Since December 2023, French courts have substantively reviewed companies' vigilance plans — not rubber-stamped them. But every review examines whatever document the company presents today. Nothing independently fixes what the plan said before the claim was filed.

Le document d'orientation actuel sur les vérifications de gestion au titre du règlement portant dispositions communes définit sa propre méthodologie en citant un guide de 2015, rédigé pour un règlement aujourd'hui expiré — sans jamais revérifier de façon indépendante que ces définitions restent exactes. SOURCE 0 examine ce qu'une citation franchissant une frontière réglementaire expirée établit, et ce qu'elle n'établit pas.

The current EU guidance on management verifications under the Common Provisions Regulation defines its own core methodology by citing a 2015 guide written for a regulation no longer in force — without independently re-verifying that the definitions still hold. SOURCE 0 examines what a citation across an expired regulatory boundary does and does not establish.

Regulation (EU, Euratom) 2020/2092 evaluates a Member State using courts, auditors, OLAF, GRECO — never the state's own word. One narrow provision breaks that pattern: the follow-up report on whether beneficiaries were actually paid. SOURCE 0 closes that one gap.

The same proposal that requires a qualified technical body to certify a satellite's environmental footprint asks nothing of the sort for its incident reports. Self-detection, self-logging, self-declaration. SOURCE 0 fixes the record before the operator writes it.

Article 6 of DORA requires financial entities to review and internally audit their ICT risk framework at least once a year. But the "independence" the Regulation demands is segregation within the entity, not independence from it — leaving the only record of diligence in the hands of the party whose diligence is in question.

3,383 major ICT incidents, one joint ESA report, and a methodology section that quietly admits the data is incomplete and not yet fully validated. This article examines what it means that the reference benchmark regulators now cite was built entirely from entities' own self-declared accounts of themselves.

DORA requires a bank to prove when it became aware of an incident and when it classified it as major — the two instants a regulator disputes most. Both are written exclusively by the bank itself. This article examines why TLPT, Article 6 internal audit, and third-party oversight do not supply an independent witness to either instant, and what a pre-execution, third-party-deposited fixation adds to the DORA timeline.

Reconstructing what an AI system did is a forensic capability. Proving what was authorised before it acted is an architectural one. The governance documentation market — law firms, consulting practices, compliance frameworks — sells the first. Enforcement proceedings under AI Act Article 99 will demand the second. This article establishes the structural distinction between evidence-based governance and proof-based governance, and why only one survives adversarial scrutiny.

The Reference Legitimacy Gap designates the structural interval between what a governance architecture documents and what it can actually verify. Without prior fixation, the evaluative reference becomes a variable adjustable after the fact by any party with sufficient interest and access. This article establishes the Mandate of Antecedence as the minimum architectural condition under which governance produces proof rather than narrative.

The Digital Omnibus on AI defers the enforcement of high-risk obligations but leaves evidentiary exposure unchanged. When a system acts before the deferred deadlines, the governance state operative at T-0 remains the central question in civil, insurance, and contractual proceedings. The postponement affects regulatory temporality, not the requirement to hold an independently fixed, opposable governance record. The proof gap persists throughout the deferral window, closed only by a pre-execution cryptographic attestation architecture such as SOURCE 0.

The new anti-corruption directive shifts liability from "who committed the infraction" to "why didn't your organisation prevent it." Demonstrating that a compliance programme functioned requires proof it was operational before the act — not documentation assembled after. With sanctions reaching 5% of global turnover or 40 million euros, this article establishes why that distinction is architectural, not procedural.

Governance only becomes enforceable when three conditions are simultaneously met: T‑0 fixation, structural independence (S ∩ C = ∅), and legal opposability. Without these properties, no post-execution record can establish a governance state that was never sealed. This article articulates the architectural conditions under which governance ceases to be a management assertion and becomes a verifiable system property.

States do not lose climate litigation because their policies were inadequate. They lose because they cannot prove, with forensic finality, what those policies were based upon at the moment they were adopted. SOURCE 0 seals that proof before litigation exists. The Irish multi-generational climate case as paradigmatic demonstration. SOURCE 0 Doctrine Series — Authoritative Public Release.

Landgericht München I, 28 May 2026. Google bore direct liability for AI-generated content. The defence it did not pursue — proof of E(T₀) singularity — did not exist.

The four categories of the SOURCE 0 Doctrine are not parallel classifications. They constitute a causal sequence — problem domain, methodological response, legal operationalization, normative constraint field — whose coherence depends on the formal articulation of three inter-layer interfaces. This article makes that architecture explicit, disambiguates its shared vocabulary across eleven distinct definitions, establishes the material modification threshold, closes the deliberate misclassification escape route, and maps each layer against its precise regulatory obligations. The four-layer architecture is not a model. It is a condition of proof.

This article defines the evidentiary boundary of autonomous AI intent and introduces the Intent Seal — the pre‑execution proof that turns Operational Intent into a judicial fact.

The law knows how to prove what happened. It does not know how to prove what did not happen. In autonomous AI governance, this asymmetry is not a procedural inconvenience — it is a structural liability gap. Logs record occurrences. They cannot record absences. An AI system that failed to alert, an operator who failed to intervene, a supervisor who failed to activate the override mechanism: none of these non-actions leave a trace in any audit trail. SOURCE 0 closes this gap through the Non-Action Governance Map — a pre-execution seal of the precise conditions under which intervention was mandatory, produced at T-0 by an independent authority. When those conditions are met and no intervention appears in the evidentiary record, the non-action becomes a legally opposable fact under the EU AI Act, the Product Liability Directive 2024, and NIS 2.

Autonomous AI decisions engage liability — but not through system performance. They become legally attributable only when a competent human authority has documented governance before execution. SOURCE 0 defines this evidentiary threshold as T‑0: the moment where human authorisation is cryptographically sealed by an independent authority. Without a T‑0 seal, an AI act has no author — and under the EU AI Act and the Product Liability Directive 2024, that is a liability without a ceiling.

The distinction between a trace and a proof is not technical. It is jurisdictional. Most organisations generate traces. Very few produce legally opposable proof. SOURCE 0 closes this gap at T‑0, transforming digital records into evidence that carries a legal presumption of integrity.