the deployer can retain operational logs, and a human can sign the final decision while the intermediate chain remains incomplete: Evidence → Retrieval → Analysis → Transformation → Inference → Recommendation or Action → Institutional Outcome. Model governance, technical observability and institutional reconstructability are related, but they are not interchangeable. EIS-020 also identifies an Epistemic Authority Boundary. AI may retrieve, compare, calculate, infer and recommend. The institution remains responsible for authorising whether evidence is accepted, whether a matter is material, whether a legal interpretation is adopted, whether assurance has been achieved, and whether an accountable decision takes effect. Usage Evidence Gap and Epistemic Authority Boundary are analytical terms used by this series. They are not statutory definitions adopted by the European Union, NIST, OECD, UNESCO or any other cited institution, and they do not imply that every AI interaction requires the same intensity of records.

EIA-010「After Deployment」已指出，AI 上線後的資料、模型、設定、使用者、整合、預定用途與責任會持續變動，使部署前證據逐步失去對現況的代表性。EIS-020 接續但不重複該問題。EIA-010 關注的是 evidence validity 隨時間衰減；EIS-020 關注的是一次實際使用如何把證據轉化為機器分析並進入制度結果。EIA-010 因此作為前序來源資料，不列入獨立外部證據計數。 MWP03 提供 Evidence Object 層，要求證據在跨系統移動時保留身分、來源、狀態、版本與制度關係。MWP04 提供 AI Evidence Data Science Methodology 層，區分 evidence-supported material、derived result、machine inference 與 unresolved proposition，並保留方法、時間適用性與權威邊界。EIS-020 再向前推一層：當機器分析真正進入採購、授信、保險、醫療、永續揭露、內控、研究或監管工作流時，機構要如何保存使用事件與最後決定之間的可驗證關係。MWP03 與 MWP04 同樣只作受控方法來源，不作獨立外部驗證。 外部制度已開始把「實際使用」當成治理物件。歐盟 AI Act 第 12 條要求高風險 AI 支援生命週期事件記錄，第 14 條要求有效的人類監督，第 26 條要求部署者依使用說明操作、指派具能力的監督人員、監測運作並保存其控制下的自動日誌，第 27 條則對特定部署者要求基本權利影響評估。GDPR、DORA 與 NIS2 又把資料保護、ICT 風險、事件處理、紀錄與問責帶入相鄰制度。這些規則沒有採用 Usage Evidence Gap 一詞，但共同顯示，治理重點正從模型文件延伸到使用情境、責任、監測與可稽核紀錄。

EIA-010, After Deployment, established the preceding temporal problem. Data, models, configuration, users, integrations, intended purpose and responsibility may change after an AI system is deployed, so evidence created before deployment can gradually cease to represent the operating reality. EIS-020 continues but does not repeat that analysis. EIA-010 concerns decay in evidentiary validity over time. EIS-020 concerns how a particular use transforms evidence into machine-supported analysis and then into an institutional outcome. EIA-010 is therefore retained as required predecessor source data and excluded from the independent external evidence count. MWP03 provides the Evidence Object layer, under which identity, provenance, status, version and institutional relationships remain attached as evidence moves across systems. MWP04 provides the AI Evidence Data Science Methodology layer, separating evidence-supported material, derived results, machine inference and unresolved propositions while preserving method, temporal applicability and institutional authority boundaries. EIS-020 moves one layer further into operation: when machine analysis enters procurement, credit, insurance, healthcare, sustainability reporting, internal control, research or regulatory workflows, what evidence connects the use event to the final decision? MWP03 and MWP04 are controlled methodological sources, not independent external validation. External institutions are already treating actual use as a governance object. Article 12 of the EU AI Act requires high-risk systems to support automatic event logging over their lifetime. Article 14 addresses effective human oversight. Article 26 assigns deployer obligations concerning use, competent oversight, monitoring and retention of automatically generated logs under the deployer's control. Article 27 requires a fundamental-rights impact assessment for defined deployments. GDPR, DORA and NIS2 add adjacent duties concerning data protection, ICT risk, incidents, records and accountability. These instruments do not use the term Usage Evidence Gap. They nevertheless demonstrate a movement from model documentation toward use context, responsible actors, monitoring and auditable records.

