Digital Forensics in Opaque AI-Driven Markets

Introduction

Digital forensics in opaque AI-driven markets refers to the systematic collection, preservation, reconstruction, and analysis of electronic evidence where market outcomes are significantly influenced by artificial intelligence, machine-learning systems, automated pricing tools, recommendation engines, algorithmic trading systems, or autonomous commercial agents.

Traditional competition-law investigations often rely on human communications, contracts, meeting records, pricing documents, and witness testimony. AI-driven markets create a different evidentiary environment. A potentially anticompetitive outcome may emerge from models, training data, APIs, software configurations, automated instructions, reinforcement mechanisms, or interactions between algorithms, without a conventional agreement between human decision-makers.

The central forensic problem is therefore:

How can an enforcement authority establish causation, coordination, market power, or exclusionary conduct from digital traces generated by systems whose internal decision-making may be difficult to observe or explain?

This problem is particularly important under Articles 101 and 102 TFEU, national competition laws, and emerging digital-market regulation, because competition authorities increasingly encounter algorithmic pricing, personalised markets, platform ecosystems, automated bidding, and AI-mediated commercial decisions.

1. Meaning of an Opaque AI-Driven Market

An AI-driven market becomes opaque when the authority cannot readily determine from observable prices or outputs:

1. how decisions were generated;
2. what data influenced the decision;
3. which instructions were embedded in the system;
4. whether algorithms communicated directly or indirectly;
5. whether firms anticipated competitors' algorithmic responses;
6. whether apparently independent conduct resulted from common technological infrastructure;
7. whether discriminatory outcomes were intentional or emergent;
8. whether a platform's AI system strategically disadvantaged rivals; or
9. whether human employees exercised meaningful control over the system.

Opacity can exist at several layers.

A. Data layer

The authority must determine:

• what data entered the model;
• where the data came from;
• whether competitors' information was used;
• whether confidential information was scraped or shared;
• whether data was contemporaneous;
• whether data was selectively filtered.

B. Model layer

Investigators may need to reconstruct:

• model architecture;
• training methodology;
• objective functions;
• reward functions;
• loss functions;
• model versions;
• parameter changes;
• fine-tuning;
• reinforcement-learning processes.

C. Decision layer

The relevant question becomes:

Why did the AI make this particular commercial decision?

Examples include:

• raising prices;
• refusing access;
• lowering a rival's visibility;
• changing advertising bids;
• prioritising particular sellers;
• allocating scarce computing resources;
• changing commission rates.

D. Interaction layer

Two apparently independent AI systems may repeatedly interact.

Forensic analysis therefore examines:

• timing;
• common inputs;
• common software providers;
• API interactions;
• repeated price movements;
• common optimisation targets;
• response times;
• communication protocols.

2. Why Digital Forensics Is Necessary

A conventional antitrust investigation may establish coordination through emails such as:

"We should increase our prices next Monday."

An AI-driven cartel may contain no equivalent communication.

Instead, investigators may discover:

• configuration files;
• API calls;
• model-training logs;
• deployment histories;
• Git repositories;
• feature-engineering scripts;
• system prompts;
• reward-function changes;
• telemetry;
• cloud logs;
• automated bidding records;
• model outputs;
• rollback events.

The evidence may therefore be distributed across technical systems rather than contained in human communications.

Digital forensics becomes the bridge between:

technical evidence → economic behaviour → legal inference.

3. Principal Objectives of AI Forensics

3.1 Establishing provenance

Investigators must establish where a particular digital artifact originated.

For example:

Price increase → AI recommendation → model version → input data → algorithmic instruction → human approval/deployment

This chain can establish evidential provenance.

3.2 Establishing temporal sequence

Timing becomes exceptionally important.

Suppose:

• Firm A's algorithm changes at 10:01:03;
• Firm B's algorithm changes at 10:01:07;
• prices change at 10:01:10;
• the pattern repeats thousands of times.

