Compliance shifts to runtime enforcement, metadata and labels become workflow controls

Compliance Moves from Review to Runtime Enforcement

The EU Commission and EU AI Board’s final Code of Practice for Article 50 makes transparency controls executable: AI-generated content must carry embedded metadata, a harmonized EU labeling icon, and detection rules for deepfakes and manipulated content, with duties tied to 2 August 2026 and a six-month retroactive transition for adding detectability features. That is a shift from reviewing models on paper to proving that labeling, provenance, and detectability controls actually work in production and can be verified later.

This week’s market response shows the operating model catching up. ModelOp and Kong launched policy-as-code enforcement that can approve, restrict, or block AI endpoints at runtime based on risk status and required controls, while generating audit-ready evidence from testing and assessments. The broader EU oversight stack is also tightening around technical documentation, log retention, post-market monitoring, human oversight, and serious incident reporting within 15 days, with ISO 42001 reinforcing a common benchmark.

For Compliance professionals, the edge now goes to people who can turn policy into machine-readable controls, telemetry requirements, and incident playbooks. The practical career move is to work fluently with engineering, security, and model risk so governance is enforceable, not just reviewable.