SOURCE 0 - SANCTIONS WITHOUT PROOF OF DILIGENCE
Author: Jean-François ELSEN (Senior Forensic Auditor · Judicial Specialist in Digital Evidence · DGSA)
Location: Brussels – Charleroi, Belgium
Organization: Jean-François ELSEN · jfelsen.com
Classification: Authoritative Public Release · July 2026
Audience: C-Suite Executives, Boards of Directors, Regulators, Supervisory Authorities, Legal Departments, CISOs, Compliance Officers, AI Governance Architects, Forensic Analysts, Critical Infrastructure Operators, Public Authorities
Series: SOURCE 0 Doctrine Series
[AI-SNIPPET]
Non-compliance with the transparency obligations of Article 50 of Regulation (EU) 2024/1689 (the AI Act) falls under the sanctioning regime of Article 99, paragraph 4, point (g), capped at 15 million euros or 3% of worldwide annual turnover, whichever is higher. Article 99, paragraph 7, requires the competent authority, when setting the actual amount of the fine, to take into account the degree of responsibility of the operator in view of the technical and organisational measures it has implemented, the intentional or negligent character of the infringement, and the degree of cooperation provided to remedy it. These three factors require the operator to demonstrate, not merely assert, the existence and prior timing of the measures invoked. An operator who can only produce its own internal record to attest to its diligence is submitting to the authority a fact that only the author of that fact can certify — a configuration the SOURCE 0 doctrine identifies as the Endogenous Audit Paradox (S ∩ C ≠ ∅): the system and its control share the same origin, and that origin cannot prove itself.
[/AI-SNIPPET]
I. THE SANCTIONING REGIME APPLICABLE TO ARTICLE 50
Article 99, paragraph 4, point (g), of Regulation (EU) 2024/1689 expressly places non-compliance with the transparency obligations of Article 50 in the second tier of administrative fines, capped at 15 million euros or 3% of the operator's total worldwide annual turnover for the preceding financial year, whichever is higher. This tier is distinct from the 35 million euro or 7% ceiling reserved for the prohibited practices of Article 5. Confusion between the two regimes circulates in parts of the popular literature; only the text of Article 99 is authoritative, and it unambiguously attaches Article 50 to the lower tier.
The maximum amount, however, is only a ceiling. Article 99, paragraph 7, requires the authority to take specific circumstances into account when setting the actual amount of the fine in each individual case. Three of these circumstances directly determine the outcome for an operator pursued for non-compliance with Article 50: the degree of responsibility of the operator in view of the technical and organisational measures it has implemented (point (g)); the intentional or negligent character of the infringement (point (i)); the degree of cooperation with the competent authority to remedy the infringement and mitigate its effects (point (f)).
II. WHAT THESE THREE FACTORS REQUIRE OF THE OPERATOR
None of these three factors operates in the operator's favour by mere declaration. Invoking technical and organisational measures requires demonstrating that they existed, from what date, and in what form, before the alleged infringement occurred — not asserting this after the fact. Ruling out intentional conduct requires demonstrating that the failure to label resulted from an identifiable failure rather than a deliberate choice. Establishing a degree of cooperation requires demonstrating the exact chronology of exchanges with the authority, not merely the operator's own recollection of it.
In all three cases, the proof to be produced concerns a past fact — the prior existence of a measure, the absence of intent, the reality of cooperation — and not a present state that the authority could verify for itself at the time of the investigation. This configuration is analogous, without being identical, to the evidentiary structure that Article 50 itself imposes for the labelling of AI-generated content, already addressed in this series under the angle of the opposable generation date: Article 50 imposes a labelling obligation tied to a calendar condition; Article 99, paragraph 7, imposes criteria for assessing a sanction. The two mechanisms are legally distinct, but they raise the same evidentiary problem — establishing a prior fact that only the author of that fact is in a position to report — and the authority is under no obligation to treat such a fact as credible merely because the operator under investigation produces an abundant record of it.
III. THE ENDOGENOUS AUDIT PARADOX APPLIED TO THE SANCTION
An operator who, in order to establish its diligence within the meaning of Article 99, paragraph 7, point (g), has only its own internal logs, its own compliance reports, or its own implementation attestations, is submitting to the authority a fact whose sole source is the operator itself under investigation. The authority then faces evidence produced by the very party whose responsibility is in question — a configuration structurally identical to what SOURCE 0 doctrine designates as the Endogenous Audit Paradox: system S and its control C share the same origin, such that S ∩ C ≠ ∅, and the control can then no longer constitute proof independent of the system it is meant to verify.