The investigator must determine whether the temporal relationship is:

• coincidence;
• common external shock;
• common software;
• automated response;
• information exchange; or
• coordinated conduct.

3.3 Establishing causation

A correlation between an AI output and market conduct is not automatically proof of infringement.

Forensic analysis must establish:

Input → model process → output → commercial implementation → market effect.

This distinction prevents authorities from treating every algorithmic correlation as collusion.

4. Major Sources of Digital Forensic Evidence

4.1 Source code

Source code may reveal:

• pricing rules;
• competitor-monitoring mechanisms;
• prohibited variables;
• discriminatory ranking criteria;
• communication functions;
• strategic constraints.

4.2 Model documentation

Important evidence includes:

• model cards;
• system documentation;
• technical specifications;
• deployment notes;
• risk assessments;
• change logs.

These can reveal the intended function of the system.

4.3 Training data

Training datasets may demonstrate that an algorithm was trained on:

• competitor prices;
• confidential information;
• marketplace data;
• customer-specific information;
• commercially sensitive forecasts.

The crucial issue is not merely what data existed, but whether the system was designed to exploit it competitively.

4.4 Logs

Logs may be among the most important forensic evidence.

They can establish:

• user identity;
• timestamp;
• model version;
• input;
• output;
• API call;
• deployment event;
• configuration change.

4.5 Cloud infrastructure

Investigators increasingly need to examine:

• cloud storage;
• containers;
• serverless functions;
• Kubernetes deployments;
• model registries;
• GPU instances;
• access-control logs.

This is particularly significant where companies do not physically host their AI infrastructure.

4.6 APIs

API logs can establish communication between:

• platforms;
• sellers;
• pricing systems;
• advertising exchanges;
• AI providers;
• data brokers.

An API may effectively become a digital communication channel even where no human communication exists.

5. Forensic Reconstruction of Algorithmic Coordination

A useful methodology is a five-stage reconstruction model.

Stage 1 — Identify the system

Determine:

• who owns it;
• who developed it;
• who operates it;
• what decisions it controls.

Stage 2 — Preserve the evidence

Preserve:

• original logs;
• model versions;
• databases;
• source code;
• configuration files;
• metadata.

The forensic principle should be:

Preserve before interpreting.

Stage 3 — Reconstruct inputs

Determine precisely what information the system received.

Stage 4 — Reconstruct decision logic

Analyse:

• rules;
• models;
• objective functions;
• constraints;
• optimisation processes.

Stage 5 — Compare output with market behaviour

The investigator then asks whether the AI's behaviour corresponds with:

• competitors' behaviour;
• exclusionary outcomes;
• coordinated pricing;
• market foreclosure;
• discriminatory treatment.

6. AI Forensics and Tacit Coordination

One of the most difficult problems concerns tacit algorithmic coordination.

Suppose several competing algorithms independently learn:

"Prices are higher when competitors maintain high prices."

They may eventually converge on a stable high-price equilibrium.

There may be:

• no meeting;
• no email;
• no explicit instruction;
• no direct communication.

The competition-law question becomes whether the outcome constitutes:

1. unilateral intelligent adaptation;
2. conscious parallelism;
3. exchange of competitively sensitive information;
4. algorithm-mediated concerted practice; or
5. an agreement/concerted practice attributable to the firms.

Digital forensics cannot itself answer the legal question. It supplies evidence from which the legal classification can be made.

7. Case Laws

1. United States v. Topkins — Algorithmic Price-Fixing

This is one of the most important examples involving digital evidence and algorithmic pricing.

The U.S. Department of Justice prosecuted online sellers who agreed to fix prices of posters and other products sold online. The defendants used algorithms to implement agreed pricing strategies.

Forensic significance

The case demonstrates that investigators can connect:

human agreement → algorithmic implementation → automated prices.

The important lesson is that automation does not break the evidentiary chain. If humans agree to fix prices and then use software to implement that agreement, the algorithm can become the instrument of the cartel.