第一項挑戰是把 technical observability 誤認為 institutional reconstructability。提示詞、模型回覆、工具呼叫、延遲、錯誤碼與 token 使用量能說明系統如何運作，卻不一定能說明哪一筆證據支撐哪一句結論、哪個檢索結果被忽略、哪個規則改變排序、人工覆核修改了什麼，以及最終責任人為何接受或拒絕建議。系統追蹤可以很完整，制度證據鏈仍可能斷裂。 第二項挑戰是來源與推論混合。AI 可能將原始文件、摘要、計算、分類與預測組合為流暢答案，使直接證據、方法衍生結果與機器推論在輸出中失去邊界。如果下游使用者只保存最後文字，就無法判斷某項主張是來源明示、依固定公式計算、模型統計推估，還是未解決的假設。高品質輸出不等於可被制度採用的證據。 第三項挑戰是人類監督被縮減為形式簽核。若覆核者沒有看到來源版本、檢索集合、推論類型、衝突訊號與禁止主張，按下核准只能證明有人操作過介面，不能證明其具備實質審查條件。人類在迴路中不等於責任已被治理，真正的控制是人能理解、挑戰、暫停並留下理由。 第四項挑戰是多模型與多工具路徑。一次任務可能先由搜尋服務選取資料，再由語言模型摘要，由程式計算數值，由另一代理人生成建議，最後由工作流自動送入案件或報表。只記錄最後模型會遺失中介工具、轉換規則、提示模板、資料快照與權限變動。任何一個節點都可能改變結果，重建必須以事件鏈為單位，而不是單一模型為單位。 第五項挑戰是比例原則。不是每次拼字修正都需要完整鑑識紀錄，也不能因為保存證據而無限制收集個資、商業秘密或敏感提示。紀錄強度應依後果、可逆性、受影響人數、法定責任與爭議風險調整，同時設定目的限制、最小化、存取權、保存期限與刪除規則。過度紀錄與不足紀錄都可能形成新的風險。

The first challenge is confusing technical observability with institutional reconstructability. Prompts, responses, tool calls, latency, errors and token counts can describe system execution. They do not necessarily establish which evidence supported each proposition, which retrieval results were ignored, which policy rule changed a ranking, what a human reviewer altered, or why the accountable owner accepted or rejected the recommendation. A technically rich trace may remain institutionally incomplete. The second challenge is source and inference collapse. AI can combine original documents, summaries, calculations, classifications and forecasts into a fluent answer. Direct evidence, method-derived results and machine inference may then lose their boundaries. If a downstream user retains only the final prose, the institution cannot determine whether a claim was explicit in an authoritative source, calculated under a controlled method, statistically estimated by a model, or left unresolved. High-quality language is not the same as institutionally admissible evidence. The third challenge is reducing human oversight to formal approval. If a reviewer cannot see source versions, the retrieval population, inference classifications, conflicts and prohibited claims, clicking approve proves only that a person operated the interface. It does not establish substantive review. Human-in-the-loop language is not itself a control. A real control enables a competent person to understand, challenge, pause, modify or reject the machine contribution and to record a reason. The fourth challenge is the multi-model, multi-tool path. A search service may select evidence, a language model may summarise it, code may calculate a figure, another agent may prepare a recommendation, and a workflow engine may place it into a case or report. Recording only the last model loses intermediary tools, transformation rules, prompt templates, data snapshots and permissions. Any node can change the outcome. Reconstruction therefore needs an event chain, not a model-only log. The fifth challenge is proportionality. A spelling correction does not require the forensic record appropriate to a credit denial, clinical recommendation or regulatory finding. Evidence retention must also avoid unlimited collection of personal data, confidential material and sensitive prompts. Record intensity should respond to consequence, reversibility, affected population, legal responsibility and dispute risk, while applying purpose limitation, minimisation, access control, retention and deletion rules. Too much indiscriminate logging can create a different governance failure.

