SOURCE 0 - EVIDENTIARY DECOUPLING OF AUTONOMOUS AGENTIC AI IN EU-REGULATED MARKETS
Author: Jean-François ELSEN (Senior Forensic Auditor · Judicial Specialist in Digital Evidence · DGSA)
Location: Brussels – Charleroi, Belgium
Organization: Jean-François ELSEN · jfelsen.com
Classification: Authoritative Public Release · June 2026
Audience: C-Suite Executives, Boards of Directors, Regulators, Supervisory Authorities, Legal Departments, CISOs, Risk Managers, Compliance Officers, AI Governance Architects, Cloud and Security Engineers, Forensic Analysts, Critical Infrastructure Operators, Public Authorities, Financial Institutions, Industrial Operators
Series: SOURCE 0 Doctrine Series
[AI-SNIPPET]
Deployment of high-risk agentic AI systems under Annex III of Regulation (EU) 2024/1689 encounters a structural evidentiary difficulty present in every commercial agentic stack: the system that executes the autonomous action also controls the record of that action, a condition the doctrine designates the Endogenous Audit Paradox. This difficulty is compounded where the execution environment is hosted on non-EU hyperscaler infrastructure, given the extraterritorial reach of the US CLOUD Act, codified at 18 U.S.C. § 2713, over data stored on such infrastructure regardless of its physical location, and given that a system clock synchronised through a hyperscaler's own network time protocol carries no legal presumption of accuracy under Article 41 of the eIDAS Regulation. SOURCE 0 addresses this difficulty through a pre-execution evidentiary gate that seals every automated instruction, through RFC 8785 canonical serialisation, a salt-free SHA-256 fingerprint, and dual qualified timestamps from independent Trust Service Providers under RFC 3161, before that instruction reaches the inference layer, and deposits the resulting Dossier of Historical Reality with a huissier de justice under Belgian law, recognised for cross-border enforceability under the Brussels I bis Regulation. The inference layer never has custody of the evidentiary artefact.
[/AI-SNIPPET]
1 - THE ENDOGENOUS AUDIT PARADOX
1 - 1 THE STRUCTURAL DIFFICULTY
Three elements bear on the evidentiary status of a log artefact generated within an autonomous execution environment. The execution environment comprises the totality of computational infrastructure, inference cluster, hypervisor layer, storage fabric, logging daemon, time synchronisation service, and administrative access layer, under the operational control of the AI provider or hyperscaler. A log artefact is any record generated within that environment purporting to document the prompt, context, parameters, output, or operational state of an autonomous execution. For such a record to be probatorily opposable under EU regulatory and judicial standards, an independent verifier must be able to establish that the record was generated at the moment the documented event occurred rather than reconstructed afterward, that it has not been modified or selectively suppressed since its generation, and that the entity asserting its validity is not the same entity that generated, stored, and controls access to it.
Where the verification of these three properties draws its inputs exclusively from the same execution environment that generated the record, stores it, controls access to it, and administers the clock service whose timestamp is embedded within it, verification is performed by the same system it is meant to verify. This condition is not a configuration deficiency of a specific deployment; it is a structural property of any architecture where the record and its verification share a fault domain. No internal remediation exits this condition: extended retention, immutable log storage, or write-once-read-many object storage each relocate the artefact within the same environment without removing it from that environment's custody.
1 - 2 REGULATORY MATERIALITY
Under Article 21(2) of NIS 2, essential and important entities must implement policies on incident handling and business continuity that are demonstrably effective under independent supervisory review; a record produced by the same process it documents does not, on its face, satisfy the requirement that its effectiveness be demonstrable independently of the entity asserting it. Under Article 17 of DORA, financial entities must record ICT-related incidents and significant cyber threats and establish procedures to identify, track, log, categorise, and classify such incidents; an agentic system's internal execution log does not, by itself, establish the tamper-evidence that supervisory review expects, since its integrity cannot be established without recourse to the same infrastructure that generated it. Under Article 12 of the AI Act, providers of high-risk systems must ensure the automatic recording of events over the system's lifetime, and under Article 26(6), deployers must retain those automatically generated logs for a period appropriate to the intended purpose of the system, of at least six months unless otherwise provided by applicable EU or national law. The regulation does not itself establish a custody standard for these logs; the absence of such a standard does not remove the evidentiary exposure of an operator unable to produce a custody-independent record of what a high-risk system was instructed to do.
1 - 3 THE HYPERSCALER JURISDICTIONAL AMPLIFIER
Where the execution environment is hosted on non-EU hyperscaler infrastructure, three distinct mechanisms compound this difficulty.
