This essay makes a deliberate assumption: a digital twin is a tool, not a second human subject. The question is therefore institutional rather than metaphysical. How should a hospital, manufacturer, law firm, or public authority use a model that represents a person, machine, or process without allowing the model to acquire more authority than its purpose justifies? The answer depends on definition, validation, update cadence, delegation, evidence, and responsibility. Calling something a twin does not transfer judgment or liability to software.
In engineering, a digital twin is commonly a computational representation of a physical object or process that is connected to observations and used to monitor, simulate, or optimize it. A clinical twin might represent a patient's physiology for a treatment comparison. An industrial twin might represent a turbine, factory line, or building. A legal team might use a simulation of a transaction, case schedule, or compliance risk. These are different applications, but each should be treated as a bounded model with inputs, assumptions, outputs, and an accountable user.
Begin With the Model's Purpose
A model is not validated in the abstract. It is validated for a task, population, time horizon, and decision. A clinical model intended to estimate a patient's response to radiation is not thereby validated to determine capacity, adherence, or insurance eligibility. A factory twin that predicts bearing failure is not automatically reliable for setting a worker's performance rating. A litigation simulation that estimates settlement ranges is not a reconstruction of what a witness knows.
The first institutional document should therefore state the intended use in ordinary language. What action may follow the output? Who is affected? What costs arise from a false alarm and a missed warning? Which variables are observed, supplied by a person, inferred, or generated by another model? What decisions are expressly outside the model's mandate? Purpose limitation is not paperwork. It prevents an accurate narrow model from being repurposed into an untested judgment about a person.
Purpose also determines what “real time” means. A model of a ventilator may need second-by-second updates. A model of a building's maintenance schedule may be refreshed hourly or after an inspection. A clinical model may become stale when a medication, diagnosis, or patient goal changes. A legal model may depend on a filing, settlement offer, or new authority. Institutions should record a twin's effective time, data latency, refresh triggers, and expiration conditions rather than treating a current-looking dashboard as current knowledge.
Validation Is a Continuing Duty
Validation should test more than whether predictions were accurate on historical data. Developers should specify the reference outcome, the comparison standard, calibration, subgroup performance, missing-data behavior, and the consequences of error. Prospective testing matters because deployment changes the environment. When clinicians alter treatment in response to a prediction, or operators change a machine schedule in response to a warning, the old data no longer describe a passive setting.
A twin needs a change log. Sensors can drift, labels can be revised, software dependencies can change, and the represented object can change its condition. An industrial model trained on one production line may fail after a redesign. A clinical model may underperform in a hospital whose patients differ from the development population. A legal model may encode a rule that has been amended. Version numbers, validation reports, confidence limits, known exclusions, and rollback procedures let a user ask not only “What did it say?” but “Which version said it, from what evidence, under what conditions?”
Monitoring should include the possibility that the model is right for the wrong reason. A hospital can track calibration while missing that access to follow-up care drives the apparent relationship. A manufacturer can celebrate fewer breakdowns while shifting risk to maintenance workers. Domain experts and affected people should be able to identify changes the training data cannot see.
Delegation Does Not Remove Authority
A user can delegate a bounded task to software: rank likely causes, simulate a pressure change, flag an anomaly, or compare treatment scenarios. Delegation should identify the principal, the operator, the permitted action, the escalation threshold, and the person who may override the output. “The system decided” is not an adequate account of authority. An automated recommendation may be the immediate cause of an action while the institution remains responsible for choosing to deploy it and for setting the conditions under which it operates.
Clinical delegation has a special boundary. A physician may use a patient-specific model to support professional judgment, but the model cannot supply informed consent, discover a patient's values, or make an ethical decision about burdens and benefits. The patient needs a comprehensible explanation of the relevant options and uncertainty. A clinician who follows an output without checking its scope has not converted the output into medical authority; they have created a human failure in the use of a tool.
Legal delegation has a similar boundary. A lawyer may use a model to search, organize, forecast, or test a negotiation strategy, but professional duties of competence, communication, confidentiality, loyalty, and supervision remain. Under the American Bar Association Model Rules, Rules 1.1, 1.4, 1.6, and 5.3 are relevant examples, subject to the law and ethics rules of the applicable jurisdiction. A client's authorization to use a tool does not authorize disclosure of another person's confidential information, and a generated assertion is not legal research merely because it is fluent.
