Prove a Human Decided

There is a moment in every renovation where the contractor stops, looks at the wiring, and says it is not up to code. Nothing is on fire. The lights work fine. But the paperwork proving a licensed person signed off does not exist, and until it does, nothing else moves.

That is roughly where AI landed this month. Three separate bodies of law, written by people who have almost certainly never been in the same room, arrived at the same requirement within days of each other: a named human has to be accountable for what the machine did, and you have to be able to prove it.

Europe went first, and it set a date

From August 2, 2026, the European Commission's AI Office and national authorities began actually enforcing the AI Act, and Article 50's transparency duties came into force. The rules are refreshingly concrete. A system that interacts directly with people has to tell them they are dealing with AI, unless that is obvious from context. AI-generated or altered content has to carry machine-readable marks. Deepfakes have to be labelled.

New systems must comply from August 2. But the date worth circling is December 2, 2026, which is the deadline for systems that were already on the market before August. Penalties reach €15 million or 3% of worldwide turnover, whichever is higher.

Here is the part most people miss. These duties do not just land on the labs that build the models. They land on deployers, meaning the companies that switched a feature on. The riskiest thing in most stacks right now is not the shiny new agent someone is still testing. It is the support chatbot somebody enabled in March, wrote a happy Slack message about, and never thought about again.

US states drew a fence around therapy

Meanwhile, fourteen to fifteen new state laws regulating AI in health care passed in 2026, and they rhyme with each other in a way that suggests a settled consensus rather than a panic.

Tennessee's SB 1580 bars developers and deployers from advertising or representing that an AI system is qualified to act as a licensed mental or behavioral health professional. Read that again: it regulates the marketing copy, not only the software. Maine's HB 2082 lets licensed mental health professionals use AI solely for administrative functions and limited supplementary purposes, expressly barring it from therapeutic communications, treatment decisions, or independent patient interaction. Delaware's HB 191 prohibits any nonhuman entity from being licensed as a nurse, physician, or PA, or from using those protected titles. New York has introduced comparable legislation.

Notice that none of this closes the market. It fences it. Scheduling, intake, insurance checks, reminders, documentation prep for a human to sign: all still open, and all still where most of the actual pain lives. The law drew a line around the moment of care, not around the clipboard.

Congress wants an incident log

Then the Senate Armed Services Committee advanced an NDAA draft requiring that humans retain ultimate responsibility over all use of lethal force and nuclear weapons deployment by AI systems. Attached to it: mandated Pentagon review and verification of military AI models, privacy impact assessments, and an incident repository to track AI system failures.

A separate bipartisan bill would require that any intentionally lethal use of an autonomous or AI-enabled system be subject to human oversight and approval, and would require commanders to verify AI-generated targets using non-AI sources for five years after enactment.

Strip away the domain and the shape is identical to Europe's marking duty and Tennessee's advertising ban.

Three unrelated regulators, one requirement: prove a human decided, and prove you would notice if the machine were wrong.

The products went the other direction

The awkward part is that the same few weeks made that proof harder to produce.

Meta made Advantage+ automation the default for new campaigns, took Advantage+ Leads global, and shipped AI dubbing, AI-generated music, and persona-based image generation. It also began rewriting the headline text baked into ad images, observed live on July 27. The standalone Automated Ads product is being phased out next year in favor of all this. Salesforce rebuilt Slackbot on August 18 from a notification relay into a full agent that searches across the workspace and acts on what it finds. Enterprise deployment data from the same week put the average organization at roughly 13 agents, up from 5 in early 2025.

So: more systems, generating more content, in more places, with fewer humans looking at any given output before it ships. If an automated system rewrites the words printed on your ad image, you have made a claim you did not write and could not read in advance. That is a scissors motion. Output is going up and provenance is going down, and the regulators just picked the losing blade.

The good news: provenance is shippable

The most quietly encouraging thing in the same news cycle was Google unveiling ScientistOne, a framework for AI-generated research that records citations without hallucinated references. Early tests logged zero fake references across 75 evaluated papers.

That matters far beyond academia, because it demonstrates that verifiable sourcing can be an engineered property of a pipeline rather than a disclaimer at the bottom of the page. You can build systems that structurally cannot make something up. Nobody has to accept "the model said so" as a final answer.

What to actually do about it

If you ship anything with AI in it, the December 2 date is the one to work backwards from, and the work is unglamorous inventory. List every AI touchpoint a customer can reach, including the ones somebody enabled last spring. Confirm each one discloses that it is AI at first contact. Confirm anything synthetic carries machine-readable marking. Then log the boring metadata for every machine recommendation that matters: model version, inputs, confidence, the human who approved or overrode it, the timestamp, and why.

That log is not compliance theater. It is the only artifact that answers the question all three regulators are asking, and it is the same artifact whether the domain is European advertising, American behavioral health, or defense. Build it once and you have an answer ready before anyone asks. Skip it and you will be assembling it under deadline, from memory, about a chatbot nobody remembers turning on.