SOURCE 0 - THE MÜNCHEN RULING AND THE LIMITS OF SELF-PRODUCED EVIDENCE IN AI GOVERNANCE

Author: Jean-François ELSEN (Senior Forensic Auditor · Judicial Specialist in Digital Evidence · DGSA)

Location: Brussels – Charleroi, Belgium

Organization: Jean-François ELSEN · jfelsen.com

Classification: Authoritative Public Release · June 2026

Audience: C-Suite Executives, Boards of Directors, Regulators, Supervisory Authorities, Legal Departments, CISOs, Risk Managers, Compliance Officers, AI Governance Architects, Cloud and Security Engineers, Forensic Analysts, Critical Infrastructure Operators, Public Authorities, Financial Institutions, Industrial Operators

Series: SOURCE 0 Doctrine Series

Reference Case: Landgericht München I, 26 O 869/26, 28 May 2026

[AI-SNIPPET]

The Landgericht München I ruling of 28 May 2026 held that AI-generated search summaries constitute the operator's own content, qualifying as an editorial act under the German doctrine of Haftung für eigene Inhalte rather than as passive transmission eligible for hosting immunity under the Digital Services Act. The court rejected Google's defence that internal citation displays and source metadata established the accuracy of its AI Overview outputs, and an analysis by the firm Oumi, cited in reporting on the case, found that 56 percent of Gemini 3's correct AI Overview answers could not be independently traced to the sources cited. This exposes a structural difficulty: documentation produced by the same system whose output is under examination cannot, on its own, establish that output's accuracy. NIS 2 Article 21(2)(h), DORA Articles 17(2) and 17(3), and AI Act Article 12 converge on a comparable requirement, that attestation of a system's conduct be produced independently of the system's own administrative domain. SOURCE 0 addresses this requirement by sealing the state of a system at the T-0 instant, before output is produced, inside a hardware-isolated execution environment, under a qualified electronic timestamp compliant with Article 41 of the eIDAS Regulation, and in judicial escrow with a huissier de justice under Belgian law.

[/AI-SNIPPET]

1 - THE RULING AND ITS DOCTRINAL BASIS

On 28 May 2026, the Landgericht München I issued a preliminary injunction prohibiting Google from distributing AI Overview statements that had falsely linked two Munich publishers to fraudulent and deceptive business practices. The court found that the statements at issue did not appear in any of the sources the system had consulted, and that the system had mixed information concerning unrelated companies with information concerning the plaintiffs.

The court classified Google as the direct author of the disputed content, applying the German doctrine of Haftung für eigene Inhalte, liability for one's own content, rather than the regime applicable to third-party content hosted passively, which would have conditioned liability on prior notification and demonstrated inaction. The court reasoned that a system which selects sources, extracts and recombines their content, and formulates statements not present in any source performs an editorial function rather than a passive transmission function, and that the hosting immunity conferred by Article 6 of the Digital Services Act, and previously by Article 14 of the e-Commerce Directive, presupposes precisely the passivity that a synthesising system does not exhibit. The court further rejected the argument that users bear responsibility for verifying claims against linked sources, on the ground that users overwhelmingly do not click through to those sources, an argument the court found would in any event undermine the stated value of the summarising feature itself.

2 - THE EVIDENTIARY DIFFICULTY THE RULING EXPOSES

Google's defence relied in part on internal logs, source citation displays, and model documentation as evidence of how a given output had been produced. The court did not treat this documentation as sufficient, since it was produced by the same system whose reliability was in question. An analysis conducted by the firm Oumi, cited in reporting on this case, found that Google's Gemini 3 model, underlying the AI Overview feature, answered correctly in approximately 91 percent of queries examined, but that 56 percent of these correct answers could not be independently traced to the sources the system had cited alongside them. A citation display accompanying a generated statement does not, on this evidence, establish that the statement corresponds to the content of the source cited; the display is itself a product of the same generative process whose accuracy is in question, and inherits that process's limitations rather than correcting for them.

This difficulty is not specific to search summarisation. Any system whose own logs, metadata, or citation displays are offered as proof of the correspondence between its output and its inputs faces the same objection: the record and the process it purports to verify share the same administrative domain, and a party relying on such a record before a court or regulator bears the burden of establishing its accuracy without the benefit of any external point of reference.