可重建的 AI 使用事件至少需要六個相連層次。第一是 Use Context，記錄使用目的、程序節點、法律或契約基礎、預定使用範圍、禁止用途、受影響對象與責任人。第二是 Evidence Inputs，為每個 Evidence Object 保存來源、權威、主體、版本、有效期間、擷取時間與完整性狀態。第三是 Machine Path，保存模型、工具、檢索索引、提示或規則版本、參數、轉換步驟與執行時間。第四是 Inference Boundary，逐項標示直接支撐、衍生計算、模型推論、衝突與未解決命題。第五是 Human Intervention，保存誰檢查、看到哪些材料、修改或拒絕什麼，以及理由。第六是 Institutional Outcome，把最終決定、簽核權限、生效時間、救濟管道與後續監測連回同一事件。 每次具後果使用可建立 stable use_event_id，至少包含 case_id、system_id、model_version、toolchain_version、prompt_or_rule_version、retrieval_snapshot_id、evidence_object_ids、output_hash、inference_classification、human_reviewer_id、review_action、decision_owner、decision_status、effective_at、appeal_or_override、retention_rule 與 provenance_log。敏感提示或個資不必全部公開，但系統必須保存足以重建路徑的受控指標、雜湊、權限與版本。若資料依法不得長期保存，也應留下刪除依據、刪除時間及由誰執行。 工作流可設置五道閘門。Admission Gate 檢查用途與資料是否被允許。Evidence Gate 檢查來源身分、版本、時效與必要證據是否齊備。Inference Gate 將直接證據、計算與推論分層，阻止未支撐命題被包裝成事實。Authority Gate 確認機器只在授權範圍內建議，最終決定仍由正確角色作成。Outcome Gate 把簽核、通知、申復、矯正與監測寫回事件鏈。任何一閘缺少關鍵證據時，系統應回傳 Hold、Escalate 或 Request Evidence，而不是用最接近的文字補齊缺口。 控制設計應同時處理重演與反事實測試。重演要求使用相同證據快照、模型或可替代受控版本、提示規則與工具鏈，重建當時結果或可解釋差異。反事實測試則移除一筆關鍵來源、改變排序或替換過期證據，觀察決定是否實質改變。若一項決定對單一不可驗證來源高度敏感，應提高人工覆核與第二來源要求。 組織應把變更控制與事件控制連接。模型升級、檢索索引更新、提示模板修改、權限重設或供應商服務變更，都要產生新版本，並界定哪些正在進行的案件需要重新執行或重新核准。事故、申訴或監測異常發生時，調查人員應能從制度結果回溯至人工介入、機器路徑與 Evidence Object，而不是只取得一張輸出截圖。

A reconstructable AI use event requires at least six connected layers. Use Context records the purpose, process step, legal or contractual basis, intended scope, prohibited use, affected people and accountable owner. Evidence Inputs preserve source, authority, subject, version, validity period, retrieval time and integrity state for each Evidence Object. Machine Path records the model, tools, retrieval index, prompt or policy version, parameters, transformations and execution time. Inference Boundary classifies direct support, derived calculation, machine inference, conflict and unresolved proposition. Human Intervention records who reviewed the output, what material was available, what was changed or rejected and why. Institutional Outcome connects the final decision, authorisation, effective time, appeal mechanism and subsequent monitoring to the same event. A consequential use record can be anchored by a stable use_event_id with case_id, system_id, model_version, toolchain_version, prompt_or_rule_version, retrieval_snapshot_id, evidence_object_ids, output_hash, inference_classification, human_reviewer_id, review_action, decision_owner, decision_status, effective_at, appeal_or_override, retention_rule and provenance_log. Sensitive prompts and personal data do not always need to be exposed. The system still needs governed identifiers, hashes, versions and permissions sufficient to reconstruct the pathway. When information must be deleted, the record should preserve the legal basis, deletion time and responsible actor. Five gates can govern the workflow. The Admission Gate verifies that the purpose and data are authorised. The Evidence Gate verifies source identity, version, timeliness and required evidence. The Inference Gate separates direct evidence, calculation and inference and prevents unsupported propositions from being presented as facts. The Authority Gate ensures that machine analysis remains inside the authorised recommendation boundary and that the correct role makes the final decision. The Outcome Gate writes approval, notice, appeal, correction and monitoring back to the event chain. Missing material should produce Hold, Escalate or Request Evidence, not a plausible completion invented by the model. Control design should support replay and counterfactual testing. Replay uses the same evidence snapshot, the same or a controlled equivalent model, the same prompt rules and the same tools to reproduce the result or explain the difference. Counterfactual testing removes a critical source, changes a ranking or replaces expired evidence to determine whether the decision materially changes. High sensitivity to one unverifiable source should raise the human-review and second-source requirement. Change control must be connected to use-event control. A model upgrade, retrieval-index refresh, prompt-template revision, permission change or external service update should create a new version and identify which active cases require rerun or renewed approval. When an incident, complaint or monitoring anomaly occurs, investigators should be able to move backwards from the institutional outcome through human intervention and the machine path to the underlying Evidence Objects. A screenshot of the final output is not enough.