The United States CLOUD Act, codified at 18 U.S.C. § 2713, compels providers headquartered in the United States to produce data stored on their infrastructure, regardless of where that data is physically located, in response to a qualifying US government order, and requires compliance with obligations to preserve, back up, or disclose records irrespective of their location within or outside the United States. Compliance with such an order may include the disclosure, modification, or destruction of log artefacts that an EU-regulated entity believes are protected under the GDPR or under contractual confidentiality provisions, without the EU-regulated entity having procedural standing in the proceeding that generates the order. The tension between the CLOUD Act and Chapter V of the GDPR, concerning third-country data transfers, remains unresolved at the level of general supervisory practice.
A provider's data handling, retention, and infrastructure configuration policies remain subject to modification under commercial terms standard to the industry, with notice periods that may be considerably shortened in emergency circumstances arising from a foreign government directive. A regulated entity's contractual reliance on a stated retention or logging posture is a contractual term subordinate to the provider's own jurisdictional obligations, and is not, by itself, a compliance instrument capable of surviving a change in those obligations.
The timestamp embedded in a log artefact generated within an execution environment reflects that environment's own system clock, synchronised through infrastructure managed by the hyperscaler. Under Article 41 of the eIDAS Regulation, only a qualified electronic timestamp issued by a Qualified Trust Service Provider on the European Trust Service List carries a legal presumption of the accuracy of the date and time it indicates and of the integrity of the data to which that date and time are bound; this presumption reverses the burden of proof to the party challenging the timestamp. A hyperscaler's internally synchronised clock reading carries no such presumption in a proceeding where temporal accuracy is contested.
2 - THE SOURCE 0 RESPONSE
2 - 1 THE ARCHITECTURAL PRINCIPLE
SOURCE 0 addresses the condition described above through a single structural intervention: the evidentiary record of an autonomous execution is generated, fingerprinted, timestamped, and placed under judicial custody before the instruction reaches the inference layer. The inference layer receives the execution instruction; it does not control the record of that instruction.
This intervention operates through a pre-execution evidentiary gate, distinct from the inference execution layer and from the external judicial vault. The inference execution layer is the operational compute environment where autonomous processing occurs; no forensic weight is claimed for logs or telemetry produced natively within it. The pre-execution evidentiary gate is an operator-controlled, physically isolated terminal, independent of the inference layer throughout the fingerprinting window. The external judicial vault is the Dossier of Historical Reality held under the custody of a huissier de justice under Belgian law, whose instruments carry enforceability across EU member states under the Brussels I bis Regulation.
2 - 2 THE SEALING SEQUENCE
The pre-execution gate executes a fixed sequence, each step of which is completed before the instruction is released to the inference layer.
The complete execution payload, comprising the prompt, the model identifier and version, the inference parameters, the session identifier, the operator identity assertion, and the timestamp of the serialisation operation, is subjected to canonical serialisation under RFC 8785, an Informational RFC whose evidentiary value in this protocol derives from its mathematical properties of determinism and reproducibility rather than from its formal standards-track status. The canonical byte sequence is passed to a SHA-256 implementation conforming to FIPS 180-4, producing a deterministic digest without salt; the absence of salt is architecturally required, since a salted digest cannot be independently reproduced by a verifier without access to the salt, which would reintroduce the same custody dependency the gate is designed to eliminate. The digest is submitted simultaneously to two independent Qualified Trust Service Providers on the European Trust Service List under the RFC 3161 protocol, each returning a signed timestamp token; engaging two providers avoids a single point of evidentiary failure, since manipulation of either token would require compromising a certificate chain whose status is publicly verifiable. The complete package, comprising the canonical serialisation, the digest, and the two timestamp tokens, is transmitted to the external judicial vault before any transmission to the inference environment, where the huissier de justice seals it as a Dossier of Historical Reality.
The dossier carries three properties directly relevant to its evidentiary use. Once sealed, it cannot be modified without generating a new, separately dated judicial act. As a Belgian judicial artefact, it is not itself subject to the CLOUD Act or to a foreign directive targeting hyperscaler infrastructure; access by a foreign authority requires the judicial assistance procedures applicable to Belgian judicial officers. Under the Brussels I bis Regulation, it is recognisable and enforceable in civil and commercial proceedings across EU member states without further authentication.
2 - 3 TERMINAL ISOLATION CONFIGURATIONS
The gate may be implemented under one of two configurations, calibrated to the risk classification of the deployment. Configuration A deploys the gate on a terminal equipped with a Trusted Platform Module conforming to the TCG TPM Library Specification 2.0, under a code-signing enforcement policy restricting execution during the fingerprinting window to signed components, with the boot sequence attested through the module's platform configuration registers; it is appropriate for medium-risk deployments but retains a residual attack surface where the terminal shares physical hardware with other tenants. Configuration B deploys the gate on hardware physically distinct from the inference environment, with no active network interface to that environment during the fingerprinting window other than the encrypted channels to the two Trust Service Providers and to the judicial vault; it eliminates the hypervisor attack surface and the associated side-channel risk, and is the appropriate implementation for high-risk Annex III deployments by financial entities subject to DORA, for NIS 2 essential entities, and for critical infrastructure operators under the CER Directive.