Principle

Algorithmic implementation does not immunise an underlying agreement from antitrust liability.

8. United States v. Airline Tariff Publishing Co.

The Airline Tariff Publishing litigation concerned sophisticated computerised systems used by airlines to communicate and publish fare information.

The case is important because it demonstrated how electronic pricing systems can facilitate coordination without conventional face-to-face meetings.

Forensic relevance

Investigators can examine:

• timing of fare changes;
• sequence of announcements;
• pricing signals;
• computerised communications;
• responses by competitors.

Significance for AI markets

Modern AI systems can make these processes vastly faster and more complex.

Thus, forensic reconstruction of machine-readable market signals becomes increasingly important.

9. Interstate Circuit, Inc. v. United States

This Supreme Court decision is a foundational authority on circumstantial evidence of concerted action.

The Court accepted that an agreement could be inferred from:

• knowledge of competitors' conduct;
• communication of commercially significant proposals;
• subsequent conduct consistent with the communicated strategy.

Relevance to AI

AI-driven markets create a technological version of the same evidentiary problem.

Instead of letters being exchanged between firms, investigators may examine:

• APIs;
• automated signals;
• platform notifications;
• algorithmic recommendations;
• common data feeds.

The underlying legal question remains whether the evidence demonstrates concerted conduct rather than independent action.

10. United States v. Apple Inc.

The Apple e-books litigation provides a major example of the use of extensive electronic evidence to reconstruct coordination.

The evidence included communications and digital records concerning interactions between Apple and publishers.

Forensic lesson

Electronic evidence can establish:

• chronology;
• communications;
• strategic objectives;
• knowledge;
• implementation.

The broader lesson for AI markets is that digital forensic reconstruction should integrate technical evidence with ordinary documentary evidence.

An AI investigation should therefore not become exclusively technical.

11. FTC v. Amazon.com, Inc.

The U.S. Federal Trade Commission's litigation against Amazon provides an important contemporary example of competition enforcement involving large-scale digital-platform systems.

Although not simply an "AI cartel" case, the litigation illustrates the evidentiary challenge created by complex digital-platform architecture.

Forensic significance

Investigators examining large platforms may need to analyse:

• internal software systems;
• pricing mechanisms;
• seller information;
• ranking systems;
• business rules;
• internal communications;
• automated decision-making.

Principle for AI investigations

The relevant market conduct may be embedded inside a technological architecture rather than in a single contractual document.

12. Google Search (Shopping) — European Commission

The European Commission's Google Shopping decision provides a major precedent concerning algorithmically mediated search rankings.

The Commission found that Google had systematically favoured its comparison-shopping service in search results and treated the conduct as an abuse of dominance.

Forensic relevance

The case demonstrates the importance of examining:

• ranking algorithms;
• traffic allocation;
• visibility;
• algorithmic treatment of rivals;
• changes to ranking mechanisms.

The critical forensic question in AI markets becomes:

Does the system's architecture systematically transform algorithmic control into exclusionary advantage?

This extends digital forensics beyond price fixing.

13. Google Android — European Commission

The Google Android decision concerned several practices involving Google's mobile ecosystem.

Its importance for AI-driven markets lies in the investigation of interconnected technological layers.

The relevant ecosystem included:

• operating systems;
• app distribution;
• search;
• licensing;
• default settings.

Forensic lesson

Competition investigations increasingly require ecosystem-level forensic reconstruction.

In an AI ecosystem, investigators may similarly need to connect:

cloud → compute → model → API → application → distribution → data.

A forensic examination limited to one layer may therefore miss the mechanism through which market power is exercised.

14. Qualcomm — European Commission

The European Commission's Qualcomm decisions demonstrate the significance of extensive technical and commercial evidence in investigating exclusionary conduct involving technologically sophisticated markets.

Forensic relevance

The investigation illustrates the importance of reconstructing:

• contractual arrangements;
• payment structures;
• product strategies;
• customer relationships;
• technological dependencies.