本篇證據鏈分為四層。第一層是 sustainabilitynewsnetwork.net 的 EIS-020 正典原文，用於確認系列身分、作者、發布日期、原始英文論證與分析用語邊界，不計入外部證據。第二層是 EIA-010「After Deployment」，支撐 evidence validity、Evidence Decay 與部署後持續治理的前序問題；它是指定來源資料，不計入 15 筆獨立外部來源。第三層是 MWP03 與 MWP04 兩筆 DOI 方法文件，用於界定 Evidence Object、來源保存、推論分類與機器分析的制度權威邊界；同屬受控研究體系，不主張獨立外部驗證。 第四層包含 17 筆獨立外部官方來源。歐盟 AI Act 支撐高風險 AI 的日誌、人類監督、部署者監測與使用情境評估基線；GDPR 支撐自動化決策、資料保護影響評估、資料最小化與問責；DORA 與 NIS2 支撐金融與關鍵組織對 ICT 風險、事件、供應商與紀錄的控制。歐洲委員會 Ethics Guidelines 與 ALTAI 支撐人類能動性、透明度、技術穩健、問責與自我評估。Council of Europe、UNESCO 與 OECD 文件支撐人權、民主、風險管理、透明度與責任的全球治理方向。 NIST AI RMF、Playbook 與 Generative AI Profile 支撐 Govern、Map、Measure、Manage 以及生成式 AI 風險的操作框架。美國 GAO Accountability Framework 支撐 governance、data、performance 與 monitoring 四個問責面向；OMB M-24-10 支撐政府機關對權利或安全影響 AI 的治理、清冊、最低實務與責任角色。加拿大 Directive on Automated Decision-Making、新加坡 Model AI Governance Framework 與英國 Algorithmic Transparency Recording Standard 則提供部署者責任、影響分級、人類介入、透明紀錄與公共部門使用揭露的不同制度實例。 這 17 筆來源證明的是既有法規與治理架構已要求或鼓勵紀錄、監測、透明、人類監督、風險管理與問責。它們不獨立驗證 Usage Evidence Gap、Epistemic Authority Boundary、六層使用事件模型或本篇對台灣市場的判斷。所有來源均保存標題、機構、角色、出版日期、精確查核時間與支撐範圍，並把同體系方法資料與真正的外部來源分開計數。

