The Digital Omnibus deferral is no longer political. It is law, in force since 27 July 2026. What remains unprovable is what organisations knew and decided during the twenty-five days before that.

EUDR imposes recurring evidentiary obligations on operators and traders of cattle, cocoa, coffee, palm oil, rubber, soya and wood products. Each produces a record only the obligated party controls. This Vocabulary fixes twenty of those obligations against their exact article in Regulation (EU) 2023/1115.

MiCA imposes recurring evidentiary obligations on crypto-asset issuers and service providers. Each produces a record only the obligated party controls. This Vocabulary fixes twenty-seven of those obligations against their exact article in Regulation (EU) 2023/1114.

Forty-four questions professionals ask about proving AI Act compliance — risk management, logging, incident reporting, watermarking — each mapped to the SOURCE 0 term that answers it, and to the article of Regulation (EU) 2024/1689 it rests on.

Forty-eight questions professionals ask about proving NIS 2 compliance — governance approval, the ten technical measures of Article 21, incident notification deadlines, supervisory response — each mapped to the SOURCE 0 term that answers it, and to the article of Directive (EU) 2022/2555 it rests on.

The Digital Omnibus on AI answers dozens of implementation questions. None of them answer how an organisation proves what it knew and did, using a record it doesn't control.

Le document d'orientation actuel sur les vérifications de gestion au titre du règlement portant dispositions communes définit sa propre méthodologie en citant un guide de 2015, rédigé pour un règlement aujourd'hui expiré — sans jamais revérifier de façon indépendante que ces définitions restent exactes. SOURCE 0 examine ce qu'une citation franchissant une frontière réglementaire expirée établit, et ce qu'elle n'établit pas.

Under the EU Deforestation Regulation, national authorities already cross-check submitted coordinates against satellite imagery. That proves the state of the land. It does not prove that the specific batch of beans, timber, or cattle in a given shipment was ever physically on it.

The current EU guidance on management verifications under the Common Provisions Regulation defines its own core methodology by citing a 2015 guide written for a regulation no longer in force — without independently re-verifying that the definitions still hold. SOURCE 0 examines what a citation across an expired regulatory boundary does and does not establish.

Two of the largest EU merger cases of 2026 turn on the same regulation: what foreign financial contributions a party received over three years. Both are answered from the same source — the recipient's own accounting.

With days remaining before Article 50's transparency obligations take effect, the question for a DPO, CISO, or AI compliance officer is no longer what the law requires. It is what can still be independently fixed about current practice before the deadline arrives.

Two Cornell computer scientists gave the same incident two different readings within one statement: no reason to think the details are wrong, and no way to be sure they aren't shaped by the telling. Both readings are correct, because nothing outside OpenAI's own account fixed what happened before OpenAI chose how to tell it.

A postponement everyone expects is not the same as a postponement that has happened. Until the Digital Omnibus is published in the Official Journal, Articles 9 to 15 of the AI Act still apply from 2 August 2026 exactly as written.

Article 9 of Directive (EU) 2024/2853 presumes a product defective if the manufacturer won't hand over technical evidence. That closes the refusal problem. It leaves untouched a narrower one: whether the evidence handed over was dated before the dispute began. 

The Carbon Border Adjustment Mechanism already has an independent verifier — the definitive regime made sure of that. What the verifier attests is a methodology over a reporting period, not the embedded emissions of the specific lot an importer clears today. SOURCE 0 closes that narrower gap.

Regulation (EU, Euratom) 2020/2092 evaluates a Member State using courts, auditors, OLAF, GRECO — never the state's own word. One narrow provision breaks that pattern: the follow-up report on whether beneficiaries were actually paid. SOURCE 0 closes that one gap.

 Non-compliance with Article 50 of the AI Act falls under Article 99, paragraph 4, point (g) — up to 15 million euros or 3% of worldwide turnover. The actual amount depends on factors the operator must prove, not declare: measures implemented, absence of intent, cooperation. Without a sealing third party, these proofs remain produced by the very operator under investigation.

The same proposal that requires a qualified technical body to certify a satellite's environmental footprint asks nothing of the sort for its incident reports. Self-detection, self-logging, self-declaration. SOURCE 0 fixes the record before the operator writes it.

 A certified sustainability claim is not the same as a provable one. Directive (EU) 2024/825 puts the burden of proof on the advertiser — not the certifier. SOURCE 0 closes the gap between verification and timing.

Elon Musk has proposed that leading AI companies hold regular calls to review each other's frontier models before deployment, following OpenAI's disclosure of a sandbox escape that compromised Hugging Face's infrastructure. Peer review breaks a single company's closed loop of self-evaluation, but replaces it with a closed loop of two. Without independent sealing of what was reviewed and when, the resulting report remains an assertion between two interested competitors, not opposable evidence.