An NSPIRE inspection finds a smoke alarm missing in a unit. The clock starts. A maintenance tech or a vendor fixes it that afternoon and texts you a photo of the new alarm on the ceiling. You upload the photo to HUD’s system and certify the deficiency is corrected.
That photo is now part of a statement you made to the federal government. This piece is about what the rule asks for, why that texted photo is the weakest part of your evidence, and how to check the file before you sign. It is not legal advice.
What the rule says
The deadlines are in HUD’s regulation, 24 CFR 5.711. After an inspection, HUD or the inspecting party gives you notice of Life-Threatening and Severe deficiencies. The rule says:
“All Life-Threatening items must be corrected within 24 hours of receipt of notice of these items, unless HUD approves a variation.”
Severe items get the same 24 hours, unless the inspection standard for that deficiency says otherwise or HUD approves a variation. Then:
“The owner or PHA or owner’s representative must electronically certify and provide supporting evidence within 2 business days after the deadline to correct the Life-Threatening and Severe items that the items have been resolved or sufficiently corrected…”
Moderate deficiencies must be corrected within thirty days and Low ones within sixty, again unless the standard or a HUD notice says otherwise.
HUD’s own step-by-step guide for closing out these deficiencies in its NSPIRE system (an August 2024 toolkit, which has since gone from hud.gov; we read an archived copy) says what counts as evidence: “Proof of work, such as work orders, invoices, and photographs, can be used as evidence.” The upload form asks for the “date/time mitigated”. And the guide adds one sentence worth reading twice:
“Proper certification of the evidence and adherence to truthfulness is essential, as false statements may result in penalties.”
One scope note. Paragraph (a) of the same section says this scoring process does not apply to the Housing Choice Voucher, Project-Based Voucher or Moderate Rehabilitation programs, which are assessed under other rules. If your units are voucher units, check which rules your inspections run under; we cover the voucher side in voucher units and repair photos.
Why the photo is the weak link
A work order is your own record. An invoice comes from a vendor you have a contract with. The photo is the one piece of evidence that is supposed to show the repair itself, and it is usually the one you know least about. It can be wrong in three ways, and none of them needs anyone to be dishonest on purpose:
- It is not this unit. A tech with forty units on the list sends the photo from the unit next door, or last month’s photo of the same model of alarm. Occasionally it is worse: a picture copied from someone else’s website.
- It is not from that day. The form asks when the item was mitigated. If the photo was taken before the fix, or the day after the 24 hours ran out, the date you type and the date in the photo disagree.
- It was made or changed by a tool. AI image tools can now paint a clean wall over a stain or put a new fixture where an old one was. We have written about what the file records when a photo is AI-edited, and about how often it does not.
Here is the problem. The photo the vendor texted you often cannot tell you any of this. WhatsApp’s ordinary photo button and Facebook Messenger strip the camera data as they send, and texts between an iPhone and an Android phone are compressed on the way. The copy that arrives may have no camera name and no capture time. (Apple’s own AI-edit label has been reported to survive iPhone-to-iPhone iMessage, which suggests the rest of the record does too, but we have not tested that.) A stripped photo may be perfectly honest. You just cannot check it, and you are about to certify on it. More on which routes keep the file in how to get the original photo.
What the original file can tell you
If the vendor sends the original file instead, as an email attachment or an upload rather than a text, a phone photo usually still carries a record written by the camera: which phone took it, the date and time it was taken, often the time zone, and the exposure settings. Our checker reads that record in your browser. For a phone original it says “Camera Original”, names the device and shows the capture time, so you can hold it against the 24-hour window and against the time you are about to type into the form.
If the file names an AI tool, or carries Content Credentials that say it was made or edited with AI, the checker says “AI Generated” or “AI Edited”, and names the tool when the file does. If the record is gone, it says “Can’t Verify”. That is not an accusation. Honest files lose their record every day, mostly by being texted. It means: ask for the original.
The same rule, used the other way
Photos also matter when you think the inspector got it wrong. Under paragraph (d), you can ask for a technical review within 45 calendar days of getting the report, and the rule says you “may submit photographic evidence”. The burden of proof is yours, and HUD starts from “a rebuttable presumption that the inspection was conducted accurately.”
The rule also says a review “will not be conducted based on conditions that were corrected subsequent to the inspection.” So a photo offered to show a deficiency was never there needs to show the condition as it was on inspection day, not after your team fixed it. A photo whose own record says it was taken a week after the inspection is a weak thing to stake a review on. The rule does not say whether HUD’s reviewers look at camera data, and we do not know whether they do. You want to know what the file says before anyone else reads it.
And residents can ask to see it
Paragraph (h) says that once a final score is issued, you must make the inspection report “and all related documents available to residents during regular business hours upon reasonable request for review and copying”, and it lists your certification among them. The person who lives in the unit can ask to see the photo you certified their repair with. They will know whether that is their ceiling.
A routine for the 24-hour window
- Put one sentence in the work order and the vendor agreement: photos of NSPIRE repairs are sent as the original file, attached to email or uploaded, not screenshotted and not sent by text or messaging app. Your own maintenance staff too.
- Take a wide shot as well as the close-up, with something that identifies the unit in frame, such as the unit number on the door. A close-up of a new outlet cover could be any outlet in the building.
- Before you certify, run the photos through the checker. Look at the capture time against the notice time and the deadline, and at whether the device is the one you expected. If it says “Can’t Verify”, ask for the original while the tech still has it on their phone.
- Save a report and keep it with the work order. The report is dated and lists each file’s SHA-256 fingerprint, so if the certification is questioned later, anyone can confirm the file you produce is byte-for-byte the one you checked. Keep the originals; see where you keep inspection photos for the settings that quietly replace them with copies.
The limits, stated plainly
- We quote the regulation as published on eCFR and HUD’s 2024 toolkit from an archived copy, both read in October 2026. We have not used HUD’s NSPIRE system ourselves and do not know how HUD reviews the evidence it receives. Check current HUD guidance before relying on this.
- “Camera Original” is not proof the repair was done, or that the photo shows this unit. It means a camera or phone recorded the file and the record is still intact. Camera clocks can be set wrong, and camera data can be edited by someone who means to.
- Our checker gives no confidence score and does not judge a picture by looking at it. A file with no record is not a fake, and a file with no AI marker is not proven real.
- It reads camera data from JPEG, PNG, WebP and HEIC files. HEIC has been read since 6 October 2026 and has been tested on an iPhone XR and on Canon and Sony cameras, not yet on a current iPhone. For video it reads the container’s own clock, not the pictures.
- This is not legal advice. If a certification is already in question, talk to a lawyer.
ImposterShield reads the evidence inside image and video files. It runs in your browser and uploads nothing. If a file has been stripped, it says so. That is the product working, not failing.
Check the repair photos before you certify
Drop the files on the page. It shows what each one says about where it came from and when it was taken, and a saved report lists each file’s SHA-256 so you can show later that the file is unchanged. The check runs in your browser, so no photo is uploaded.
Open the checker