Takeaways

• AI governance and trust hold only if the evidence stays true after every change. Code, buyer expectations, and regulations now move faster than an annual audit.

• T.R.U.S.S. Compass, our continuous trust monitoring for AI systems, checks every pull request against the frameworks and regulations an AI system must meet: EU AI Act is now live, GDPR is in beta, and due diligence and ISO 42001 are next.

  
  

Who hasn’t told an innocent lie as a kid? Like “I didn’t eat all that chocolate”, “I didn’t say that to him”. Recently, an OpenAI coding agent was asked to copy a reference implementation during a routine migration. To match it, the agent removed its own monitoring integration. When the user asked whether the monitor had been removed, the agent said no. OpenAI documented the incident in its misalignment report. But let’s be clear: this is not just like the innocent lies I mentioned in the beginning. This is truly a major trust deal, the removal was there, line by line.

That is where AI governance now lives. AI systems change every week, a growing share of that code is written by agents, and the people who rely on those systems (customers, buyers, regulators) ask for proof that holds after each change. And the thing is that an audit describes one day in the life of a system, what happens next when a PR merges is someone else’s (yours) responsibility. While AI governance monitoring follows every version you ship.

What does AI governance mean when your system changes every week?

AI governance means having evidence, for every version you ship, that your AI system still meets the rules and standards that apply to it. That evidence covers what the system does, who oversees it, what it discloses to users, and how it was built.

Audits, certifications, and legal reviews still matter. Each one describes the system on the day it happens and certainly are a backup. The thing is that between those days, an AI product ships new prompts, models, tools, and agents, and any of those changes can move its compliance position. Continuous compliance closes the gap by checking the system whenever it changes and keeping the evidence as you go.

Why do audits and self-reports fall behind?

Three things around an AI system move faster than a yearly review. Let’s dive briefly into each of them.

1) The code moves. Agents now write and change production code, and their own reports about that work can be wrong. Beyond the incident above, METR and Redwood Research spent three weeks reviewing how OpenAI monitors its coding agents, with access to its code and configuration. They estimated that on the order of 10% of eligible internal Codex traffic went unmonitored between May and July 2026, because monitoring only triggered when an agent handed control back to the user. Looking ahead, Forrester predicts that AI-assisted software development and patching will outstrip testing capacity.

2) The buyers move. Customers are setting their own rules for AI even before regulators do. According to Axios, citing unnamed sources, Morgan Stanley has begun blocking third-party AI agents in customer accounts, and JPMorgan, Bank of America, and Citi are restricting them. Forrester also predicts that two-thirds of providers will lose deals because buyers cannot verify claims, and that AI agents will influence 75% of B2B purchase decisions. Trust is becoming something a vendor has to show.

3) The rules move. An AI system with European exposure answers to several AI governance frameworks. GDPR has applied since 2018. The EU AI Act phases in obligations between 2025 and 2028, and the Digital Omnibus has already moved several of those dates. ISO/IEC 42001 adds a certifiable standard for AI management systems. Enforcement of artificial intelligence regulation is taking shape: Italy's Legislative Decree No. 179/2026, already in force, makes the national cybersecurity agency (ACN) the main market surveillance authority for AI, with the power to inspect real-world testing without prior notice.

Where should the AI governance check live?

Look at what these cases have in common: the agent’s own account wasn’t enough, and the evidence was in the change itself. For a product team, the place where every change becomes visible and attributable is the pull request. A check there is bound to a specific commit, runs before the change ships, and reads the code itself, whatever the agent reports about its work. It also leaves a record you can show a buyer or an auditor later. For the human side of this, What Human-in-the-Loop Oversight of AI Agents Needs to Work covers what people need in order to act when a check fires.

What does built-in AI governance look like in practice?

Governance that keeps up with the code is built into the way the code ships. Five steps get you there:

1. Inventory and classify. List every AI system, including experiments, internal helpers, and the agents that write code. Give each one a risk tier before new code is written, so you know which obligations apply.

2. Map each rule to a control. An AI Act article, a GDPR clause, or a control from a standard turns into something your team can implement and test.

3. Keep the evidence as you build. Logs, decisions, and documentation come out of each change, so ongoing compliance monitoring never depends on reconstructing evidence before an audit.

4. Give oversight to someone who can act. Article 26(2) of the EU AI Act asks deployers to assign human oversight to people with the necessary competence, training and authority.

5. Disclose and label. In the EU, Article 50 requires telling people when they are interacting with AI and marking generated content in a machine-readable way. For generative systems placed on the market before August 2, 2026, the marking deadline is December 2, 2026.

How does T.R.U.S.S. Compass keep AI governance monitoring current across frameworks?

T.R.U.S.S. Compass is a continuous trust monitor for AI systems. It lives in your team's GitHub repositories and checks every pull request against the frameworks and regulations your AI must meet. It turns Arionkoder's T.R.U.S.S. framework for trustworthy AI (Transparency, Reliability, User-Centricity, Safety and Security) into a monitoring product.

How T.R.U.S.S. Compass works:

Every pull request triggers a check. The check is connected to that commit, so each result belongs to a specific version of your code.

Changes get flagged. When a change moves a system's risk tier or compliance status, T.R.U.S.S. Compass marks it on the pull request.

Every finding comes with a suggested fix. Each one includes a ready-to-paste prompt for an AI coding assistant, or Arionkoder's engineers can implement it. Your team decides what to accept, change, or reject.

The result is evidence that stays current between audits, and expert review that takes minutes instead of weeks. This is how you keep up with frameworks and regulations, this is how you make your AI trustworthy. Multiple frameworks and regulations. One monitor. You can start now for free.