Regulatory and Licensing Status (as of October 2026)
A compliance checklist written in 2024 is already wrong twice: the EU moved its high-risk deadline in July 2026, and Microsoft dropped a filter requirement from its copyright indemnity in April. So far, the fixed rules touch software teams at the edges, through AI literacy, vulnerability reporting, provenance and indemnity conditions. No text read for this appendix lists coding assistants as high-risk. Every item below carries its date and a primary source, and every legal inference is put as a question for counsel. None of this is legal advice.
The status board
Sources follow in the sections below. The governance argument these items feed is in Scaling Across Teams. The risk summary is in Economics, Risk and Measurement.
EU AI Act after the Omnibus
According to the European Commission (read October 2026), the Act entered into force on 1 August 2024. Prohibitions and AI literacy have applied since 2 February 2025, obligations for general-purpose models since 2 August 2025, and general application since 2 August 2026. The Annex III high-risk rules now apply from 2 December 2027, and Annex I systems embedded in regulated products get until 2 August 2028. The amending "AI Omnibus" "entered into force on 27 July 2026". It is Regulation (EU) 2026/1744, published in the Official Journal on 24 July 2026.
Article 4, as amended, has providers and deployers "take measures to support the development of AI literacy" (Regulation (EU) 2026/1744, which replaces the earlier duty to ensure literacy). Any team that deploys a coding assistant is a deployer. That makes training a likely compliance artefact, which People: Roles, Skills and the Junior Pipeline can build on.
Annex III point 4(b) covers systems used "to monitor and evaluate the performance and behaviour of persons" in work relationships (Annex III, consolidated text on artificialintelligenceact.eu, secondary). Coding assistants are not listed there. Article 14(4)(e) requires that overseers of high-risk systems can halt them through "a 'stop' button or a similar procedure" (Article 14, same consolidated text, secondary).
Open questions for counsel. Does an AI dashboard that scores or ranks individual developers fall under Annex III 4(b) from 2 December 2027? Does running internal coding agents ever make a company a provider rather than a deployer? Until counsel answers, Measuring Success and When to Roll Back recommends keeping AI metrics out of individual performance reviews, for measurement reasons of its own.
EU Cyber Resilience Act
The Commission's CRA page (read October 2026) gives three dates. The Act entered into force on 10 December 2024. Reporting obligations "apply as of 11 September 2026". The main obligations apply from 11 December 2027. It covers "software or hardware products with digital elements". For a team that ships such products into the EU, the reporting clock is already running.
Open question for counsel. The source says nothing about AI-generated code. Do a manufacturer's CRA duties apply to agent-written code exactly as to human-written code? The book assumes they do when it plans controls, but that is an inference, not a reading of the text.
Voluntary frameworks: NIST AI RMF and ISO/IEC 42001
NIST's AI Risk Management Framework 1.0 was released on 26 January 2023 and is "intended for voluntary use". Its Generative AI Profile (NIST AI 600-1) followed on 26 July 2024. As of October 2026, NIST says "The AI RMF 1.0 is being revised as part of the White House AI Action Plan". MANAGE 2.4, which maps onto this book's rollback design, asks that mechanisms be in place "to supersede, disengage, or deactivate AI systems that demonstrate performance or outcomes inconsistent with intended use" (NIST AI 100-1).
ISO/IEC 42001:2023, an AI management-system standard, was published on 18 December 2023 (IEC webstore listing; the iso.org page could not be read). In practice it turns up in procurement. On 13 January 2025 Anthropic announced that it had been certified to it by an accredited body (vendor announcement). The certificate covers the vendor's management system, not how its tool behaves in your pipeline. The wiki compares these frameworks in ISO 42001 vs NIST AI RMF vs EU AI Act vs AIUC-1 and NIST AI RMF for agents.
Copyright, the Copilot case and indemnity
US Copyright Office. Part 2 of its report, on copyrightability, was published on 29 January 2025 (copyright.gov). It concludes that "given current generally available technology, prompts alone do not provide sufficient human control to make users of an AI system the authors of the output". Human expression that is perceptible in the output, and the creative selection, arrangement or modification of output, can still be protected (report PDF).
Doe v. GitHub. On 16 September 2026 the Ninth Circuit (No. 24-7700) rejected the DMCA §1202(b) "output" theory. Copilot and Codex do not "remove or alter" copyright-management information. They "instead create new works that never contained that information". Two breach-of-contract claims "remain pending". The court also called GitHub's duplicate-detection filter "some evidence that Copilot can and does emit literally identical copies of code" (opinion).
Microsoft's Customer Copyright Commitment. For GitHub offerings, "as of April 3, 2026, there are no additional required mitigations. Use of the Duplicate Detection filter feature is no longer required for CCC coverage" (CCC required mitigations, page updated 13 July 2026). Azure OpenAI customers still have required mitigations, including the protected-material code filter for code generation.
Open questions for counsel. Who owns a codebase that is mostly agent-written, given the Office's position on prompts? Does dropping the duplicate filter, now that indemnity no longer requires it, change your licence exposure, given what the court read into that filter? The wiki's IP and copyright for agent output page tracks the detail.
Open-source project policies
If your agents open pull requests upstream, each project's policy is a hard constraint, and the policies split three ways.
Assisted-by: AGENT_NAME:MODEL_VERSION [TOOL1] [TOOL2], the 7.3-rc7 docs for Assisted-by: LLM [TOOL1] [TOOL2].Assisted-by: trailer. The contributor "is fully accountable for the entirety of these contributions". AI may assist reviewers but must not be "the sole or final arbiter" of a substantive judgement.The kernel and Fedora pattern, disclosure plus human-only sign-off, is the basis of the provenance-policy template in Templates. The wiki's regulatory landscape and EU AI Act for agents pages carry the wider context.
What to do.
- Re-check every row of the status board each quarter against its primary, and record the date you read it. At least two rows changed in 2026 alone.
- Have a CRA vulnerability-reporting runbook in place now if you ship software with digital elements into the EU. The obligation has applied since 11 September 2026.
- Before any agent opens an upstream pull request, record the project's AI policy. Block the agent from projects that decline AI contributions.
- Keep AI tools out of scoring individual developers until counsel has answered the Annex III question.
- For each vendor indemnity, write down the conditions and the date you read them. Decide on the duplicate filter for licence reasons, not indemnity reasons.
- Take the open questions in this appendix to counsel. Do not answer them in an engineering document.