A market has formed around cryptographic certification of synthetic datasets — SHA-256 fingerprints, Ed25519 signatures, publicly verifiable registries. The better providers state plainly what this proves: integrity and authenticity of the certificate, not generation quality. That honesty does not close the gap that matters under Article 10 of the AI Act, especially where the same platform both generates the data and signs its own certificate.

An AI evaluation infrastructure built on billions of synthetic persona records reports a high adherence rate — proof the model can play an assigned role. Article 10 of the AI Act asks whether the declared population is representative of real users, and who, independent of the producer, can confirm it. This article examines the gap between the two.