← All tech signals
Governance

Compliance Moves to Code

AI compliance moves from legal memo to engineering log: continuous evidence a system can be audited against, even as the EU delays its high-risk rules to 2027 and 2028.

What is it?

Before an August 2026 EU deadline, compliance for high-risk AI stops being a legal memo and becomes continuous, structured evidence a machine can audit — engineering teams, not lawyers, now build the pull request that proves it. Whether tooling matures fast enough is the open part.

Why now?

Regulation used to arrive as a filing; the EU AI Act arrives as an operational obligation instead, demanding ongoing evidence rather than a one-time report. The obligation lands on infrastructure, not legal, because only code can produce continuous proof. Vendor certification signals buyers now expect this as default.

Who’s building it?

Platform and security teams, governance-tooling vendors, and certification bodies like ISO enforcing the standard.

Platform engineersSecurity teamsGovernance vendorsISO/IEC certifiersEU regulators
The full read
Why now, who is building it, where the market goes, and what stays unsettled.
Get weekly →
01 · The market
Who’s in it
Builders — Governance-tooling vendors and the platform teams who deploy them.
Buyers — Enterprises facing the EU AI Act deadline, screening vendors for certification.
Gatekeepers — EU regulators and certification bodies setting what counts as proof.
What’s at stake
Whether tooling matures fast enough — demand already outpaces what commercial vendors currently ship in practice.
Who owns compliance internally, once it has left legal behind.
Procurement exclusion for firms lacking a credible, auditable evidence trail.
What’s unsettled
Whether vague terms like ‘meaningful human oversight’ become genuinely codeable.
If ISO/IEC 42001 becomes the real standard, or one of several.
Whether engineering teams can absorb this work without dedicated new headcount.
02 · How the demand matureda progression, not a timeline
Deadline
The August 2026 EU deadline forces structured evidence, not a filing.
Certification
Vendors pursue ISO/IEC 42001 as buyers start screening for it directly in deals.
Translation
Platform and security teams turn vague legal language into pull requests and structured audit evidence.
Procurement filter
Buyers screen for certification and evidence trails, excluding vendors that lack a mature one.
03 · Where the market goesthe forks, not a prediction
→Standardise or fragment — ISO/IEC 42001 could become the default proof, or compete against several regional and sector standards at once.
→Commercial tooling catches up to what teams need, or teams keep building their own custom tooling instead.
→Compliance ownership settles permanently inside engineering, reversing decades of sitting squarely with legal instead.
→Enterprise procurement makes an auditable trail a hard gate, not just a nice differentiator.
Everything here turns on translation: whether vague legal duties like ‘meaningful oversight’ can genuinely become code a machine audits, not a policy a lawyer signs off.
04 · The Compliance-as-Feature deskadjacent markets, moving now
The Always-On Audit
Firms start using AI agents to monitor alerts, with audit trails in question.
FINRA says agentic AI is moving into early use at member firms.
FINRA
The Explainability Demand
Transparency labelling for AI content becomes mandatory.
EU AI Act Article 50 mandates AI-content transparency labelling.
European Commission
Certified Before Release
Independent labs now pre-screen AI products directly.
An independent lab now runs a crash test for AI systems.
CNN Business
05 · The Wire
01
Guide: log every AI endpoint and monitor continuously
Raconteur ↗
02
EU delays high-risk AI rules to December 2027 and August 2028
Council of the EU (via EEAS) ↗
The panel on this signal
They agreed on
–Compliance is genuinely migrating from legal teams into infrastructure and engineering, right now, faster than expected.
–Certification is becoming a real procurement filter, not a nice-to-have.
–Tooling maturity currently lags what the deadline and buyers now expect of it.
The regulatory analyst disagreed on
–Statutory language written in broad, principle-based terms does not translate cleanly into the structured, auditable evidence trails compliance tooling requires; organisations may end up generating documentation that satisfies an audit checklist without altering the underlying practice the rule targets.
Know more about the method →
✦How this signal was built
01 · Panel
A Delphi panel of 4 AI analysts, each reasoning independently.
→
02 · Debate
They challenge and revise each other’s reads over two rounds.
→
03 · Evidence
Every claim is tied to a cited, linked source on The Wire.
→
04 · Synthesis
A moderator writes it into one read, disagreement and all.
✦Signal changelogre-read as evidence changed
2025
Enterprises had to show continuous, auditable AI Act compliance evidence before the high-risk deadline of 2 August 2026.
→
2026
The Council adopted a delay: high-risk rules now apply from 2 December 2027 for stand-alone systems and 2 August 2028 for embedded ones. Council of the EU (via EEAS) ↗