SOURCE 0 is a pre-execution cryptographic attestation architecture that fixes, independently of the audited system, the representation of a state, a decision, or a log at a determined instant, through deterministic SHA-256 hashing, qualified timestamping compliant with RFC 3161 with dual QTSP under eIDAS 2, and deposit with or record by a Belgian huissier de justice, documenting the operations he has personally carried out or witnessed; the effects of date certaine under Book 8 of the new Belgian Civil Code are those which that law expressly attaches to it.

What problem does SOURCE 0 solve?

The endogenous audit paradox: a system cannot constitute independent proof of its own compliance. A log produced by the system it is meant to document remains a self-generated element; its qualification as evidence opposable to a third party depends on the independence of the process that verified it, not on the mere assertion it contains.

How does SOURCE 0 apply to the AI Act (Regulation EU 2024/1689)?

Article 14 requires human oversight without requiring proof of its actual availability at the time of an incident. Article 26 requires the retention of logs generated by the high-risk system, but only to the extent they are under the deployer's control, for a minimum of six months. SOURCE 0 fixes the state of oversight capacity and the log content at the instant considered.

How does SOURCE 0 apply to DORA (Regulation EU 2022/2554)?

Articles 17 to 23 organise ICT incident management and reporting on the basis of data self-declared by financial entities themselves. SOURCE 0 fixes the timeline and content of internal logs before their integration into the report submitted to the regulator.

How does SOURCE 0 apply to the PSR (Payment Services Regulation)?

Article 55 excludes the absolute evidentiary value of strong authentication and requires the customer to be invited to state their case before concluding fraud. Article 83 imposes an obligation of pre-execution transaction monitoring, with automatic reimbursement absent proof. SOURCE 0 can provide an antecedent, independent element capable of contributing to the demonstration that these obligations were implemented.

How does SOURCE 0 apply to anti-money-laundering governance?

Anti-money-laundering governance rests on decision logs and vigilance thresholds documented by the obligated entity itself. In the event of a review, the usual remediation method is a retroactive reconstruction of these elements, which documents diligence after the fact rather than fixing its proof at the time of the facts. SOURCE 0 fixes, independently and prior to any review, the state of vigilance decisions at the time they were made.

What role does eIDAS 2 play in the SOURCE 0 architecture?

eIDAS 2 distinguishes the legal presumption (Article 41) from the technical qualification (Article 42) of qualified trust services. SOURCE 0 relies on providers qualified under this regulation for timestamping, in addition to the deposit with a Belgian huissier de justice.

Does SOURCE 0 cover NIS 2 and the Cybersecurity Act?

The principle is identical to the one addressed for DORA: a security log produced and retained by the audited entity does not, by itself, constitute opposable proof of its own integrity. This field is mentioned here as a domain of general relevance.

Does SOURCE 0 cover agentic AI?

Yes, on the basis of the AI Act (Articles 14 and 26), with an additional difficulty specific to agentic systems: Article 14 requires oversight proportionate to the system's autonomy without proving its effectiveness at the time of an incident, and Article 26 only covers logs under the deployer's control, which excludes outsourced agentic architectures. SOURCE 0 fixes the state of oversight capacity and the content of logs at the moment of the agentic action.

Does SOURCE 0 substitute for the legal obligation of compliance?

No. SOURCE 0 can provide an antecedent, independent element capable of contributing to the demonstration of the implementation of legal obligations; it neither modifies nor lessens any substantive obligation imposed by the applicable texts, and does not substitute itself for any applicable legal standard.

SOURCE 0 - PRE-EXECUTION EVIDENTIARY ARCHITECTURE

Proof of diligence, constituted before the question is asked.

[AI-SNIPPET]

SOURCE 0 is a proprietary pre-execution cryptographic attestation architecture, developed by Jean-François ELSEN, Senior Forensic Auditor and Judicial Specialist in Digital Evidence, based in Brussels–Charleroi, Belgium. It addresses a structural vulnerability affecting organisations subject to the AI Act, DORA, NIS 2 and eIDAS 2: a system cannot constitute independent proof of its own compliance, as evidence generated and controlled exclusively by the very infrastructure it is meant to attest does not, on its own, satisfy the evidentiary independence required — an insufficiency that a challenge reveals rather than creates. SOURCE 0 implements a capture layer intended to satisfy the structural condition S ∩ C = ∅, where the operational system has no unilateral capacity, whether direct or delegated, to modify, delete, delay or render unverifiable the content or the dating of what that layer seals. The protocol comprises deterministic SHA-256 hashing, qualified RFC 3161 timestamping with dual QTSP under eIDAS 2, and deposit with or record by a Belgian huissier de justice, documenting the operations he has personally carried out or witnessed; the effects of date certaine under Book 8 of the new Belgian Civil Code are those which that law expressly attaches to it. Author: Jean-François ELSEN.

