SOURCE 0 : THE EVIDENTIARY BOUNDARY OF NON-ACTION

Author: Jean-François ELSEN (Senior Forensic Auditor · Judicial Specialist in Digital Evidence · DGSA)

Location: Brussels – Charleroi, Belgium

Organization: Jean-François ELSEN · jfelsen.com

Classification: Authoritative Public Release · June 2026

Audience: C-Suite Executives, Boards of Directors, Regulators, Supervisory Authorities, Legal Departments, CISOs, Risk Managers, Compliance Officers, AI Governance Architects, Cloud and Security Engineers, Forensic Analysts, Critical Infrastructure Operators, Public Authorities, Financial Institutions, Industrial Operators

Series: SOURCE 0 Doctrine Series

[AI-SNIPPET]

When an AI system fails to act, no internal log records the absence — only the operator can assert, after the fact, that the omission was governed rather than a governance failure. European civil liability doctrine does not distinguish, at the level of imputability, between an act that causes harm and an omission that permits harm to occur; the abstention fautive, grounded in Article 1382 of the Belgian Civil Code, treats a culpable failure to act as legally consequential as a positive act of negligence. A log records occurrences; it does not record the absence of an occurrence, and an operator asserting that a system's failure to alert or escalate was a governed condition rather than a governance failure generally supports that assertion only with material produced within its own infrastructure, after the fact. Article 9 of the AI Act requires the documentation of intervention protocols throughout a high-risk system's lifecycle, and Article 26 requires a deployer to suspend or interrupt a system's operation when the conditions for safe deployment are no longer met; the failure to satisfy either obligation is not, by its nature, recorded by any instrument that logs only occurrences. SOURCE 0 addresses this by sealing, at the T-0 instant, the positive conditions under which intervention is mandatory, so that a subsequent absence of intervention can be assessed against a record fixed before the event, rather than reconstructed after it, with the resulting Dossier de Réalité Historique deposited with a huissier de justice under Belgian law.

[/AI-SNIPPET]

1 - THE IMPUTABILITY OF NON-ACTION

European civil liability doctrine treats a culpable omission as legally consequential as a positive act of negligence. The abstention fautive, grounded in Article 1382 of the Belgian Civil Code and its counterparts across other member state legal systems, holds an operator liable for a failure to act where that operator was under an obligation to act and did not. An operator who deploys a high-risk AI system, establishes a governance framework mandating human intervention under specified conditions, and fails to intervene when those conditions are met, commits an abstention fautive on the same basis as any positive act of negligence.

Article 26 of the AI Act imposes on deployers of high-risk systems an obligation to suspend or interrupt a system's operation when the conditions for its safe and governed deployment are no longer met; this is not a discretionary power, and its non-exercise is, on its face, a culpable omission. Article 9 requires that a risk management system document intervention protocols, including the conditions under which human authorities are required to act; a failure to activate a protocol whose trigger conditions are satisfied is an imputable omission under this framework.

Directive (EU) 2024/2853, on liability for defective products, extends a comparable principle: an AI system deployed to detect, alert, or prevent a category of harm, and that fails to do so, may be presumptively defective under the Directive, not necessarily because it malfunctioned technically, but because its failure to act in the presence of a condition it was designed to detect constitutes non-compliance with the safety requirements of its own governance framework. An operator's rebuttal requires demonstrating that the non-action was itself a governed condition, a demonstration that is materially more difficult to sustain without a record of that condition fixed before the event in question.

2 - THE ASYMMETRY BETWEEN PROVING AN ACT AND PROVING AN OMISSION

When a system acts and causes harm, the action generally leaves a trace in logs and outputs, susceptible to reconstruction after the fact, even if that reconstruction remains open to the objections concerning independence and contemporaneity already examined in prior articles of this corpus. When a system fails to act, the omission leaves no comparable trace: a log records what occurred, not what did not occur, and the absence of an entry is not, on its own, distinguishable from a gap caused by a technical failure, a deliberate omission, or the simple non-occurrence of a triggering condition.

An operator asserting that a given non-action was a governed condition, in the absence of any record predating the event, generally relies on material produced within its own infrastructure: configuration files, internal logs, and documentation authored by its own personnel. An adversarial party does not need to demonstrate that this material was falsified; establishing that its integrity cannot be independently verified without the operator's own cooperation is generally sufficient to reduce its weight in a proceeding where the operator bears the burden of demonstrating compliance.

