What Makes a Machine-Generated Reactor Record Admissible Evidence?

1. What relied upon means here, and what this paper is not

Relied upon, in this paper, means capable of being used as a basis for a decision by a party that was not present when the thing recorded happened. That party may be a regulator forming a view about compliance, an insurer pricing a risk, a lender testing a covenant, or a grid operator committing capacity. The definition is deliberately practical. It asks whether a record changes what a decision-maker does, not whether it satisfies any formal standard of proof.

What this paper is not needs stating with equal precision. It is not an analysis of legal admissibility, and it takes no position on whether a record of the kind described would be received in any legal proceeding. Where the word admissible appears in the title of this paper, it carries the technical-reliance meaning defined above and nothing further. Questions about legal proceedings belong to counsel and sit outside the scope of this document. The nature note above applies without qualification: this is technical analysis and is not legal, regulatory, engineering, or investment advice.

The question arises now because of a change in operating model rather than a change in law. Oak Ridge National Laboratory research on concepts for autonomous operation of microreactors describes an architecture in which monitoring, diagnosis, and supervisory functions are performed by systems rather than by people watching instruments ^[17]. Brookhaven National Laboratory, in contractor analysis prepared for the NRC, reviews reactor facilities operated without a conventional main control room and sets out what changes when the crew is not co-located with the plant ^[18]. The licensing frame usually cited in this context is proposed 10 CFR Part 57 (a proposed rule published in the Federal Register on May 1, 2026, with the comment period closed on June 15, 2026; not final, and no developer is licensed under it) ^[11].

The consequence is a change in the character of the evidence rather than in its volume. When an inspector is on site, the record and the observer are separable: a licensee log can be checked against what a person saw, and a person can be asked a question the log did not anticipate. As on-site staffing reduces, the record and the observer converge, because the instrument producing the record becomes the principal observer. A relying party then depends on properties of the record itself rather than on corroboration from somebody who was there.

Claim types are distinguished throughout, because a reviewer left to do that sorting resents it. Requirements in force are identified as in force. Proposals are identified as proposals and carry their status at every mention. Staff and contractor documents are labelled as staff or contractor documents at every mention. Published standards are described by what they specify, never by what they might be taken to imply. Everything remaining is our analysis, and where our reading differs from a common industry reading we say so, so that the disagreement can be argued with.

2. Who the relying parties are, and what each of them needs

The four relying parties are usually collapsed into one in vendor material, which obscures the fact that their questions differ in ways that change what a record must contain. A regulator asks whether a licensee is operating inside its licensing basis and whether the licensee's own account of that is reliable. The NRC's Reactor Oversight Process combines baseline inspection, performance indicators, a significance determination process, and assessment ^[7], and the Government Accountability Office has examined how heavily agency safety conclusions rest on the information that process produces ^[9].

An insurer asks a different question. Its interest is in the distribution of losses across a population and over time, so it needs a record that is complete for a period rather than accurate at an instant. A gap in an insurer's record is worse than a lower-resolution record without gaps, because a gap is where an adverse event is most likely to be hiding. An insurer also needs the record to survive the event it describes, which is a durability requirement rather than an accuracy requirement.

A lender's question concerns performance against commitments over the term of the debt, which may be decades. That imposes a requirement almost nobody designs for: the record has to remain checkable long after the software that produced it has been retired, and after the cryptography protecting it has aged. A lender is also the party most likely to want a record produced or appraised by somebody other than the borrower, because the borrower's incentive to present favourably is structural rather than dishonest.

A grid operator's question is the narrowest in time and the most demanding in latency. It needs to know whether capacity committed for the next interval will be delivered, which makes freshness the dominant property and long-term durability close to irrelevant. A record that is authoritative and an hour old is of limited use for dispatch, while an hour-old record may be entirely adequate for an insurer pricing an annual policy. The same record cannot be optimised for both without being designed for both.

The mature example of an independent party drawing conclusions from declarations, measurements, and inspection rather than from presence alone is the IAEA safeguards system ^[16]. It is instructive rather than transferable, since safeguards address material accountancy under international agreements rather than operational state under a domestic licence. The practical point is that these four sets of requirements do not reduce to one another, so a record designed around whichever party is nearest at hand will disappoint the other three. Our companion note on what a reactor's sensors can and cannot attest works the same problem from the instrument end.

