The EU AI Act deadline is not a legal problem. It is an architecture problem

⚖️ The EU AI Act deadline is not a legal problem. It is an architecture problem.

The Code of Practice for general-purpose AI is out, obligations start applying on 2 August, and the industry response has been telling — OpenAI and Mistral signalling they'll sign, Meta publicly refusing, and most enterprises quietly forwarding the whole thing to their legal teams.

I think that last move is the mistake.

In every enterprise AI programme I've seen, compliance handled as a legal review at the end behaves like a tax: it slows releases, frustrates teams, and produces documentation nobody reads. Compliance handled as an architecture constraint at the start behaves very differently — it becomes a design input, like latency or cost.

What that looks like in practice:

Risk classification decided when a use case is scoped, not when it ships
Data boundaries, DLP and PII protection designed into the retrieval layer, not audited afterwards
Source-cited outputs and human-review gates as default patterns, so auditability is a property of the system, not a report about it
A living inventory of models and use cases, because you cannot classify what you have not catalogued

The uncomfortable truth for leaders: if your AI estate needs a six-month remediation project to answer "which of our systems are high-risk," the Act is not your problem. Your architecture is. The regulation just made it visible.

The organisations treating August as a fire drill will do this again for every jurisdiction that follows. The ones treating it as a forcing function to build governance into the platform will comply once — and then compete on it.

Where does compliance sit in your organisation today — with legal, or with architecture? I'd genuinely like to know how others are structuring this.

Reading: https://digital-strategy.ec.europa.eu/en/policies/contents-code-gpai