The evidence chain has four layers. The first is the canonical EIS-020 publication on sustainabilitynewsnetwork.net. It establishes series identity, author, publication date, original English analysis and terminology boundaries, and is not counted as external evidence. The second is EIA-010, After Deployment. It supports the predecessor problem of evidence validity, Evidence Decay and continuous post-deployment governance. It is the user-required source-data link and is excluded from the independent external source count. The third layer contains MWP03 and MWP04. Those DOI publications define Evidence Objects, provenance preservation, inference classification and the institutional authority boundary for machine-supported analysis. They belong to the same controlled research environment and do not claim independent validation. The fourth layer contains 17 independent external official sources. The EU AI Act supports the baseline for logging, human oversight, deployer monitoring and use-context assessment. GDPR supports automated-decision safeguards, data-protection impact assessment, minimisation and accountability. DORA and NIS2 support ICT risk, incident, supplier and record controls for financial and essential organisations. The European Commission Ethics Guidelines and ALTAI support human agency, transparency, robustness, accountability and structured self-assessment. Council of Europe, UNESCO and OECD instruments support global directions concerning human rights, democracy, transparency, risk and responsibility. The NIST AI RMF, its Playbook and the Generative AI Profile support the Govern, Map, Measure and Manage structure and operational treatment of generative-AI risks. The United States GAO accountability framework supports governance, data, performance and monitoring dimensions. OMB Memorandum M-24-10 supports federal governance, inventories, minimum practices and named responsibility for rights-impacting or safety-impacting AI. Canada's Directive on Automated Decision-Making, Singapore's Model AI Governance Framework and the United Kingdom Algorithmic Transparency Recording Standard provide different institutional examples of impact classification, human intervention, deployer responsibility, transparency records and public-sector disclosure. These 17 sources establish that laws and governance frameworks already require or encourage records, monitoring, transparency, human oversight, risk management and accountability. They do not independently validate the Usage Evidence Gap, the Epistemic Authority Boundary, the six-layer use-event model or the Taiwan interpretation in this edition. Every source record contains a title, institution, source role, publication date, exact verification timestamp and supported-claim scope. Controlled first-party methodology and independent external evidence remain separately counted.

對董事會、風險與內稽而言，AI 治理報告不能只列已核准模型數量、準確率與事故數。治理單位需要知道哪些具後果流程使用 AI、機器輸出影響哪個決策節點、多少案件被人工推翻、哪些來源反覆造成衝突，以及是否能由結果回到證據與責任人。Usage Evidence Gap 可成為控制測試的標的，而不是另一個抽象成熟度分數。 對金融、保險與資本市場而言，AI 可能影響授信、詐欺偵測、投資研究、風險評級、理賠與永續資料判讀。機構若只保存模型分數，將無法回答當時採用哪一版客戶資料、外部資訊、政策規則與人工例外。對醫療與生命科學而言，檢索內容、臨床資料版本、適用族群、醫師覆核及後續結果需要同一事件識別，否則輔助決策與專業責任會被切開。 對半導體、電子、製造與出口供應鏈而言，生成式 AI 可能用於規格比對、供應商資格、材料來源、產品碳資料、品質異常與客戶問卷。錯誤不是只發生在答案生成，也可能發生在舊版規格被檢索、不同法人資料被混用、推論超出產品批次或人工簽核未覆蓋實際主張。採購、品質、法遵與永續單位需要共享 evidence identity，但保留各自決策權。 對軟體與 AI 供應商而言，市場需求會從模型 API 延伸到 use-event registry、retrieval snapshot、policy versioning、evidence citation、inference labelling、human review console、override log 與 outcome monitoring。這些功能不能以「可解釋 AI」一詞籠統替代，因為模型解釋、來源追溯、程序授權與法律理由是不同證據物件。

For boards, risk functions and internal audit, an AI governance report cannot stop at approved-model counts, accuracy and incident totals. Oversight bodies need to know which consequential processes use AI, which decision point a machine output influences, how often humans reverse a recommendation, which sources repeatedly create conflict, and whether an outcome can be reconstructed to evidence and responsible people. The Usage Evidence Gap can become a control-testing object rather than another abstract maturity score. For banking, insurance and capital markets, AI can influence credit, fraud detection, investment research, risk rating, claims and sustainability-data analysis. If the institution stores only a score, it cannot explain which version of customer data, external information, policy rules and human exceptions applied at the time. In healthcare and life sciences, retrieved material, clinical-data version, applicable population, professional review and later outcome need one event identity so that decision support is not separated from professional responsibility. For semiconductors, electronics, manufacturing and export supply chains, generative AI may support specification comparison, supplier qualification, material-origin review, product-carbon data, quality investigation and customer questionnaires. Failure may arise before answer generation when an old specification is retrieved, records from different legal entities are combined, an inference exceeds the product batch, or approval does not cover the actual claim. Procurement, quality, compliance and sustainability functions need shared evidence identity while retaining distinct decision authority. For software and AI providers, demand will expand from model APIs to use-event registries, retrieval snapshots, policy versioning, evidence citations, inference labels, human-review consoles, override logs and outcome monitoring. These functions should not be collapsed into the phrase explainable AI. Model explanation, source provenance, procedural authority and legal reasons are separate evidence objects and require separate controls.