Application to AI

AI markets may similarly involve:

• exclusive compute arrangements;
• model access restrictions;
• API dependency;
• cloud incentives;
• preferential infrastructure access.

Digital forensics can therefore help establish whether technological dependency is accidental or strategically engineered.

15. Important Evidentiary Distinction: Outcome vs Intent

A critical principle in AI antitrust investigations is:

Algorithmic outcome ≠ automatically unlawful intent.

An AI system may produce:

• parallel prices;
• discriminatory rankings;
• exclusionary outcomes;
• identical recommendations.

That alone does not establish an infringement.

Investigators must distinguish between:

A. Designed conduct

The system was expressly configured to achieve the anticompetitive result.

B. Constrained conduct

The outcome resulted from commercially legitimate constraints.

C. Emergent conduct

The outcome emerged unexpectedly from machine learning.

D. Coordinated conduct

The system was designed or operated in circumstances amounting to unlawful coordination.

This classification is fundamental to a legally defensible enforcement action.

16. The Problem of Explainability

Traditional software often permits investigators to follow explicit rules:

IF competitor price > X → increase price by Y.

Machine-learning systems may instead produce:

Input → neural network → latent representations → probabilistic output.

The forensic challenge is therefore not necessarily to reproduce every internal mathematical operation.

It may be sufficient to establish:

1. what information entered the model;
2. what objective it was optimising;
3. what constraints existed;
4. what outputs it repeatedly generated;
5. what changes occurred following model retraining;
6. whether humans knowingly deployed the system.

This produces a functional explanation rather than a complete mathematical explanation.

17. Model Versioning as Antitrust Evidence

Every major AI system should theoretically be capable of reconstruction across versions.

Forensic investigators should compare:

Model V1 → Model V2 → Model V3 → Model V4

and determine:

• when behaviour changed;
• what code changed;
• what data changed;
• what objective changed;
• what commercial outcome followed.

A sudden increase in exclusionary behaviour following a particular model update may be highly probative, although it would still require contextual analysis.

18. Digital Forensics and Article 101 TFEU

For Article 101 investigations, forensic evidence may be used to establish:

Agreement

Evidence of:

• common instructions;
• coordinated deployment;
• shared systems;
• communications.

Concerted practice

Evidence of:

• exchange of strategic information;
• algorithmic signalling;
• coordinated adaptation.

Object restriction

For particularly serious conduct, forensic evidence may help demonstrate that the system was used to implement an inherently anticompetitive strategy.

Effect restriction

Economic and technical evidence may establish actual market effects.

19. Digital Forensics and Article 102 TFEU

For Article 102, forensic analysis can help establish:

Dominance

Technical evidence may demonstrate control over:

• data;
• infrastructure;
• APIs;
• compute;
• distribution;
• ecosystem access.

Abuse

Possible forensic indicators include:

• algorithmic self-preferencing;
• discriminatory access;
• strategic throttling;
• ranking manipulation;
• interoperability restrictions;
• exclusionary recommendation systems;
• automated degradation of rivals.

Causation

Investigators can compare system changes with:

• competitor traffic;
• market shares;
• prices;
• conversion rates;
• access conditions.

20. Digital Forensic Chain of Custody

Because AI evidence can be modified continuously, chain of custody becomes especially important.

An authority should document:

Collection → Hashing → Preservation → Authentication → Analysis → Reproduction → Presentation

Important forensic safeguards include:

• cryptographic hashes;
• immutable storage;
• timestamp verification;
• access logs;
• version control;
• forensic copies;
• documentation of analytical tools.

This is particularly important where a company argues that the authority analysed an outdated model or incorrectly reconstructed an algorithm.

21. Problems With Black-Box Evidence

A company may argue:

"Nobody intended this outcome. The model learned it."

That raises difficult questions.