Fiduciary Duties and Conflicts of Interest
Many twin deployments place an institution in a position of dependence or trust. A clinician owes professional duties to the patient, not merely to the vendor's performance metric. A lawyer owes duties to the client, not to a platform that sells optimization data. A plant owner has duties to workers and the public that cannot be narrowed to production targets. Public agencies must apply their lawful authority fairly rather than use a model to make a difficult decision appear inevitable.
Conflicts should be disclosed and governed. Who benefits when the clinical twin recommends a more expensive intervention? Does an industrial vendor receive data from every customer and then improve a competing product? Does a legal analytics provider retain privileged documents or use them to train an unrelated service? The institution should identify the model owner, data controller, vendor role, retention terms, and incentives attached to the output. Procurement cannot outsource fiduciary judgment by putting the model in the cloud.
When Can a Twin Be Evidence?
A model can contribute evidence without being a witness. In a clinical review, a simulation may show why a proposed intervention is plausible. In an industrial investigation, a validated twin may help test whether a pressure spike could have produced a failure. In litigation, a party may offer a model output or expert analysis if the applicable rules permit it. The proponent must establish what the model does, how it was built, which data were used, whether it was validated for the question, and how the output was preserved.
Evidence requires a chain of custody and a way to distinguish observation from reconstruction. A sensor record is not the same as a model's interpolation of a missing interval. A simulation of a collision is not a video of the collision. A clinical risk estimate is not proof that a patient did or did not follow instructions. An expert may explain a model, but the expert must not conceal choices about parameters, excluded data, or alternative plausible outputs.
The legal result varies by jurisdiction and proceeding. In the United States, Federal Rule of Evidence 702 and the reliability principles associated with Daubert are examples of questions a court may face, not a universal checklist for every country or model. Courts also distinguish scientific evidence, business records, expert testimony, and demonstrative exhibits. A label such as “digital twin” cannot bypass foundation, relevance, prejudice, privilege, or the opportunity to challenge the result.
Liability Follows the Decision Chain
A model may fail because its data were wrong, its design was defective, its deployment exceeded validation, its operator ignored a warning, or its owner failed to maintain it. Those possibilities point to different responsibilities. Contracts should allocate access, testing, security, updates, incident reporting, audit rights, and records. They should not promise that a model is infallible or make a customer responsible for defects it cannot inspect.
Institutions should preserve the decision chain: input snapshot, model version, output, confidence, human interpretation, action, and later outcome. This supports quality improvement and fair attribution. It also prevents a retrospective story in which the model is blamed for a policy that the institution chose, or a worker is blamed for following instructions that concealed a known limitation. Liability doctrines vary, but traceability makes both correction and adjudication more honest.
The Strongest Objection: More Oversight Slows Safety
The strongest objection is practical. A twin can prevent a dangerous machine failure, reveal a medication interaction, or help an emergency team act before every fact is known. Requiring extensive validation, human review, and logging may slow the response and leave people exposed to hazards that the model could have reduced. Human experts are also fallible, biased, and sometimes less accurate than a well-tested system.
The objection is correct that oversight must be proportionate. An emergency alert need not wait for a committee meeting, and a low-stakes maintenance recommendation need not receive the same review as an irreversible clinical intervention. But speed does not eliminate the need to define an alert threshold, escalation path, fallback procedure, and post-event review. The safer response is tiered authority: permit rapid action within a preapproved scope, require confirmation for high-impact choices, and investigate both missed warnings and unnecessary interventions.
Accuracy also does not answer the question of who bears the cost. A model can outperform an individual on a benchmark and still be inappropriate for a decision because its target is a poor proxy, its errors are concentrated in one group, or affected people cannot contest it. Human review should not be a ceremonial signature. It should include enough time, information, expertise, and authority to reject the output.
Practical Architecture for Bounded Twins
Write a model card and an operating charter
The charter should identify purpose, users, affected parties, inputs, output meaning, validation population, update cadence, prohibited uses, confidence limits, and escalation rules. A model card should document subgroup performance, missingness, drift, and known failure modes. These documents should be revised when the model or its environment changes, not filed once at launch.
Make updates visible
Automated refreshes should not silently change a consequential recommendation. Record data windows, model versions, retraining triggers, and rollback options. Let users see whether an output is based on a current sensor, an old clinical measurement, a legal rule that has changed, or a forecast far outside the validation horizon.
Separate simulation, recommendation, and action
A scenario explorer can show what might happen; a recommendation ranks options; an actuator or official decision changes the world. These stages require different permissions. The institution should not connect an experimental simulation directly to a drug order, machine shutdown, benefit denial, or filing without a documented control and an accountable human owner.