SNN editorial analysis：歐洲與全球的具體制度變動，是歐盟 AI Act 已把高風險 AI 的自動事件記錄、人類監督、部署者監測、日誌保存及特定使用情境的基本權利影響評估納入法律架構，同時 Council of Europe、UNESCO、OECD、NIST、GAO 與各國政府框架把透明、風險管理與問責從模型設計推進到實際部署；這些外部制度變動將透過歐洲客戶及母公司的供應商契約、AI 採購條款、金融機構與保險人的第三方風險要求、跨境資料治理、確信程序、產品責任與稽核問卷傳導，具體使台灣半導體與電子製造、金融保險、醫療科技、軟體服務、上市櫃公司及公部門面臨對 use event、證據來源、模型與工具版本、人工覆核、決策理由、異常處理及保存期限的可重建紀錄要求。這條「外部制度變動、傳導機制、台灣市場影響」鏈不表示歐盟 AI Act 普遍直接適用所有台灣 AI 使用，也不表示上述國際框架已成為台灣法律；它指出的是台灣組織會先在歐洲市場輸出、跨國集團控制、客戶盡職調查、融資保險、採購與確信條件中承受制度傳導。 台灣半導體與電子製造業的資訊、品質、採購與法遵主管應在每次 AI 輔助供應商資格、產品規格或永續資料決定完成前，共同核對 use_event_id、來源文件版本、檢索快照、產品或法人綁定、模型與提示規則版本、人工修改及核准理由，並在客戶查核或每季內控抽查時重演選定案件。台灣金融與保險機構的風險、法遵、模型治理與業務負責人應在每次權利、授信、理賠、投資或重大風險判斷生效前，保存輸入資料日期、外部來源、模型分數、衝突訊號、人工覆核、例外權限與決定時間，並在模型更新、申訴或異常事件發生後重新驗證受影響案件。台灣醫療科技、軟體服務、上市櫃公司與公部門的系統所有人應在每次模型、檢索索引、工具鏈或提示模板上線及變更前，測試過期來源、錯誤主體、缺失證據、推論越界、人工否決與申復路徑，只有測試結果、責任人與修正紀錄完整時才允許進入正式工作流。 揭露前證據基礎設施（Pre-Disclosure Evidence Infrastructure）在此不是增加一份 AI 政策，而是把 Evidence Object、use event、machine path、inference boundary、human intervention 與 institutional outcome 綁定到同一可追溯事件鏈。它讓台灣企業在對客戶、主管機關、銀行、保險人、董事會或確信人員說明 AI 使用前，先證明哪些內容來自來源、哪些經方法轉換、哪些只是推論、誰有權接受，以及何時需要重新驗證。此段為 SNN.TW editorial interpretation，不是歐盟或台灣主管機關已驗證的市場事實，也不構成法律、醫療、授信、投資、確信或採購意見。

