Reuters mapped the US liability landscape for rogue AI agents. This article examines the EU mirror — the withdrawn AI Liability Directive, Belgian fault law, and the evidentiary gap common to every version of the standard.

OpenAI's Astra disclosure raises a Critical-level cybersecurity flag on the basis of an evaluation record only OpenAI has seen. This article examines what would, and would not, make that determination independently verifiable.

WORM storage made a record impossible to alter once written. In 2022, the SEC added an alternative that lets a firm's own system log the alterations instead — and verify itself.

Federal Rule of Evidence 902(13) and 902(14) remove the need for a foundation witness. They do not remove the question of who is making the underlying assertion, or when it was made.

Both parties in Lorraine v. Markel lost their motions for the same reason: neither had authenticated their own e-mails. The court that decision leaned on identified the real question — not how a record was created, but what happened to it afterward.

Article 1(a) of the 1961 Hague Apostille Convention names the huissier de justice. Article 1(d), read past by most commentary, names something more useful for anteriority disputes: the fact that a document already existed on a certain date. A second, independent treaty foundation for SOURCE 0's pre-execution architecture.

Fourteen questions professionals ask about proving CBAM compliance — default values, carbon-price certification, quarterly certificates, delegation — each mapped to the SOURCE 0 term that answers it, and to the article it rests on.

Fifteen questions professionals ask about proving CSDDD compliance — due diligence, remediation, civil liability, transition plans — each mapped to the SOURCE 0 term that answers it, and to the article it rests on.

Fifteen questions professionals ask about proving Data Act compliance — trade-secret refusal, compensation, contract dates, cloud switching — each mapped to the SOURCE 0 term that answers it, and to the article it rests on.

Fourteen questions professionals ask about proving Cyber Resilience Act compliance — the 24-hour clock, SBOMs, support periods, substantial modifications — each mapped to the SOURCE 0 term that answers it, and to the article it rests on.

Fourteen questions professionals ask about proving Data Governance Act compliance — intermediation conduct, altruism registration, consent timing, third-country transfers — each mapped to the SOURCE 0 term that answers it, and to the article it rests on.

Fifty questions professionals ask about proving GDPR compliance — consent, breach notification, DPIAs, international transfers — each mapped to the SOURCE 0 term that answers it, and to the article of Regulation (EU) 2016/679 it rests on.

Commits, tickets, and scans prove what your own systems recorded about a fix. None of them, on their own, fixes when it actually took effect — before an independent third party, and before the dispute began.

OpenAI says four accounts were breached. Only two are named, and neither naming came from OpenAI. The count itself is a disclosure, not a finding.

DORA requires a bank to prove when it became aware of an incident and when it classified it as major — the two instants a regulator disputes most. Both are written exclusively by the bank itself. This article examines why TLPT, Article 6 internal audit, and third-party oversight do not supply an independent witness to either instant, and what a pre-execution, third-party-deposited fixation adds to the DORA timeline.

Article 50 tells you what to disclose. It says nothing about proving when you disclosed it — and that silence is where liability actually lives.

Article 50 of the AI Act requires disclosure that a person is interacting with an AI system. It does not require proof that the disclosure preceded the interaction. This article states the current status of the Digital Omnibus on AI as of 12 July 2026 and sets out the pre-execution attestation mechanism that closes the resulting evidentiary gap.

Regulators regulate markets. Courts adjudicate facts. Only architecture can produce proof. The DMA designation of cloud gatekeepers does not resolve evidentiary independence.