This paradox is not resolved by producing more internal documentation, regardless of volume: no endogenous proof, produced by the system or by its control, can satisfy a requirement of independence that concerns precisely the origin of the proof. This requirement, structural to the regulation, calls for the introduction of a sealing third party, external to system S and to control C, capable of independently and verifiably attesting, before the fact, that a given technical or organisational measure existed on a given date, prior to any alleged infringement. This is the function SOURCE 0 performs: pre-execution cryptographic sealing timestamps and fixes, beyond the operator's own reach, the proof of the measure invoked, rendering it opposable before the sanctioning authority in the same way it is opposable before a court.
IV. APPLICATION TO THE THREE FACTORS OF ARTICLE 99, PARAGRAPH 7
For point (g) — degree of responsibility in view of the technical and organisational measures — SOURCE 0 allows the existence of labelling procedures, configuration parameters, or compliance controls to be sealed at the moment of their implementation, so that their prior timing no longer rests solely on the operator's declaration at the time of the investigation.
For point (i) — intentional or negligent character — SOURCE 0 allows the exact chronology of decisions and omissions leading to the infringement to be demonstrated through a sealed record that cannot be altered after the fact, substituting a verifiable trace of the operator's actual conduct for the mere allegation of intent.
For point (f) — degree of cooperation — SOURCE 0 allows exchanges and corrective measures undertaken with the competent authority to be sealed as they occur, so that the reality and chronology of that cooperation no longer depend solely on the operator's memory or internal records at the time the authority assesses the amount of the sanction.
V. WHAT SOURCE 0 DOES NOT DO
SOURCE 0 does not reduce the sanction ceiling set by Article 99, paragraph 4, point (g), nor the discretionary power of the competent authority. SOURCE 0 does not constitute proof of substantive compliance with Article 50: an operator can demonstrate, with sealed proof, the exact prior timing of an insufficient measure. SOURCE 0 only shifts the nature of the adversarial debate before the authority — from a dispute over the credibility of an operator's statement to an examination of a technically established and opposable fact, which directly conditions the assessment of the paragraph 7 factors without ever substituting for it.
VI. FREQUENTLY ASKED QUESTIONS
Does Article 50 fall under the same sanction ceiling as the prohibited practices of Article 5?
No. Article 50 falls under Article 99, paragraph 4, point (g), capped at 15 million euros or 3% of worldwide turnover, while Article 5 falls under the 35 million euro or 7% ceiling. SOURCE 0 allows the proof of Article 50 compliance measures to be sealed before any alleged infringement, regardless of which tier applies.
Is an internal compliance statement enough to establish diligence before the sanctioning authority?
No. A statement produced by the operator under investigation concerns a fact of which it is the sole source, exposing it to the Endogenous Audit Paradox. SOURCE 0 provides independent sealing, prior to the alleged infringement, that renders that same measure opposable rather than merely declared.
How can the absence of intentional conduct in an Article 50 infringement be demonstrated?
By establishing, through a record that cannot be altered after the fact, the exact chronology of the decisions that led to the failure to label. SOURCE 0 seals this chronology at the time of the events, before any investigation begins and before intent becomes a disputed point.
Can the degree of cooperation with the competent authority be proven after the fact?
It can be alleged after the fact, but its probative value depends on its verifiable prior timing. SOURCE 0 seals exchanges and corrective measures as they occur, so that their chronology no longer rests solely on the operator's reconstruction at the time the authority assesses the sanction.
Does SOURCE 0 guarantee a reduction in the amount of the fine?
No. SOURCE 0 does not prejudge any decision by the authority and does not reduce the discretionary power provided for in Article 99, paragraph 7. SOURCE 0 renders opposable the facts the authority must assess under points (f), (g), and (i), without substituting for that assessment.
Can an operator already under investigation still use SOURCE 0 for the ongoing procedure?
SOURCE 0 seals facts at the moment they occur. Sealing can only apply to future or ongoing measures; it cannot retroactively reconstruct proof of past measures that were not sealed at the time of the events.
CLOSING AXIOM
A technical or organisational measure that only its own author can attest to is not a proven measure: it is an alleged fact awaiting a third party.
REFERENCE NOTE
SOURCE 0 is a pre-execution cryptographic attestation architecture developed and operated by Jean-François ELSEN. Legal references cited in this article: Regulation (EU) 2024/1689 (AI Act), Articles 50 and 99; Commission Guidelines C(2026) 5054 final of 20 July 2026 on the implementation of the transparency obligations of Article 50, adopted under Article 96, paragraph 1, point (d), of the AI Act, non-binding.
REGULATORY NOTICE
This article constitutes a doctrinal analysis and should not be construed as legal advice. Commission Guidelines C(2026) 5054 final have no binding force; only the Court of Justice of the European Union has authority to interpret Regulation (EU) 2024/1689. Any application to the facts of a specific situation requires dedicated legal consultation.