3. The six properties a record needs

Working back from those four sets of needs, six properties recur. They are stated here as a checklist a technical reviewer can apply to any proposed record, including ours. None of the six is novel in general computing. What the field lacks is the assembly, applied to reactor state, with an honest assessment of which are supplied today.

1. Attributable. The record identifies the system that produced it and the configuration that system was running, checkably and without asking the producer. RFC 9334, the RATS architecture, treats this as the base case: evidence carries the identity and software state of the attester ^[1]. A record whose origin rests on the reporting organisation's assurance gives a relying party nothing new.

2. Complete. The record covers a defined period with no undeclared gaps, and any gap that occurs is itself recorded. Every relying party reads absence of an alarm as evidence of a normal condition. That inference holds when a silent instrument is distinguishable from a quiet plant, and fails when it is not.

3. Contemporaneous. The record is generated as events occur rather than reconstructed afterwards, and it carries a time reference that can be checked against an external source. A reconstruction reflects what its author believed later, and the difference between the two is precisely what an investigation exists to find.

4. Tamper-evident. Later alteration of the record is detectable by a party holding no privileged access to the system that produced it. This is detection and not prevention. A record of this kind is not tamper-proof, not unhackable, and not unbreakable; a vendor using those words about a digital record is describing an aspiration. Append-only structures make undetected alteration expensive rather than impossible.

5. Independently checkable. A relying party can verify the record without the producer's cooperation, tooling, or continued existence. The parties who need the record most are those with least leverage over its producer at the moment they need it.

6. Durable. Both the record and the means of checking it survive the period over which decisions rest on them: for a lender the term of the debt, for a regulator possibly the life of the facility. A scheme with a shorter useful life than the asset transfers the problem rather than resolving it.

The six interact, and treating them as a menu is an error. Completeness and contemporaneity together are what allow silence to be informative. Attribution and independent checkability together separate a verified record from a well-formatted claim. Durability constrains the cryptography chosen for tamper-evidence. The table states what supplies each property today and what remains unresolved for reactor state.

Two cautions. The middle column describes what a standard specifies, not what any regulator has accepted, and that distinction is the subject of sections 6 and 7. The right-hand column is written from the record cited here; a reader able to close a cell with a source we have missed would be doing us a service.

4. What today's record actually is, and where its limits lie

What a relying party receives today, for an operating power reactor, is largely a record generated by the licensee: control room logs, plant computer histories, procedures with signatures, reports made under licence conditions, and dashboards derived from all of it. The quality of that record varies between organisations and over time. The reason the variation has been tolerable is that the record was never the sole basis for anybody's conclusion.

Presence has substituted for record quality. Licensed-operator conditions attach to a power reactor licence under 10 CFR 50.54(m), a requirement in force ^[10], and the NRC assigns resident inspectors to operating sites with access to the facility, its people, and its records ^[8]. The Reactor Oversight Process assembles that inspection with performance indicators and a significance determination process into an assessment ^[7], and the Government Accountability Office has documented how heavily agency safety conclusions rest on the information the process produces ^[9].

That substitution is worth stating plainly, because it is the assumption most at risk in a reduced-staffing model. A licensee log carries weight partly because an inspector could have watched the same shift, can ask about an entry, and can compare it against what people at the site say. The record is corroborated by a presence that never appears in the record. Remove the presence and the record is asked to carry a load it was not designed to carry, without anything in its construction having changed.

The technical literature is candid about this. Brookhaven National Laboratory, in contractor analysis prepared for the NRC, examines facilities operated without a conventional main control room and identifies what changes when the operating crew is not co-located with the plant ^[18]. Oak Ridge National Laboratory research on concepts for autonomous microreactor operation describes layered monitoring and diagnostics as the substitute for continuous human observation ^[17]. Both are research and contractor products rather than requirements, and both are best read as statements of what specialists regard as unsettled.

A further element of today's record is model output rather than measurement. The Department of Energy reported that Idaho National Laboratory demonstrated a digital twin of a simulated microreactor ^[19]. A twin is a powerful diagnostic aid and a weak evidentiary artefact, because its output is a function of its assumptions as much as of the plant. A relying party asking what the plant did needs the measurement; a relying party asking what the plant would do under a hypothetical needs the model. Our explainer on how to verify that an autonomous microreactor is operating safely keeps the two apart deliberately.

