DEV Community

Discussion on: Compliance as Code: Why the EU AI Act Will Force Runtime Enforcement in 2026

Collapse
 
peacebinflow profile image
PEACEBINFLOW

The shift from "we have a policy" to "we can prove the control exists in production" is the kind of change that sounds like a legal problem until you realize it's actually an infrastructure problem. Policies are cheap to write. Runtime enforcement is expensive to build. The companies that understand this gap is engineering work, not compliance work, are the ones that will survive audits without scrambling.

What I find myself thinking about is the unspoken assumption in the "compliance as code" analogy: that the tooling ecosystem is mature enough to support it. Cloud security took a decade to go from manual reviews to policy-as-code, and it had the advantage of building on infrastructure that was already instrumented. AI systems are younger, more heterogeneous, and in many cases the guardrail layer is still bolted on after the fact rather than designed in. The registry you mention—OpenAI Guardrails Registry—sounds like an attempt to solve the discovery problem, but discovery is only the first step. The harder part is integration: making Presidio, LiteLLM, and Guardrails AI coexist in the same pipeline without creating three different failure modes and two new latency bottlenecks.

The point about retrofitting being more expensive than building enforcement early is the kind of thing everyone agrees with in principle and almost nobody acts on until an audit is six weeks away. It's the same dynamic as security—every postmortem says "we should have built this in from the start," and every greenfield project starts with the same pressures to ship features instead of controls. The EU AI Act might change that calculus by making the cost of non-compliance visible enough to justify the upfront engineering investment. But that only works if the people making build-vs-buy decisions understand that a policy PDF is not a control. How far do you think the current guardrail tooling is from being genuinely plug-and-play for a team that doesn't have dedicated ML infrastructure engineers?

Collapse
 
no1rstack profile image
no1rstack

You hit the nail on the head regarding the 'integration tax.' The bottleneck isn't just latency; it's the lack of a unified execution environment. We’re moving away from 'bolted-on' guardrails toward a 'Kernel' approach—where the safety layer isn't an afterthought but the actual permission logic the agent runs on. To your point on plug-and-play: we aren't there yet. Current tooling still requires significant 'glue code' that most product teams aren't equipped to maintain.