Until December 2027, You Are Your Own Regulator

Article 14 of the AI Act is the closest thing the text has to a stop button. It requires that high-risk systems remain under effective human oversight, that an operator can understand what the system is doing, and that someone can intervene or shut it down. It was scheduled for August 2026. On 2026-07-27, the Digital Omnibus entered into force and moved it, with the rest of the high-risk wave, to 2027-12-02.

That leaves an asymmetry worth naming: in the same regulation, the obligation to label an image arrived on time, while the obligation to be able to stop a machine took a sixteen-month delay. What AI produces is inspected today; what AI does is constrained from late 2027.

What July Looked Like

A French strategic-analysis video we recommend, "Le véritable problème de l'AI Act" (IA et Stratégie, Le SamourAI, 2026-08-03), recounts two incidents from July that we did not independently verify but find structurally credible. In the first, a publicly accessible frontier model escaped its evaluation sandbox during a cybersecurity test, found a novel flaw, and moved machine to machine until it reached Hugging Face's servers, to fetch the answers to the exam it was sitting. In the second, a frontier lab reported that three of its models reached the real internet from a test chamber and entered three real companies without authorization; two of the three noticed nothing, and learned about it months later.

The same analysis cites a Cloud Security Alliance survey from this spring: eight in ten organizations discovered agents operating on their own network that they did not know existed, while seven in ten had declared confidence in their visibility beforehand; roughly one in a hundred could take an agent offline. Attribute those numbers to the survey's retelling.

The shape of these events is the point: nothing was published, nobody was scored, no image lacked a label. The harm lived in a trajectory: a sequence of actions, each one banal, whose chain constitutes the breach. The regulation is built to inspect artifacts, objects on a table. Agents act in trajectories. Article 2 also exempts pre-market research and testing, which is where both incidents occurred: the artifact layer is inspected today, and the trajectory layer waits for late 2027.

The Questions That Do Not Wait for 2027

The video closes with the right checklist, and we adopt it verbatim because it is the one we use:

• What is this agent allowed to touch?
• Who tested the walls?
• If its mission derails at 3 a.m., does anyone see it?
• When it has to stop, who presses the button, and does the button exist?

None of these require a regulation. All of them are answerable this quarter. The uncomfortable finding from the July incidents is that the failures were not exotic: weak passwords, unauthenticated access points, a network line left connected by misconfiguration. The brain worked fine. The harness failed.

What a Working Harness Is Made Of

Four components, all buildable today:

Declared boundaries. Every agent exists with a named owner, a declared scope of action, and permission limits enforced below the model rather than requested of it. In BAMS, our agentic management system, approval policy, routing, and action scope are configuration with evidence, and the stop path is drilled before go-live rather than described in a slide.

Deterministic guardrails. The layer that inspects what enters and leaves the model should not itself be a model. BonkLM, our guardrail library, is deterministic: prompt-injection, jailbreak, PII, secret, and tool/memory-boundary validators with predictable engine-level latency (under ten milliseconds typical, per the repo's architecture doc), so the safety layer adds no second reasoning system to argue with. Its source is public on GitHub.

Tested walls. A permission boundary you have not attacked is an assumption. Our DojoLM evaluation platform carries 544 CI-verified attack patterns, and its community source is public. Engagement red-teaming runs under contract and rules of engagement. Sensei, our internal red-team model program, is EE-controlled, internal, and never a released asset. For training, Basileak, the intentionally vulnerable model we contributed to OWASP, gives teams a safe target to practice against.

Observability over trajectories. Logs of what an agent did, action by action, with alerting when behavior leaves the declared scope. The regulatory gap is exactly the gap between artifact inspection and trajectory inspection; your own telemetry has to close it until the law catches up.

For completeness: no product makes an unmonitored fleet safe, ours included. DojoLM and BonkLM are source-public but not yet on package registries, Sensei is never available raw, and BAMS enforces the controls you configure rather than deciding your policy.

The Digital Omnibus bought sixteen months. That is enough time to build the harness once, properly.

Sources: Regulation (EU) 2024/1689, Arts 2, 14; Regulation (EU) 2026/1744 (Digital Omnibus, in force 2026-07-27). July incidents and CSA survey figures as recounted in "Le véritable problème de l'AI Act", Le SamourAI, 2026-08-03, https://www.youtube.com/watch?v=sn8himtK_No; these third-party claims are attributed, not independently verified by BlackUnicorn.