5. What published standards already provide

Four bodies of published work supply parts of the six properties, and not one of them was written for this application. RFC 9334 specifies the RATS architecture, which separates three roles: an attester that produces evidence about itself, a verifier that appraises that evidence against an appraisal policy, and a relying party that consumes the verifier's result and acts on it ^[1]. The separation is the useful part. It supplies a vocabulary for saying precisely who is asserting what to whom, which most discussion of reactor data lacks.

RFC 9943 specifies the SCITT architecture, in which a transparency service records signed statements about artefacts in an append-only log and issues receipts allowing any party to check that a statement was registered and has not been altered since ^[2]. What this supplies is tamper-evidence coupled to independent checkability, because a receipt can be verified later without the cooperation of the service that issued it. The pattern was designed for software supply chains, and nothing in it is specific to software.

RFC 9942 specifies COSE receipts, the concrete format for the proofs a transparency service issues, expressed as verifiable inclusion and consistency proofs against the log ^[3]. Its relevance here is unglamorous and load-bearing: a property with no interoperable wire format is a property that stays inside one vendor's system, and a relying party dealing with four suppliers cannot be expected to check four proprietary proof formats.

Durability is where cryptography becomes a nuclear-timescale problem. NIST announced approval of three federal standards for post-quantum cryptography in August 2024 ^[4], among them FIPS 204, the module-lattice-based digital signature standard ^[5]. A record signed today that must remain checkable across the operating life of a facility is signed with an algorithm whose useful life is a design assumption rather than a certainty. Treating signature agility and re-signing practice as requirements rather than refinements follows directly from the durability property.

NIST SP 800-161r1 sets out cybersecurity supply chain risk management practices for systems and organisations ^[6]. It bears on this paper because attribution is a claim about a device and the software that device is running, and a claim about software is worth what the provenance of that software is worth. A record attributable to a device whose firmware provenance is unknown is attributable in form and not in substance, which is a distinction a technical reviewer will make even if a marketing document does not.

6. What the standards do not provide

The four bodies of work above supply form. None of them supplies acceptance, and conflating the two is the error this section exists to prevent. RFC 9334, RFC 9943, and RFC 9942 are internet standards with no nuclear regulatory standing whatever ^[1][2][3]. Nothing in them establishes that a regulator will treat a record built to their pattern as a basis for a determination, and citing them in a licensing context establishes vocabulary rather than acceptance.

There are also, so far as the record cited here shows, no acceptance criteria to meet. The NRC publishes guidance on digital instrumentation and controls for advanced reactors ^[13] and treats cybersecurity as part of its protective mission rather than as an information-technology overlay ^[14]. Neither addresses the question this paper poses, which is what makes a machine-generated statement about reactor state something a party that was not present can rest a decision on. Proposed 10 CFR Part 57 (a proposed rule published in the Federal Register on May 1, 2026, with the comment period closed on June 15, 2026; not final, and no developer is licensed under it) ^[11], together with NUREG-2271, a draft NRC staff guidance document issued for comment and not final guidance ^[12], is where such criteria could appear.

The second limit is structural and follows from the architecture itself. RFC 9334 separates the attester from the verifier and from the relying party ^[1], which relocates trust rather than removing it. The relying party now has to trust the verifier: its appraisal policy, its software, its independence from the operator, and its continued existence. Who qualifies a verifier, against what criteria, and who checks the verifier, are questions the architecture raises and does not answer. We treat that problem at length in our note on self-attestation and independent verification.

The third limit sits upstream of everything above. A cryptographic chain establishes that a value was reported by a particular device at a particular time and has not changed since. It establishes nothing about whether the value was correct when the device produced it. A compromised or degraded sensor produces a perfectly attested wrong number, and no amount of transparency logging converts that number into a fact about the plant. IAEA Nuclear Security Series No. 33-T addresses computer security of instrumentation and control systems at nuclear facilities, which is exactly this layer ^[15].

Supply-chain assurance occupies the same position ^[6]: it raises the cost of a compromise upstream of the record without converting the record into a statement about physical reality. The honest summary is that these standards make a record hard to alter after the fact and leave the question of whether it was correct when written to instrumentation, qualification, and physical and cyber security. Our microreactor cybersecurity explainer covers that layer in its own terms.