Who is responsible for:

• training the model?
• selecting the reward function?
• choosing the objective?
• deploying the model?
• monitoring it?
• ignoring warning signals?

The fact that an outcome was generated autonomously does not necessarily eliminate corporate responsibility.

At the same time, competition authorities must avoid converting mere technological unpredictability into presumed liability.

22. Counterfactual Forensic Testing

One of the strongest techniques is counterfactual testing.

Investigators can ask:

What would the market have looked like if the disputed model or instruction had not existed?

For example:

Actual system

AI model → high prices → reduced rival traffic

versus

Counterfactual system

AI model without disputed feature → lower prices → greater rival traffic

Repeated controlled testing can strengthen causal inference.

23. Synthetic Reconstruction

Investigators may create a controlled environment replicating:

• market conditions;
• competitors;
• data;
• algorithms;
• constraints.

They can then test whether the observed conduct emerges.

This is particularly useful for:

• algorithmic collusion;
• dynamic pricing;
• automated bidding;
• recommendation systems;
• autonomous procurement.

However, a laboratory simulation is evidence about possibility or mechanism, not automatically proof of what happened in the real market.

24. Common Forensic Failure Modes

1. Looking only at source code

The source code may not reflect the deployed model.

2. Ignoring training data

The behaviour may be primarily determined by training rather than explicit code.

3. Ignoring model versions

A current model may differ substantially from the model operating during the alleged infringement.

4. Treating correlation as coordination

Parallel outputs do not automatically prove an agreement.

5. Ignoring human governance

Board decisions, product managers, engineers, and compliance teams may explain why the system behaved as it did.

6. Ignoring third-party infrastructure

Cloud providers and AI vendors may possess crucial logs.

7. Failing to preserve ephemeral evidence

Containers, temporary logs, model states, and telemetry may disappear rapidly.

25. Proposed Forensic Framework

A competition authority investigating an opaque AI market can use the following framework:

Market Mapping
↓
Identify AI Systems
↓
Identify Controllers and Developers
↓
Preserve Models, Logs and Data
↓
Reconstruct Model Versions
↓
Reconstruct Inputs and Outputs
↓
Identify Human Instructions
↓
Analyse Algorithmic Interactions
↓
Conduct Economic Counterfactuals
↓
Test Alternative Explanations
↓
Establish Causation
↓
Apply Article 101/102 or National Competition Law
↓
Assess Remedies

26. Remedies and Forensic Monitoring

Digital forensics can also become part of the remedy.

Competition authorities may require:

• algorithmic auditing;
• independent monitoring;
• logging obligations;
• model-change notifications;
• access to audit trails;
• interoperability;
• data-access mechanisms;
• restrictions on certain optimisation objectives;
• independent compliance systems.

For systemic platforms, continuous monitoring may be more effective than a one-time investigation because AI systems can evolve after the original enforcement decision.

27. Six Core Legal Lessons

Conclusion

Digital forensics is becoming an essential evidentiary methodology for competition enforcement in opaque AI-driven markets. The decisive evidence may no longer be a contract or email but a combination of model versions, training data, source code, API records, cloud logs, system prompts, configuration changes, telemetry, and economic output data.

The leading cases—from Topkins and Airline Tariff Publishing to Google Shopping, Google Android, Qualcomm, Interstate Circuit, and Apple—illustrate different components of the broader evidentiary problem. They demonstrate that competition law can examine technologically mediated conduct, but they also caution against treating parallel digital outcomes as automatically unlawful.

The central methodological principle should therefore be:

Do not infer illegality merely from an opaque AI outcome; reconstruct the technological, economic, and organisational chain that produced it.

In advanced AI markets, the strongest competition-law investigation will combine digital forensics + economic analysis + technical model reconstruction + traditional documentary evidence + legal attribution. This integrated approach is particularly important where autonomous systems make commercial decisions faster than human investigators can observe them and where market power may be embedded not in a visible contract, but in the architecture of the digital ecosystem itself.