Danai Data Book a discovery call

Blog In the news

EU AI Act high-risk rules delayed to December 2027: why UK firms still need an AI audit trail before the board, the auditor or the regulator asks

Herman Wa · · 3 min read

Illustration

The news. In July 2026 the EU adopted the Digital Omnibus on AI (Regulation (EU) 2026/1744). It moved the AI Act's main high-risk obligations from 2 August 2026 to 2 December 2027, and to 2 August 2028 for AI built into regulated products. The duties themselves did not change, only the dates, and the transparency rules in Article 50 were not delayed.

For UK firms that sell into the EU, or whose AI outputs are used there, the AI Act can still apply. The extra time is time to build the record, not a reason to skip it. And the board and the auditor were never waiting for Brussels.

When people picture an AI agent team, they picture the agents: the debate, the vote, the speed. In practice the most valuable thing a session produces is quieter. It is the minutes.

Decisions get questioned later

Every decision of consequence gets questioned eventually. A board asks why the launch moved. An auditor asks where a figure came from. A client asks why their recommendation changed. A regulator asks who approved a policy.

If your answer is "the AI said so", you have a problem. If your answer is a set of minutes showing the evidence, the objections, the vote and the person who signed off, you have a defence.

What good minutes contain

Every session of a governed agent team should end with:

  • The decision, in one or two plain sentences.
  • Actions with owners: who does what next, including the people.
  • Dissent: every objection, who raised it and the fix proposed. A unanimous vote and a three-to-two vote should never look the same.
  • Sources: the document, dataset or report behind each finding. Uncited claims are marked as opinion.
  • Confidence: how sure the team was, and what would change its mind.
  • Cost: what the session spent in model usage, against the cap set before it started.

Why the log matters as much as the minutes

Minutes can be edited. That is why we pair them with a tamper-evident log. Each entry carries a fingerprint (a hash) of the entry before it, so the entries form a chain. Change one record after the fact and every later fingerprint stops matching, so the edit shows.

This is the same idea that makes financial and safety records trustworthy: not that nobody can change them, but that nobody can change them quietly.

Where this thinking comes from

Our founder spent seventeen years leading sustainability and data reporting in audited environments: FTSE-listed real estate, global tourism and NHS healthcare, with independent assurance year after year. In that world a number without a source does not exist, and a decision without a record did not happen.

We build agent teams the same way, because we have sat on the other side of the table when the auditor asks the question.

Corrections belong in the record too

A good record is not one with no mistakes. It is one where mistakes are visible and corrected openly.

On our own research programme, our agent team once found a wrong assumption in its own earlier debate. The correction went into the minutes with the reason, rather than the old record being quietly rewritten. That one entry did more for our trust in the system than a dozen sessions that went smoothly.

What this means for you

When you evaluate any AI system for decision work, ask three questions:

  1. Can I see the sources behind each finding?
  2. Can I see who, or what, disagreed and why?
  3. Would I know if the record had been changed?

If the answer to any of them is no, the system is giving you answers, not decisions you can defend. With a governed agent team, the answer to all three is yes, by design.

Sources

Read next