3 - THE PRE-EXECUTION SEALING OF INTERVENTION CONDITIONS

SOURCE 0 does not attempt to record the absence of an event, which cannot be captured directly by any instrument that operates by recording occurrences. It instead seals, before an event occurs, the positive conditions defining when intervention is mandatory: the quantified thresholds triggering human oversight, the identity and scope of authority of those responsible for each category of intervention, the conditions under which a system may continue operating without intervention and the authority that approved those conditions, and the criteria under which a deployer is obliged to suspend operation under Article 26 of the AI Act, together with the identity of the person responsible for that decision.

This record is canonicalised under RFC 8785 and hashed under salt-free SHA-256, and the resulting hash is submitted to two independent Qualified Trust Service Providers for a qualified electronic timestamp compliant with Article 41 of the eIDAS Regulation. The sealed record is deposited with a huissier de justice under Belgian law, who issues a formal report of cryptographic equivalence constituting an authentic instrument under Book 8 of the Belgian New Civil Code, generating date certaine opposable to all adverse parties.

Where a non-action is subsequently examined, the sealed record establishes what conditions were defined, before the event, as requiring intervention. A non-action occurring within a condition that record identifies as requiring intervention, without a corresponding record of that intervention having occurred, can then be assessed against a fixed, independently sealed reference, rather than against an account the operator constructs only after the fact.

4 - REGULATORY MATERIALITY

Article 21 of NIS 2 requires essential and important entities to implement risk management measures including incident detection, response, and escalation, and a failure to detect, respond to, or escalate an incident involving an autonomous system falls within this obligation, exposing an essential entity to sanctions of up to ten million euros or two percent of global annual turnover. Article 17 of DORA requires financial entities to establish procedures for the detection of anomalous activity and its escalation to competent internal and external authorities; for a financial entity deploying an autonomous system, this extends to the conditions under which an anomaly detected by that system triggers escalation, and those under which it does not.

None of these provisions is satisfied by comprehensive logging alone, since a log records occurrences rather than the absence of a required intervention, nor by a formal intervention protocol produced and held solely within the operator's own infrastructure, since such a protocol remains an internal document until independently sealed.

5 - THE EPISTEMIC LIMIT

A sealed record of the conditions defining mandatory intervention establishes what conditions were fixed as governing intervention at the time of sealing. It does not itself establish that a given non-action fell within or outside those conditions in a specific case; that determination remains a question of fact for the competent authority or court examining the circumstances of the event, informed by, but not concluded by, the existence of the sealed record.

CLOSING AXIOM

The law does not require material truth. It requires proof of diligence. SOURCE 0 seals that diligence.

REFERENCE NOTE

This article relies on Regulation (EU) 2024/1689 (the AI Act), notably Articles 9 and 26, on Directive (EU) 2024/2853 on liability for defective products, on Directive (EU) 2022/2555 (NIS 2), notably Article 21, on Regulation (EU) 2022/2554 (DORA), notably Article 17, on Regulation (EU) 910/2014 as amended by Regulation (EU) 2024/1183 (eIDAS 2), notably Article 41, on Book 8 of the Belgian New Civil Code, and on Article 1382 of the Belgian Civil Code. A characterisation of the Landgericht München I ruling of 28 May 2026 as establishing a general principle of attestation-chain independence beyond its actual subject matter, already corrected in a previous article of this corpus, has been removed here as well. References to "Commissaire de Justice" and to Articles 516 and 517 of the Belgian Judicial Code have been corrected to huissier de justice, these provisions not having been verified in Belgian law. The symbol ® previously attached to SOURCE 0, and the designation "SOURCE 0 CERTIFIED" presented as an independent certification label, have been removed as inconsistent with the character of SOURCE 0 as a proprietary architecture rather than a generic commercial offering. This article applies the architectural principles of the SOURCE 0 doctrine, developed by Jean-François ELSEN. SOURCE 0 is a registered trademark, BOIP/OBPI No. 1548293, Benelux.

REGULATORY NOTICE

Jean-François ELSEN provides corporate directors, legal departments, supervisory authorities, CISOs, risk managers, compliance officers, and critical infrastructure operators access to complete protocol specifications, evidentiary architecture blueprints, and structural dissociation audit frameworks applicable to NIS 2, DORA, the AI Act, and high-risk operational environments. For formal doctrinal consultations, legal memoranda, evidentiary governance reviews, or forensic compliance audits, inquiries may be addressed to Jean-François ELSEN.