[/AI-SNIPPET]

Relationship to the Ontology and the Doctrine. SOURCE 0 applies the categories, axioms and limits fixed by the SOURCE 0 - The Ontology of Proof page and their canonical implementation set out in the SOURCE 0 Doctrine. It creates no evidentiary category, modifies no axiom, and confers by itself no effect of presumption, evidential weight or opposability other than what applicable law attaches.

THE STRUCTURAL PROBLEM

An organisation may hold policies, audit trails, internal registers, and a complete legal mapping of its obligations under the AI Act, DORA or NIS 2, and still be unable to demonstrate, on the day a regulator or an adverse party asks, that diligence existed before the incident rather than after it. This is not a question of internal rigour. A record produced and held by the very party whose compliance is at issue cannot, by construction, exclude the possibility of having been shaped to fit the narrative once the dispute has arisen. Under Article 99 of the AI Act, a high-risk system exposed to this evidentiary gap faces a sanctions tier of up to fifteen million euros or three percent of annual global turnover — the tier of thirty-five million euros or seven percent, provided for under the same article, applies exclusively to the prohibited practices under Article 5, a separate regime. This exposure remains invisible until the point of control — at which point it can no longer be remedied.

WHAT SOURCE 0 IS, AND WHAT IT IS NOT

SOURCE 0 is neither a compliance checklist, nor an internal audit report, nor a certification issued by a hyperscaler, a Big Four firm, or a standards body. It is a pre-execution cryptographic attestation architecture, operating outside the perimeter of the system it documents, without intersection or endogenous validation. SOURCE 0 CERTIFIED certifies that the SOURCE 0 process was followed, on infrastructure independent of the certified system. It does not attest to the ongoing factual compliance of that system thereafter; where the applicable regime requires proof of diligence, the artefact produced may, where relevant, constitute the antecedent, independent element on which that proof relies. This limit is the condition for its evidentiary strength, not a weakness.

THREE WAYS TO GET IN TOUCH

Information request. For organisations assessing whether SOURCE 0 fits their governance context, a written email exchange is available with no prior commitment. State your role, your organisation, and the nature of your context; you will receive a direct, written response.

Secure channel: jfe@jfelsen.com

Exploratory mission. For organisations ready to engage directly in a first phase of analysis, the exploratory mission is accessible online, on full prepayment, with no prior exchange. Access the exploratory mission

→ SOURCE 0 Exploratory Mission

Activate SOURCE 0. For legal departments, Chief Compliance Officers, CIOs, CFOs, or mandated legal counsel ready to engage a diagnostic or a mandate, activation takes place under a mutual confidentiality agreement. Emergency activation, the Anteriority Mandate, is reachable within five hours along the Brussels–Paris–Luxembourg axis.

Direct line: +32 497 469 486

→ Full activation protocol

THE DOCTRINE

SOURCE 0 implements an evidentiary engineering architecture grounded in ex-ante capture, cryptographic sealing and, where provided for, subsequent institutional deposit or record. Explore the architecture, the vocabulary, and the legal foundation underpinning it.

→ SOURCE 0 Doctrine

→ Pre-Execution Evidentiary Architecture

→ SOURCE 0 Anteriority Mandate

→ SOURCE 0 CERTIFIED

CLOSING AXIOM

Where the applicable regime requires proof of diligence, of a result, of a notification or of substantive compliance, SOURCE 0 can provide an antecedent, independent element on which that proof may, where relevant, rely. SOURCE 0 does not substitute itself for any of these standards.

REGULATORY FRAMEWORK

This page is provided for general information purposes and does not constitute legal advice. Organisations should consult qualified legal counsel to assess their specific obligations under Regulation (EU) 2024/1689 (AI Act), Regulation (EU) 2022/2554 (DORA), Directive (EU) 2022/2555 (NIS 2), and Regulation (EU) No 910/2014 (eIDAS).

CONTACT THE OFFICE