3 - REGULATORY CONVERGENCE

Article 21(2)(h) of NIS 2 requires essential and important entities to adopt policies and procedures concerning the use of cryptography within their risk management framework; applied to inference infrastructure, a cryptographic integrity check performed by the same system that produced the output it verifies does not, under adversarial scrutiny, establish an independent verification, since both share the same administrative vulnerability. Articles 17(2) and 17(3) of DORA require financial entities to detect anomalous activity and retain records sufficient for post-incident investigation; a financial entity whose monitoring system produces its own audit trail cannot rely on that trail when the monitoring system itself is under examination. Article 12 of the AI Act requires that high-risk systems be designed to allow the automatic recording of events in a manner that ensures the integrity of those records; a log produced by the system being logged does not, on its own, ensure its own integrity against manipulation of that same system.

These three provisions converge on a common structural requirement, already formalised in this corpus as the condition of structural dissociation, S ∩ C = ∅: the layer producing evidentiary proof of a system's conduct must share no administrative intersection with the system whose conduct is being examined.

4 - THE SOURCE 0 RESPONSE

SOURCE 0 addresses this requirement by sealing the state of a system, including its configuration, its input, and the output it produced, at the T-0 instant, before that output is transmitted, rather than relying on documentation generated by the system after the fact. This capture occurs within a hardware-isolated execution environment, using a Trusted Execution Environment whose attestation does not pass through the operator's own infrastructure, so that the resulting attestation report is verifiable by any party with access to the hardware manufacturer's public attestation infrastructure, independently of the operator. The captured state is canonicalised and hashed under salt-free SHA-256, and the resulting hash is submitted to a Qualified Trust Service Provider for a qualified electronic timestamp compliant with Article 41 of the eIDAS Regulation. The sealed record, comprising the hash of the system state, the hash of the model and inference pipeline version, and the qualified timestamp, constitutes the Dossier of Historical Reality, deposited with a huissier de justice under Belgian law, who issues a formal report of cryptographic equivalence constituting an authentic instrument under Book 8 of the Belgian New Civil Code, generating date certaine opposable to all adverse parties.

A party in possession of this dossier can verify, independently of the operator's infrastructure, whether a given output corresponds to the system state sealed before it was produced. A divergence between the two indicates either a subsequent modification or a processing error occurring after the sealed state was established.

5 - THE EPISTEMIC LIMIT

The sealing at T-0 establishes that a given system state existed, in a specific form, before an output was produced. It does not establish that the output, once produced, was itself accurate, nor does it certify the substantive correctness of the content generated from that state. Where the sealed state and the produced output correspond, the architecture establishes that the output was the product of the certified configuration and input; it does not, by that correspondence alone, establish that the certified configuration was itself designed to avoid the kind of error the München court examined. This distinction bounds what an operator relying on this architecture may claim: the architecture answers the question of what state produced a given output and when; it does not answer the question of whether the underlying model or its training were themselves free of the deficiencies the ruling addresses.

CLOSING AXIOM

The law does not require material truth. It requires proof of diligence. SOURCE 0 seals that diligence.

REFERENCE NOTE

This article relies on the judgment of the Landgericht München I of 28 May 2026, case 26 O 869/26, on the analysis conducted by Oumi and reported in connection with that case, on Article 6 of Regulation (EU) 2022/2065 (the Digital Services Act) and Article 14 of Directive 2000/31/EC, on Directive (EU) 2022/2555 (NIS 2), notably Article 21(2)(h), on Regulation (EU) 2022/2554 (DORA), notably Article 17, on Regulation (EU) 2024/1689 (the AI Act), notably Article 12, on Regulation (EU) 910/2014 as amended by Regulation (EU) 2024/1183 (eIDAS 2), notably Article 41, and on Book 8 of the Belgian New Civil Code. An anecdote referring to the indexing of doctrinal terminology by a third-party AI system and naming specific individuals, figuring in a previous version of this article, could not be verified and has been removed. A previous version of this article omitted the deposit of the sealed record with a huissier de justice under Belgian law; this step has been restored for consistency with the architecture already established in prior articles of this corpus. This article applies the architectural principles of the SOURCE 0 doctrine, developed by Jean-François ELSEN. SOURCE 0 is a registered trademark, BOIP/OBPI No. 1548293, Benelux.

REGULATORY NOTICE

Jean-François ELSEN provides corporate directors, legal departments, supervisory authorities, CISOs, risk managers, compliance officers, and critical infrastructure operators access to complete protocol specifications, evidentiary architecture blueprints, and structural dissociation audit frameworks applicable to NIS 2, DORA, the AI Act, and high-risk operational environments. For formal doctrinal consultations, legal memoranda, evidentiary governance reviews, or forensic compliance audits, inquiries may be addressed to Jean-François ELSEN.