The law changes quietly

On 24 July, Regulation (EU) 2026/1744 was published in the Official Journal and took effect three days later. It amends the AI Act. Anyone maintaining a register of binding obligations has had a line in it that is no longer correct ever since.

This is the most inconspicuous case of all. No deadline expires, no authority writes, nothing visible happens. The legal position shifts and the register stays as it was.

It happened to us

We wrote about this amendment on 2 August and assigned one deadline to the wrong provision. The four-month rule for providers of generative AI systems is not in Article 38 of the amending regulation, as we had claimed. Recital 38 merely explains it. The provision itself is the newly added Article 111(4) of the AI Act. Corrected the following day.

Annoying, but instructive. The number was right, the date was right, the level was not. And because we had read the recital rather than the article, we also missed the qualification: the deadline applies only to systems placed on the market before 2 August 2026. Anyone offering one after that date does not have it at all. A register that merely says "AI Act" cannot even represent that difference.

The name of a law is not an obligation

ISO 27001 and most management systems require a register of binding obligations. In practice this is often a table of statute names, a "relevant yes/no" column and a date when somebody last looked. That gets you through an audit and not much further.

The legal register therefore maintains not the statute but the individual obligation at clause level, with a relevance assessment, an owner and a review cycle, linked through the OSCAL catalogs to the controls in the ISMS. The difference becomes visible precisely when something changes: a deferred deadline hits an obligation, not a law.

How you know something changed

There is a source watcher for the legal sources. For EU law it queries the SPARQL endpoint of the EU Publications Office for the most recent consolidated version. The trick lies in the numbering itself: the consolidated CELEX carries the status date as a suffix, so 32016R0679 becomes 02016R0679-20160504. That makes it sortable lexicographically, and a change in the highest value means a new version. For German federal law the observation runs via gesetze-im-internet.de.

The permitted addresses are hard-coded and deliberately not configurable. The tool talks to official publication bodies and to nobody else. A register that fetches its sources from arbitrary servers would be a neat way to have content slipped to you.

The machine reports, it does not change

The obvious move would be to apply the new version straight away. We do not. The watcher detects that something has changed and raises a notification. What the change means in substance is decided by a person and maintained editorially. The reason is the same as for the mistake above: between "a new version exists" and "this obligation has shifted in this specific way" lies an act of interpretation, and sorting document numbers cannot perform it.

One rule about notifications looks like noise at first and is not: entries assessed as "not applicable" are notified too. Because a new version can overturn exactly that assessment. The AI Act is the current example. Anyone who breathed out when the high-risk obligations were deferred is still covered by the transparency duties.

What does not apply, and what is unknown

Whether a norm applies to an organisation at all is checked by a rule-based comparison against its compliance profile: sector, headcount, revenue class, federal state, set flags such as operator of critical infrastructure. Explicitly without AI, because the result has to be traceable and the rules consist of thresholds anyway.

More important than the rules is how gaps are handled. If the profile lacks a value a rule needs, the result is "unknown" and not "does not apply". A missing entry must never be read as an all-clear. And every rule has to carry a justification that cites facts and thresholds instead of judging. That is not a formality: software that assesses legal consequences rather than displaying criteria would be practising law.

More on the legal register module page. The amendment we tripped over was covered here on 2 August, by now with the correct provision.