SNN editorial analysis: The concrete European and global institutional change is that the EU AI Act has placed automatic event logging, human oversight, deployer monitoring, log retention and, for defined contexts, fundamental-rights impact assessment inside a legal framework for high-risk AI, while the Council of Europe, UNESCO, OECD, NIST, GAO and national government frameworks are moving transparency, risk management and accountability from model design into actual deployment. This European and global institutional change will transmit through European customer and parent-company supplier contracts, AI procurement clauses, bank and insurer third-party-risk requirements, cross-border data governance, assurance procedures, product-liability review and audit questionnaires. It will concretely affect Taiwan semiconductor and electronics manufacturing, financial services, insurance, medical technology, software providers, listed companies and public bodies by increasing demand for reconstructable records of each use event, evidence source, model and tool version, human review, decision rationale, exception handling and retention period. This complete chain of institutional change, transmission mechanism and Taiwan market impact does not assert that the EU AI Act applies generally to every Taiwan AI use or that the cited international frameworks are Taiwan law. It identifies where Taiwan organisations are likely to experience the transmission first: European market access, multinational group controls, customer due diligence, financing, insurance, procurement and assurance. Before every AI-assisted supplier-qualification, product-specification or sustainability-data decision is completed, the information, quality, procurement and compliance owners of a Taiwan semiconductor or electronics manufacturer should jointly verify the use_event_id, source-document version, retrieval snapshot, product or legal-entity binding, model and prompt-rule version, human amendments and approval reason, then replay selected cases during each customer audit or quarterly internal-control review. Before every rights-affecting, credit, insurance-claim, investment or material-risk decision takes effect, the risk, compliance, model-governance and business owners of a Taiwan financial institution or insurer should preserve the input-data date, external sources, model score, conflict signals, human review, exception authority and decision time, then revalidate affected cases after every model update, complaint or abnormal event. Before every model, retrieval index, toolchain or prompt template is launched or changed, the system owner of a Taiwan medical-technology company, software provider, listed company or public body should test expired sources, wrong-subject binding, missing evidence, inference overreach, human rejection and appeal paths, allowing production use only when the test result, accountable owner and correction record are complete. Pre-Disclosure Evidence Infrastructure in this context is not another AI policy. It binds the Evidence Object, use event, machine path, inference boundary, human intervention and institutional outcome into one traceable event chain. It enables a Taiwan organisation to show customers, regulators, banks, insurers, boards and assurance practitioners which content came from a source, which was transformed under a method, which remained inference, who had authority to accept it, and when renewed verification was required before any external statement. This section is SNN.TW editorial interpretation, not a source-verified finding of the European Union or a Taiwan authority, and it is not legal, medical, credit, investment, assurance or procurement advice.

下一階段不應只追蹤更多 AI 法規名稱，而要觀察制度是否開始要求使用事件的端到端可重建性。重要問題包括：歐盟 AI Act 的標準、指引、監管實務與事故處理是否會把日誌要求連到具體證據路徑；基本權利影響評估是否會與資料保護、資安、內控及申訴紀錄互通；跨境集團與產業採購是否把這些要求轉成可驗證的供應商條款。 實作上可先進行四項壓力測試。第一，替換一筆關鍵來源並確認系統能顯示哪些結論受到影響。第二，更新模型、提示或檢索索引後重演同一案件，保存差異與重新核准結果。第三，讓人工覆核者拒絕部分輸出，確認原始輸出、修改內容與理由都不被覆寫。第四，模擬申訴、事故或訴訟保存要求，從最終決定回溯到 Evidence Object、工具鏈、推論與權限。 EIS-020 的訊號不是所有 AI 互動都應被永久監控，而是機器影響越具後果，機構越需要以比例原則保存可重建的使用證據。真正成熟的 AI 治理應能同時回答三件事：系統是否被治理、這次使用發生了什麼、以及誰有權把機器分析轉成制度結果。

The next phase should not be measured by the number of additional AI laws cited. The central question is whether institutions begin to require end-to-end reconstructability of use events. Important developments include whether EU AI Act standards, guidance, supervisory practice and incident procedures connect log requirements to evidentiary pathways; whether fundamental-rights impact assessments become interoperable with data protection, cybersecurity, internal control and complaint records; and whether multinational groups and sectoral procurement convert those requirements into verifiable supplier clauses. Implementation can begin with four stress tests. First, replace one critical source and verify that the system identifies every affected proposition and decision. Second, rerun the same case after a model, prompt or retrieval-index change and preserve the difference and renewed approval. Third, require a human reviewer to reject part of an output and verify that the original, modification and reason all remain immutable. Fourth, simulate a complaint, incident or litigation hold and trace the final outcome backwards to the Evidence Objects, toolchain, inferences and authority. The EIS-020 signal is not that every AI interaction should be permanently monitored. It is that the more consequential machine influence becomes, the more an institution needs proportionate, reconstructable evidence of actual use. Mature AI governance should be able to answer three distinct questions: was the system governed, what happened in this use event, and who had authority to convert machine analysis into an institutional outcome?