Meta's open-weight Muse Glimmer is exempt from AI Act technical documentation under Article 53(2). Two lawful thresholds later, no party is required to document the exact state deployed. SOURCE 0 seals it anyway.

Undisclosed communication modules found in Chinese-made solar inverters expose a structural gap in NIS 2 Article 21 supply chain security: entities take supplier declarations into account, but nothing fixes what was declared before the component is deployed. SOURCE 0 seals that declaration at the point of procurement.

Synthetic-persona providers label a minority of their population "human-grounded" to distinguish it from algorithmically sampled records. That label confirms a record traces to a real panellist's account — not that the person who supplied the answers matches the account's demographic profile. The market research industry already documents this failure as participant misrepresentation. Where the mismatched respondent is a minor, GDPR Article 8's parental-consent verification duty becomes unreachable by design.

Providers of general-purpose AI models with systemic risk must document adversarial testing and any involvement of independent external evaluators under Article 55 of the AI Act. Population-scale synthetic-persona simulation infrastructure is a plausible candidate for that role — external to the model provider, but not independent of itself when its own population and validation figures are self-reported. No such case has been identified; this article examines the structural gap that would arise if one did.

A market has formed around cryptographic certification of synthetic datasets — SHA-256 fingerprints, Ed25519 signatures, publicly verifiable registries. The better providers state plainly what this proves: integrity and authenticity of the certificate, not generation quality. That honesty does not close the gap that matters under Article 10 of the AI Act, especially where the same platform both generates the data and signs its own certificate.

Synthetic-respondent platforms now screen advertising claims before launch, reporting their own alignment rates against real consumers. EU and UK advertising law already require that the evidence behind a claim be adequate and independently defensible. A validation figure produced solely by the party selling the testing infrastructure does not meet that standard — it is the claim requiring substantiation, offered as its own substantiation.

An AI evaluation infrastructure built on billions of synthetic persona records reports a high adherence rate — proof the model can play an assigned role. Article 10 of the AI Act asks whether the declared population is representative of real users, and who, independent of the producer, can confirm it. This article examines the gap between the two.

Background-agent architectures promise to fix low AI adoption by moving humans to occasional review. That review becomes the sole surviving record of human diligence — and nothing currently proves it happened.

Geert Van Mol's call for sector-wide ambition on phishing echoes what itsme achieved for authentication. SOURCE 0 examines the layer itsme was never built to cover — proving what was actually instructed, not just who was logged in.

Two findings published in late May 2026 document the empirical collapse of agentic governance in the face of conventional observability. This article presents the SOURCE 0 architecture and the launch of Opposability-as-a-Service (OaaS) in response.

Amazon v. Perplexity turned on who "accesses" a platform through an AI agent. The ruling depends on a fact — what a session actually authorized — that only the AI company operating the agent can currently show.

A New Mexico court reasoned its way to leaving Meta's compliance self-reported — a deliberate choice, not an oversight. This article examines the evidentiary structure that leaves in place.

L'étude Aithos LARA montre que les modèles frontier violent le droit européen dans la majorité des scénarios testés. SOURCE 0 explique pourquoi l'observabilité ne suffit pas et ce que scelle l'OaaS.

Trump's remarks on AI regulation, Texas data centers, and China all argue about how much to regulate. None of them reach the separate question of how compliance is proven — a gap NIST's guidelines and Texas's own audit both share.

Reuters mapped the US liability landscape for rogue AI agents. This article examines the EU mirror — the withdrawn AI Liability Directive, Belgian fault law, and the evidentiary gap common to every version of the standard.

OpenAI's Astra disclosure raises a Critical-level cybersecurity flag on the basis of an evaluation record only OpenAI has seen. This article examines what would, and would not, make that determination independently verifiable.

WORM storage made a record impossible to alter once written. In 2022, the SEC added an alternative that lets a firm's own system log the alterations instead — and verify itself.

Federal Rule of Evidence 902(13) and 902(14) remove the need for a foundation witness. They do not remove the question of who is making the underlying assertion, or when it was made.

Both parties in Lorraine v. Markel lost their motions for the same reason: neither had authenticated their own e-mails. The court that decision leaned on identified the real question — not how a record was created, but what happened to it afterward.

From 18 August 2026, EU judicial authorities can order any service provider — including AI companies — to produce or preserve electronic evidence within days. The regulation requires a qualified eIDAS seal on the order. It requires nothing of the kind on the evidence itself, and says so in its own recitals.