Regulation

From the obligation, to the rule, to the evidence.

No examiner accepts a policy document as proof a control ran. Here is the path from obligation to artifact, along with where each regulation actually stands. No countdown clocks.

The obligation
The rule that enforces it
The evidence it leaves
IN FORCE
DORA
EU financial entities: reconstruct any incident.
Every action traced to a named person. Big transfers need a human.
Signed receipt per action: reconstructable months later, Track off.
IN FORCE
FFIEC · SR 11-7
US banks: access control + challengeable model oversight.
Least-privilege scopes. Irreversible actions need a second approver.
Proof the control ran that day, not a policy doc.
SCHEDULED
EU AI Act, Art. 12
High-risk systems: automatic, traceable event logging.
Every action logged, allowed or denied, with context.
Hash-chained. Tampering is detectable by construction.

None of these name a receipt, a schema, or Track. The obligation is real. The format is still nobody's.

Where it actually stands
Already in force5
AUG 2024
EU AI Act
Becomes law; obligations phase in over several years.
OCT 2024
NIS2
EU-wide cybersecurity risk-management duties apply.
JAN 2025
DORA
EU financial supervisors already expect this evidence.
AUG 2025
EU AI Act: GPAI rules
Model providers already face documentation duties.
JAN 2026
Texas TRAIGA
Intent-based prohibitions on certain AI uses; duties fall mainly on state bodies.
Scheduled5
AUG 2026
EU AI Act: Art. 50 transparency
Disclosure duties for chatbots and synthetic content apply.
JAN 2027
Colorado AI Act
Disclosure and transparency duties, after the 2026 amendment scaled the act back.
JAN 2027
New York RAISE
Safety and incident-reporting duties for the largest frontier developers.
DEC 2027
EU AI Act: high-risk obligations
The Annex III high-risk regime applies, Art. 12 event logging among it.
AUG 2028
EU AI Act: embedded systems
High-risk AI inside regulated products comes into scope.

Dates move: they've already slipped once. A bound approval doesn't need the calendar's cooperation.

Evidence a bound approval leaves, not a policy binder.

See what a receipt looks like against your own actions, before the calendar forces the question.

Design a pilot