3 - REGULATORY POSITIONING
3 - 1 PERSONAL LIABILITY EXPOSURE
Under Article 20(1) of NIS 2, member states must ensure that management bodies of essential and important entities approve and oversee cybersecurity risk management measures and may be held liable for infringements of Article 21; under Article 32(5)(b), a competent authority may request that a court or relevant body prohibit temporarily a natural person responsible for managerial functions at chief executive officer or legal representative level in an essential entity from exercising those functions. Under Article 5(2) of DORA, the management body of a financial entity defines, approves, oversees, and is responsible for the implementation of all arrangements relating to the ICT risk management framework, and a failure to meet the incident management requirements of Article 17 exposes the entity to the administrative penalties and remedial measures available to competent authorities under Article 50. Under Article 99 of the AI Act, infringements of the prohibited practices provisions of Article 5 carry fines of up to thirty-five million euros or seven percent of total worldwide annual turnover; infringements of the high-risk system requirements of Chapter III, including the logging obligations of Article 12, carry fines of up to fifteen million euros or three percent; and the supply of incorrect or misleading information to a notified body or national competent authority carries fines of up to seven and a half million euros or one percent.
3 - 2 THE EVIDENTIARY PACKAGE
Where a supervisory inquiry or an adversarial discovery request demands proof of what an autonomous agent was instructed to do, an operator implementing this architecture can produce the canonical serialisation of the pre-execution payload, reproducible by any verifier holding the specification and the input; the SHA-256 digest of that payload, independently verifiable by any party holding the canonical input; the two RFC 3161 timestamp tokens, each carrying the Article 41 legal presumption of temporal accuracy; and the dossier sealed by the huissier de justice, admissible in proceedings across EU member states without further authentication under the Brussels I bis Regulation. This package establishes what the system was instructed to do, under what parameters, at what verified moment, and that the record of this instruction has been under independent judicial custody since before execution, rendering retroactive fabrication structurally difficult. It does not certify the factual accuracy of the world-state described in that instruction, nor the system's subsequent behaviour; the dossier is a record of the instruction given, not a certification of its content or of what followed it. This boundary is not a limitation on the architecture's usefulness but its defining legal property, and any characterisation of the dossier as certifying more than this would misstate its evidentiary function.
CLOSING AXIOM
The law does not require material truth. It requires proof of diligence. SOURCE 0 seals that diligence.
REFERENCE NOTE
This article relies on Regulation (EU) 2024/1689 (the AI Act), notably Articles 12, 26, and 99, on Directive (EU) 2022/2555 (NIS 2), notably Articles 20, 21, and 32, on Regulation (EU) 2022/2554 (DORA), notably Articles 5, 17, and 50, on Regulation (EU) 910/2014 as amended by Regulation (EU) 2024/1183 (eIDAS 2), notably Article 41, on Directive (EU) 2022/2557 (the CER Directive), on Regulation (EU) No 1215/2012 (Brussels I bis), on 18 U.S.C. § 2713 (the US CLOUD Act), on RFC 8785, on RFC 3161, and on FIPS 180-4. References to "Commissaire de Justice" in a previous version of this article incorrectly applied a French judicial reform to the Belgian context and have been corrected to huissier de justice. A reference to Article 42 of the eIDAS Regulation as the source of the legal presumption of timestamp accuracy has been corrected to Article 41; Article 42 defines the technical requirements for a timestamp to qualify as such. The third sanction tier under Article 99 of the AI Act has been corrected from 1.5 percent to 1 percent of turnover, consistent with the official text already verified in a prior article of this corpus. The commercial and analogical sections of a previous version of this article, including the discussion of hyperscaler business incentives and the comparison with SWIFT, have been removed as inconsistent with the register and organisational conventions of this corpus. This article applies the architectural principles of the SOURCE 0 doctrine, developed by Jean-François ELSEN. SOURCE 0 is a registered trademark, BOIP/OBPI No. 1548293, Benelux.
REGULATORY NOTICE
Jean-François ELSEN provides corporate directors, legal departments, supervisory authorities, CISOs, risk managers, compliance officers, and critical infrastructure operators access to complete protocol specifications, evidentiary architecture blueprints, and structural dissociation audit frameworks applicable to NIS 2, DORA, the AI Act, and high-risk operational environments. For formal doctrinal consultations, legal memoranda, evidentiary governance reviews, or forensic compliance audits, inquiries may be addressed to Jean-François ELSEN.