Give affected people a meaningful answer
Patients, workers, clients, and residents should be told when a twin materially influenced a decision, what role it played, and how to correct relevant inputs. A correction process should distinguish an incorrect fact, an unsuitable model, a policy disagreement, and a legitimate exercise of professional judgment. Appeals are useful only when the reviewer can change the outcome.
Catholic Judgment About Instrumental Power
The Catholic contribution here is not a claim that tools are suspect. It is a discipline of responsibility. Gaudium et Spes 26 describes the common good in terms of conditions that help persons and communities flourish, while Dignitas Infinita (2024) warns against technological power becoming detached from human dignity. A bounded twin can serve the common good when it helps people exercise competent care. It undermines that good when its convenient output becomes a reason no person must answer for the outcome.
This essay does not ask whether a model is secretly a person. It assumes the twin is an instrument and asks institutions to use it truthfully: for a stated purpose, with tested limits, visible updates, proportionate delegation, professional duties, and a traceable decision chain. That modest framing is stronger than a theatrical claim that the institution has acquired a second self.
When the Instrument Assumption Must Be Revisited
This essay treats a digital twin as an instrument within the systems under discussion; that is a scope condition, not a final answer about every possible artificial subject. If a system displayed a persistent self-model, reported interests or suffering, pursued goals independently, and remained coherent across contexts, institutions should pause ordinary delegation and commission independent assessment. Those signals would not prove personhood, but they would make a categorical tool assumption less responsible. Until such evidence is available, the safer rule is neither to market a twin as a second self nor to treat uncertainty as permission to evade human duties.
Human ownership must also be operational. Reviewers need time, authority to change an outcome, access to relevant model and data documentation, and a workload that permits genuine scrutiny. Adversarial validation should test plausible distribution shifts and vendor failure, while affected people should be able to bring a counter-expert where the stakes justify it. ISO 23247 describes a digital-twin framework; NIST AI RMF describes risk-management practices; evidence rules such as Rule 702 answer a different, jurisdiction-specific question. None guarantees a fair hearing, and comparative evidence about real reviewer performance remains limited.
Sources and Qualifications
The engineering account is consistent with ISO 23247-1 and ISO 23247-2:2021, the digital-twin framework for manufacturing, while recognizing that “digital twin” is used less consistently in clinical and legal products. Risk-management recommendations draw on the NIST AI Risk Management Framework 1.0 (2023). These sources support attention to purpose, data, lifecycle, validation, and monitoring; they do not certify any particular product or establish liability.
Legal examples refer to the U.S. Federal Rule of Evidence 702, Daubert-style reliability analysis, and ABA Model Rules 1.1, 1.4, 1.6, and 5.3 only as illustrations. Rules of evidence, professional duties, product liability, fiduciary law, privacy, and medical-device regulation differ across jurisdictions and facts. Catholic reflection draws on Gaudium et Spes 26, Dignitas Infinita, and the Catechism 1700 and 1776–1782. This essay is not legal, clinical, or engineering advice.
Synthesis: A Twin Is Accountable Infrastructure
A digital twin becomes trustworthy not when it sounds like a person, but when an institution can state what it represents, what it was tested to do, when it was updated, and who remains responsible for acting on it. A simulation can clarify a choice without becoming the choice. A forecast can be evidence without becoming a witness. A delegated task can be automated without delegating away professional judgment.
The proper boundary is therefore practical: define the purpose, test the model in its actual setting, disclose its age and uncertainty, limit authority, preserve the decision chain, and give affected people a route to correction. Institutions may use powerful twins while refusing the fiction that a model inherits the authority, duties, or liability of the people who deploy it. A tool can be sophisticated without being sovereign.
Source Notes
The official ISO standards cover the framework’s overview and general principles (Part 1) and reference architecture (Part 2), supporting the distinction between a representation and the physical entity represented.
NIST’s U.S. risk-management framework for governing, mapping, measuring, and managing AI risks, including validation, monitoring, and accountable human oversight.
U.S.-specific professional-conduct, expert-evidence, and reliability standards illustrating competence, communication, confidentiality, supervision, and delegated responsibility; they are not universal rules of evidence or professional liability.
The Holy See’s declaration on the inalienable dignity of every human person, which cannot be reduced to a model, output, role, or measured capability.
The Council’s account of the common good and the social conditions required for persons and communities to flourish.
The Church’s teaching on human dignity, conscience, responsibility, and the limits of treating a model’s output as a person’s own judgment.
Editorial revision note
This essay completed one self-editing, cross-essay consistency, and strongest-criticism pass. Its controlling thesis was preserved while objections, qualifications, evidence limits, and practical consequences were strengthened.