An age-prediction system and a biometric age-verification service produce the same effect on a user account through entirely different processing. Public documentation does not establish, for either, when a compliance assessment was produced relative to deployment — nor whether an individual determination is preserved in a form a third party could later verify. This case study examines the gap under the AI Act and the GDPR, and what an independent, pre-execution seal can and cannot establish about it.

Any organization that determines, through an automated system, an individual's status produces a qualification whose evidentiary trace it alone retains. SOURCE 0 QUALIFICATION SEAL fixes a determined representation of that qualification, at a timestamped instant, independently of the system that produced it — without ruling on its accuracy, effective application, or lawfulness. First documented use case: age determination.

A supervisory authority fined Booking.com €475,000 in 2021 after applying an earlier awareness date than the one the company itself claimed. The same signals, read two ways, decided the case.

Synthetic-persona providers label a minority of their population "human-grounded" to distinguish it from algorithmically sampled records. That label confirms a record traces to a real panellist's account — not that the person who supplied the answers matches the account's demographic profile. The market research industry already documents this failure as participant misrepresentation. Where the mismatched respondent is a minor, GDPR Article 8's parental-consent verification duty becomes unreachable by design.

Fifty questions professionals ask about proving GDPR compliance — consent, breach notification, DPIAs, international transfers — each mapped to the SOURCE 0 term that answers it, and to the article of Regulation (EU) 2016/679 it rests on.