7. The gap, stated precisely

Stated as precisely as we can manage: in the record cited by this paper, there is no accepted evidentiary standard for machine-generated reactor state. There is no published set of properties such a record must have, no acceptance criteria against which one could be assessed, no qualification route for a verifier, and no worked example of a record of this kind being relied upon in a regulatory determination. The absence is not a criticism of any party. The operating models that make the question urgent are themselves proposals and research programmes.

Closing that gap is not within the gift of a vendor. Acceptance belongs to the regulator, through rulemaking, guidance, or determinations on individual dockets. Form belongs to standards bodies, which have supplied a good deal of it already ^[1][2][3]. Method, meaning validated ways of demonstrating that a record has the properties claimed for it, belongs to research organisations. Operating experience, without which no criterion can be calibrated, belongs to licensees.

A path can be described without any claim to be standing on it. Pre-application interaction with the NRC includes mechanisms by which a developer asks staff to review a discrete technical topic ahead of an application ^[20]. A topical report addressed to the evidentiary properties of an automated operating record would have to define the properties, define the failure modes, propose acceptance criteria, and propose how each criterion would be demonstrated. We have not submitted such a report. None has been accepted. We are aware of no NRC position on the subject, and pre-application interaction confers no approval of any kind.

A demonstration path is the other half, because a record of this kind cannot be assessed in the abstract. It has to be produced by real instruments in a real configuration over a period long enough for gaps, clock drift, maintenance outages, and instrument failures to occur, since those are the conditions under which completeness and contemporaneity are actually tested. A research or test setting is where that becomes possible before it is possible at a licensed facility. Whether such a demonstration would be credited by anybody is unresolved, and it is one of the entries in our register of open questions.

The framing we would resist is the one in which the gap is presented as a product opportunity. It is a shared problem, and most of the parties who will decide how it closes do not sell anything. Proposed 10 CFR Part 57 (a proposed rule published in the Federal Register on May 1, 2026, with the comment period closed on June 15, 2026; not final, and no developer is licensed under it) ^[11] and its associated draft staff guidance issued for comment ^[12] are where the regulatory half would appear if it appears at all, and neither is final. Naming the gap precisely is what this paper offers, and naming a gap is a different act from filling it.

8. Application to RankShield Energy, honestly

Applying the six properties to our own position produces an uncomfortable result, which is the reason to publish it rather than to omit it. RankShield Energy is a pre-applicant engaged in early regulatory interaction with the NRC ^[20]. We hold no NRC license, permit, or design approval. Nothing in our design has been demonstrated to or accepted by the NRC, and the pre-application process described in our explainer on it provides early alignment rather than standing of any kind.

On form, our position is ordinary rather than distinguished, and we would rather say so than imply otherwise. Attribution, tamper-evidence, and independent checkability can be built from published standards that anybody can read ^[1][2][3], and building them competently is engineering rather than an achievement worth advertising. Durability, for us, is a design commitment about signature agility and re-signing practice ^[4][5] rather than a demonstrated property, because no record of ours has yet had time to age.

On the two properties that depend on the plant rather than on the cryptography, we are materially weaker than the technology makes us sound. Completeness and contemporaneity are properties of instrumentation, sensor coverage, failure detection, and the treatment of gaps. A design-stage answer to any of those is an intention subject to analysis, testing, and regulatory review, and the sensor-level compromise described in section 6 sits upstream of anything we build ^[15]. Supply-chain provenance for the devices involved is a live obligation for us rather than a solved one ^[6].

The independence problem applies to us with full force. A verification function supplied by a party holding a commercial relationship with the operator is not independent in the sense a lender or an insurer means, and the honest description of our position is that independence is a governance question we have not resolved rather than a technical property we possess. A verification path also adds a digital interface to a plant, which is a cost in cyber terms that a regulator would weigh against whatever assurance benefit it brings ^[14].

The load-bearing uncertainty is whether any of this is credited at all. It is entirely possible that a regulator concludes that assurance of this kind belongs inside a licensee's own quality and configuration management programmes, and that an external layer adds a component to be reviewed without reducing anything else that must be reviewed. We hold no evidence bearing on that question, our commercial interest in the answer is direct, and readers should weigh the analysis above accordingly and check every source cited rather than accept our summary of it.