Your Chatbot Became a Compliance Test on Saturday.

The rules that took effect Saturday were the quiet ones.

Open your own website in a private browser window. Find the chat bubble in the corner, the one procurement approved in 2024, and ask it anything. Now answer one question:did it tell you what it is?On Saturday, every market surveillance authority in the EU gained the power to run that exact test. It takes ninety seconds and no discovery powers.

A compliance lead at an EU-exposed company spent last Monday learning why that matters. Counsel emailed asking for a list of every point where a customer interacts with an AI system, across every product, channel, and market that touches the EU. She opened the program calendar to confirm what she already knew, that the AI Act work had moved to late 2027, and began drafting a reply saying so. Then counsel called. He had read the enacted text over the weekend. The sixteen-month deferral covered the high-risk chapter. The transparency articles applied Saturday. She closed the reply and started the list instead. By Wednesday the list had four contributing teams, three conflicting versions, and no agreed answer to the first question on it, which waswhat counts.

Everyone tracked the deadline that moved. The question this edition answers: who was tracking the ones that did not, and what do they require on day one?

The facts, precisely, because precision is the whole story this week. The Digital Omnibus on AI, endorsed by the European Parliament on June 16, approved by the Council on June 29, and published as Regulation (EU) 2026/1744, entered into force on July 27, 2026. It deferred the high-risk obligations for Annex III systems to December 2, 2027. That is the provision that made the headlines and reset the budget calendars. What it did not touch: the core transparency obligations under Article 50, which applied on August 2, 2026 as originally scheduled. People must be informed when they are interacting with an AI system. AI-generated and manipulated content carries disclosure duties. The one carve-out is narrow: the machine-readable marking requirement under Article 50(2) gets a grace period, and only for systems already on the market before August 2, running to December 2, 2026. Anything placed on the market from August 2 onward complies from day one.

Four dates, one held. The compliance calendar under Regulation (EU) 2026/1744.

And none of this arrived unannounced. The European Commission adopted its final Guidelines on the Article 50 obligations on July 20, fifty-one pages of interpretive detail published thirteen days before the deadline. The Code of Practice on Transparency of AI‑Generated Content, published on 10 June 2026 and later assessed as adequate by the Commission and the AI Board, had around 190 signatories by the end of July 2026, according to the Commission’s public signatory list . Penalties for transparency violations reach 15 million euros or 3 percent of worldwide annual turnover, the middle tier, not the 35 million euro tier reserved for prohibited practices that secondary coverage keeps borrowing. Enforcement activated the same Saturday , with the Commission and national market surveillance authorities both operational. Somewhere this week, a readiness program that was ceremonially shelved in July is being unshelved in August by the same person, with the same slides, and a new cover date.

Here is the part that gets misread as a legal drafting task. Twenty-six years of enterprise obligations teaches one reliable pattern: any requirement that begins with "for every system that" is an inventory requirement wearing legal clothing. The disclosure sentence is the easy half. Knowing every surface that needs the sentence is the hard half, and it cannot be assembled by asking business units to self-report, because teams report what they believe is AI, and what they believe is shaped by procurement labels. The chatbot the vendor sold as smart routing. The recommendation widget that has been on the pricing page so long nobody remembers it learns. The service agent built in Copilot Studio and embedded in the support channel eighteen months ago, which the internal registry knows exists, though no registry field records whether the customer on the other end was ever told what they were talking to.

And the stakes have a property the high-risk chapter never had. A conformity assessment failure hides inside documentation until an examiner requests the file. A transparency failure is visible from the street. Any customer, competitor, journalist, or national authority can test your Article 50 posture in a single browsing session, no discovery powers required. The Code's public signatory list adds a second check that costs the same nothing: anyone can look up whether the vendors behind your customer-facing AI ever signed. When enforcement begins, the first wave goes where verification is cheapest, and nothing is cheaper to verify than whether your chatbot says what it is.

The asymmetry that decides where enforcement starts. Both checks cost nothing to run.

The deferral was the headline. The obligations were in the footnote.

The response is reconciliation, pointed outward. The Tenant Agent Reconciliation Framework exists to reconcile what your tenant contains against what your organization approved. The disclosure version reconciles what customers actually encounter against what your organization has documented and disclosed, and it runs in three passes.First, pull the internal registry, the denominator Edition 20 established, and filter for anything with an external interaction surface.Second, walk the customer journey the way a customer does, every channel, every market, logging each AI touchpoint encountered, including the vendor-embedded ones that never crossed your deployment pipeline.Third, reconcile the lists. The delta between what the walk finds and what the registry knows is your exposure, and every surface in the union gets one named owner and one recorded decision: disclosed, exempt because the interaction is obvious, or retired.

The delta between what the walk finds and what the registry knows is the work. Full framework at sougataroy.com/frameworks/tenant-agent-reconciliation.

That register is Intent Architecture pointed at the customer, because a disclosure can only be drafted honestly if somebody already wrote down what the system is and what it is for. Where the internal purpose was never documented, the customer-facing sentence has nothing true to say, and the transparency gap turns out to be the same gap this newsletter has been mapping from the start, now visible from outside the building.

The sixteen months bought time for the hardest obligations. The ones that arrived Saturday were the cheapest to check.

If a customer asked your organization today which of its touchpoints are AI, how many days would the true answer take?

All frameworks referenced in The Governance Gap are published in full at sougataroy.com/frameworks. The Authorization Layer library is citable at DOI 10.5281/zenodo.21245690.