[{"data":1,"prerenderedAt":206},["ShallowReactive",2],{"blog:en:rules-move-faster-than-release-cycle":3},{"id":4,"title":5,"author":6,"body":7,"date":191,"description":192,"extension":193,"meta":194,"navigation":195,"path":196,"publishAt":197,"seo":198,"stem":199,"tags":200,"__hash__":205},"blog_en/blog/rules-move-faster-than-release-cycle/en.md","When the Rules Move Faster Than Your Release Cycle","Aptli",{"type":8,"value":9,"toc":179},"minimark",[10,15,19,22,25,29,32,44,51,54,57,61,64,67,70,74,77,82,85,88,92,95,101,107,113,119,125,131,137,141,144,147,150,156,160,163,166,169,173,176],[11,12,14],"h2",{"id":13},"three-functions-three-clocks","Three functions, three clocks",[16,17,18],"p",{},"There is a conversation that comes up whenever we consider a new market, and it does not resolve cleanly.",[16,20,21],{},"Product asks whether the market is worth entering. Legal asks what we would be on the hook for. Engineering asks what it would take to build. Each function gives an answer that is correct on its own and incomplete next to the other two. Product can want a market that legal has not scoped. Legal can describe an obligation that engineering would need a year to satisfy. Engineering can build for a regime that never arrives.",[16,23,24],{},"The usual way to settle this is to pick one perspective and let it lead. That works when the ground is stable. Right now it is not.",[11,26,28],{"id":27},"what-changed-this-summer","What changed this summer",[16,30,31],{},"Two things happened within a few weeks of each other, in opposite directions.",[16,33,34,35,39,40,43],{},"The EU adopted a simplification package that entered into force on 27 July 2026. It deferred the high-risk obligations in Annex III of the AI Act from 2 August 2026 to ",[36,37,38],"strong",{},"2 December 2027",", and product-embedded systems under Annex I to ",[36,41,42],{},"2 August 2028",". That is the expensive tier: risk management systems, conformity assessment, CE marking, quality management, registration, post-market monitoring. The reason given was that the European standardisation bodies had not finished the harmonised standards. You cannot certify against a standard that has not been published.",[16,45,46,47,50],{},"At the same time, ",[36,48,49],{},"Article 50 became enforceable on 2 August 2026",". It was not deferred. It applies to any system that interacts directly with a person, whatever its risk tier, and it requires that the person be told they are dealing with AI. Generated content has to be marked. The ceiling is 15 million euros or three percent of worldwide turnover.",[16,52,53],{},"Canada moved the other way. AIDA died with Bill C-27 when Parliament was prorogued in January 2025 and has not been reintroduced. The responsible minister has said it will not return as drafted, and that any future framework should be light. The live federal vehicles are privacy and digital safety legislation rather than a comprehensive AI statute. There is no Canadian AI act in force.",[16,55,56],{},"That does not mean there is nothing to meet. Quebec's Law 25 has been fully in force since September 2024, with penalties to 25 million dollars, and its automated decision provisions read a lot like the European ones: inform the person, explain the logic and the criteria, allow them to submit observations, provide human review on request. The binding obligations in Canada arrive through provincial privacy law, and they are shaped more like the EU than like the federal posture above them.",[11,58,60],{"id":59},"are-we-compliant-has-a-shelf-life","\"Are we compliant\" has a shelf life",[16,62,63],{},"Set the two together and the useful lesson is not about either jurisdiction.",[16,65,66],{},"An organization that built the full high-risk apparatus for August 2026 spent it sixteen months early, against standards that were not published. An organization that built nothing missed a transparency duty that became enforceable with a real penalty attached. Neither of those is a failure of diligence. Both are the same mistake. Each treated a moving requirement as a fixed one and committed early in the wrong direction.",[16,68,69],{},"So \"are we compliant\" is not a question with a durable answer. It has a shelf life measured in months.",[11,71,73],{"id":72},"the-question-that-lasts","The question that lasts",[16,75,76],{},"The question that survives the churn is a delivery question:",[16,78,79],{},[36,80,81],{},"When the next substantial change lands, are we in a position to meet it, or do we leave that market?",[16,83,84],{},"Both answers are legitimate. Deciding that a market is not worth the maintenance is a real strategic choice, and it is better made deliberately than discovered halfway through a procurement. What is not legitimate is finding out you cannot meet a change because of a decision made years earlier for reasons that had nothing to do with regulation.",[16,86,87],{},"Answering that question is not about predicting the law. It is about knowing where the load lands when it changes, and keeping those specific points loose.",[11,89,91],{"id":90},"where-the-load-lands","Where the load lands",[16,93,94],{},"For an AI feature inside an operational system, we watch a short list. Every one of these is somewhere a rule change would put weight.",[16,96,97,100],{},[36,98,99],{},"The model provider."," If a provider is named anywhere except one configuration file, switching means a code change. Ours is a setting an administrator picks. It is stored in the database, and no other part of the pipeline assumes a provider.",[16,102,103,106],{},[36,104,105],{},"Where data sits, and which law governs it."," These