The law shipped first

There is a category of bug no test suite catches: the world changes the rules while your code stays the same. On August 2, 2026, the European Union's AI Act began requiring that synthetic audio be disclosed as artificially generated. On August 19, I gave every post on this site an AI narration — a synthetic voice reading roughly three hours of my writing — and labeled it nowhere. The builds were green. The tests were green. Seventeen days into the new rules, my most audible feature was my least compliant one.

Nothing bad happened, and that is the uncomfortable part. No linter knows about the AI Act. No deploy pipeline asks whether your new feature is legal this month. Compliance fails silently, which for an engineer is the worst possible property: the feedback arrives years later, from a lawyer, instead of seconds later, from a test.

So I did what the incident deserved: read the actual rules instead of the headlines about them. A caveat before any of it — I am not a lawyer and none of this is legal advice; what follows is an engineer's reading, kept with citations and confidence grades precisely because I might be wrong. That said, the picture was narrower and stranger than the coverage suggests. The EU's transparency article covers synthetic audio, and AI-written text when it informs the public, with a carve-out for text a human edited and takes responsibility for — and whether a personal engineering blog even counts as informing the public is a scoping question I chose not to gamble on, because labeling everything makes it moot. The FTC's endorsement guidance points the same direction: undisclosed AI in promotional content risks being deceptive, and fabricated reviews are barred outright however they are labeled. Steam and Google Play both demand disclosure of AI content players and users actually experience. And the scariest-sounding law of all — California's AI Transparency Act — reads, on my parsing of the bill text, as binding million-user AI providers rather than the people deploying their models. Half the headlines bind OpenAI, not me. The other half bind me precisely where I was quietest.

Then comes the design problem that makes this worth writing about: a compliance tool has a rot problem. Whatever I encode today will be wrong within a year, because the law will change underneath it. The answer is the oldest trick in software — separate what changes from what does not. The rulebook is one file: every rule dated, cited to its source, graded by how much I trust the citation, and changeable only by a human decision, never by the tool itself. The auditor is another file entirely, and it never edits its own laws.

The auditor asks only questions with yes-or-no answers. Does the disclosure page exist. Does the audio player say the voice is synthetic. Does each narration file carry a machine-readable AI mark in its metadata. Does each AI-touched item wear its badge. Boring checks, deliberately — a compliance check you can argue with is a compliance check you will eventually lose an argument with.

The first run against this site was a clean sweep of failure. Every narration file was unmarked. No label anywhere named the voice as synthetic. There was no disclosure page, no badges, nothing a visitor or a regulator could point to. Fifty-four of the findings were blocking — the kind the auditor now refuses to let deploy.

The fix pass touched every surface. Each post now wears badges naming exactly what AI made — the narration is a synthetic voice, the text is AI-assisted and human-approved. The player says so next to the play button. Every audio file carries the disclosure inside itself, as metadata, so the marking survives the file being downloaded and shared. A sitewide page explains the whole posture in plain words, linked from the footer.

The second property taught me the best lesson of the exercise. My guild's site needed only a statement page — its content is written by humans — so I added one and deployed. The page came back behind the login wall. A disclosure behind a login is not a disclosure. The auditor now checks that the route is public, because I got it wrong once and never want to depend on remembering that.

The part I expect to matter most in five years is the smallest file: a ledger, one compressed line per AI-touched artifact — what it is, what made it, what disclosure it got, and which version of the rulebook was in force when it shipped. Fifty-three lines, about seven kilobytes. When a rule changes, the rulebook's version number ticks up, and one command lists every artifact stamped under the old version. The question every compliance change actually asks — what did I already ship that this affects — stops being a memory exercise and becomes a query.

The last piece is the trigger. A hook watches the content files across my properties, and any write to them surfaces a reminder to run the audit before deploying; the audits themselves gate the deploys. The failure mode this whole system exists for is the exact one I already committed: shipping the feature without ever being asked the question.

My honest read — an engineer's, not a lawyer's — is that a one-person portfolio's real exposure is small. But the stronger reason has nothing to do with fear. This site's whole argument is that AI-heavy work can be done with receipts — measured, verified, disclosed. Receipts about the AI itself are the least optional kind. Over-disclosure costs a badge; under-disclosure costs credibility exactly where I can least afford it.

The badges under this post's title say an AI voice reads it and an AI helped draft it. Both are true, and both were placed by the system this post describes. The law shipped first. The auditor makes sure that is the last time it laps me.