Notes

Did the EU just take AI-assisted development off the compliance agenda?

Quite the opposite, and the details matter this month.

Quite the opposite, and the details matter this month.

The Digital Omnibus on AI was adopted in June. High-risk obligations moved to December 2027 and August 2028. Plenty of teams heard “delay” and moved on.

Look closer at what did not move.

The AI literacy duty in Article 4 has applied since February 2025. If your developers use coding agents at work, your organisation already owes them sufficient training in the capabilities and limits of those tools. Not from next year. Now.

The transparency obligations in Article 50 still land on 2 August 2026. Under three weeks away.

And the delayed obligations did not change. They just moved.

Here is the part most engineering leaders have not priced in. The Act does not regulate how you write software. Coding assistants are not a high-risk category. But when the software you are building with agents is itself a high-risk AI system, or sits inside a regulated product, the provider obligations attach to you. Your development process becomes compliance evidence.

Annex IV asks for a description of how the system was developed. Article 12 asks for logs. Article 14 asks for human oversight that is effective, not oversight that is written down. If agents wrote a meaningful share of the code, can you show who or what produced each change, what reviewed it, and what could have stopped it?

The sixteen extra months are for building those answers, not for filing the question under 2027.

A regulator will not ask whether your governance policy exists. They will ask whether it worked.

What would your development process look like in an audit, rather than in a policy document?

Written in the open

New material lands week by week

Research, the kernel devlog, news and the papers are all published here first. Get them by email, or follow the feeds.

Or follow the work directly: Research · Kernel devlog · News · CDI assessment