Where the AI
actually is.
“AI-powered” has stopped meaning anything. So, specifically:
AI drafts
- Application code, against an approved specification
- Unit and integration tests
- Migrations and refactors
- Documentation
- First-pass defect fixes
AI does not
- Decide what to build
- Approve its own output
- Merge to your main branch
- Release to production
- Touch your data outside the agreed scope
AI does the volume. The gates do the checking — and the checking is done by people whose names are on the record.
Your customers will ask
about regulation.
The European Commission’s own timeline: authorities’ enforcement powers begin 2 August 2026; high-risk obligations for Annex III systems apply from 2 December 2027; and for AI embedded in regulated products, from 2 August 2028. Source: European Commission AI Act service desk, checked 12 Oct 2026.
Governed, documented, human-approved delivery stops being a preference and becomes a procurement question. The evidence is something we produce by default.