are two different questions. One instance and one database per customer, in the jurisdiction the customer chooses, keeps them answerable separately.",[16,108,109,112],{},[36,110,111],{},"Whether a person is in the loop."," The assistant proposes and a person applies or discards. It does not commit changes on its own. Human oversight is close to universal across the regimes we looked at, and it is very difficult to retrofit into a system that was designed to act autonomously.",[16,114,115,118],{},[36,116,117],{},"What leaves the instance."," Names, emails and phone numbers are replaced with deterministic tokens before a request goes out. The reverse map stays in the customer's own database.",[16,120,121,124],{},[36,122,123],{},"What you can prove afterwards."," An append-only audit log records who did what and when. Every regime we read wants records. They differ on retention and format, and those are easier to change than the decision to keep records at all.",[16,126,127,130],{},[36,128,129],{},"Disclosure."," This is the one that is enforceable in Europe today, and it is also the cheapest to satisfy. It is a string in each supported language and a marking on generated output. We are not selling into the EU, so Article 50 does not currently bind us, and our public portal does not carry an AI disclosure today. It is on the list to add before that changes, and honestly it should be there regardless of where we sell.",[16,132,133,136],{},[36,134,135],{},"Conformity documentation."," Technical files, model cards, formal impact assessments. We have not built these. That is a deliberate decision rather than an oversight, because the trigger for them is a market entry we have not made. What matters is that nothing we have built makes them harder to produce later.",[11,138,140],{"id":139},"the-half-that-is-not-the-product","The half that is not the product",[16,142,143],{},"The list above is an architecture list, and architecture is the easier half. The organizational twin is where teams tend to be more locked down than they realise.",[16,145,146],{},"Does any customer agreement name a specific model provider? Does a signed data processing agreement pin a country you would then have to renegotiate to leave? If a regulator asked for documentation, would you generate it from the record, or would producing it be a project you had to staff? Who watches for the next Article 50, and how would they find out about it? And when the answer is that a market is no longer worth it, who owns that call?",[16,148,149],{},"Here is the part that makes this genuinely hard, and it is not a technical problem.",[16,151,152,155],{},[36,153,154],{},"The artifacts that prove you take governance seriously are often the same artifacts that reduce your ability to change."," A certification has a scope. A contractual commitment has a term. A residency guarantee names a place. Each of these felt like rigour on the day it was signed, and each one narrows what you can do next year. You cannot resolve that tension inside the legal function or inside engineering. It only resolves in a conversation where somebody is accounting for both.",[11,157,159],{"id":158},"the-last-switch-belongs-to-the-customer","The last switch belongs to the customer",[16,161,162],{},"We sell operational software. The AI is a means of making some of that work easier, and it is not the product.",[16,164,165],{},"That has a design consequence we think is right independent of any regulation. The assistant ships disabled on a new instance and stays off until an administrator turns it on. The customer holds that switch, not us. If their own obligations change, or their council takes a position, or they decide they would rather not, they do not need a release from us and they do not need to ask.",[16,167,168],{},"None of this is exotic. Most teams building in this space are making versions of the same calls, and plenty are further along on parts of it than we are. The part that seems to get skipped is naming the pressure points out loud, and being honest about which ones you have deliberately left unbuilt.",[11,170,172],{"id":171},"what-agile-actually-means-here","What agile actually means here",[16,174,175],{},"Agility is usually discussed as a property of how a team plans its work. In an environment like this one it is closer to a comparison of two rates: how fast the ground moves against how fast you can respond.",[16,177,178],{},"If the second number is smaller than the first, your process is not the thing that will save you. And walking away from a market is a legitimate output of that comparison, not an admission of failure. The failure is arriving at the decision without having noticed that it was being made.",{"title":180,"searchDepth":181,"depth":181,"links":182},"",2,[183,184,185,186,187,188,189,190],{"id":13,"depth":181,"text":14},{"id":27,"depth":181,"text":28},{"id":59,"depth":181,"text":60},{"id":72,"depth":181,"text":73},{"id":90,"depth":181,"text":91},{"id":139,"depth":181,"text":140},{"id":158,"depth":181,"text":159},{"id":171,"depth":181,"text":172},"2026-08-22","AI and privacy law is changing faster than most product cycles. The question is not whether you are compliant today. It is whether you can absorb the next change, or whether you leave that market. Here is how we think about the decision, and where we chose not to build.","md",{},true,"/blog/rules-move-faster-than-release-cycle/en",null,{"title":5,"description":192},"blog/rules-move-faster-than-release-cycle/en",[201,202,203,204],"ai-governance","compliance","architecture","product-strategy","eycymbIPZ7M928_sw4YImJBqgoeuFf-A8WFst3qkKho",1788431621115]