The EU AI Act's high-risk obligations hit full enforcement on August 2, 2026. Article 12 wants a queryable record of every AI-driven decision — including whether each governance intervention was a hard gate or a soft gate.
Here's the part I keep seeing teams miss: most agent deployments produce neither.
They log prompts and completions. That's a record of what the agent said — intent and response. It is not a record of what governance was applied at the moment the agent tried to act. And if your governance layer is a separate observer reading logs after the fact, you're already out of compliance for high-risk systems, because you can't prove the policy was enforced at execution time — only that you noticed something afterward.
So the real requirement isn't "keep better logs." It's this: enforcement and audit have to be the same action. The moment your governance layer checks an agent's proposed tool-call against a policy is the moment the audit record gets created — not reconstructed later from scattered logs.
I've spent the last stretch building exactly this, and I want to share the shape of it — partly because I think the architecture is the interesting part, and partly because I'd genuinely rather pressure-test it against people dealing with this than keep building in a vacuum.
