Compliance becomes a tool category

Four months to retrofit provenance, an enforceable transparency regime, and a guardrail technique that cannot hold against an adversary. A market is forming in the gap.

Providers whose synthetic-media systems shipped before 2 August have until 2 December to implement machine-readable marking. Everything else applied immediately.

Four months is a build schedule

The work touches the generation pipeline, the output encoding, the storage format and whatever downstream processing the product performs. None of it was designed with a marking layer in mind, and all of it has to keep working.

It also creates a two-tier situation that will persist indefinitely. Content generated before the deadline is unmarked and permanently indistinguishable. The regime marks the future and can do nothing about the archive, which is most of what exists.

The appealing shortcut, and its ceiling

Compiling governance rules directly into agent guardrails as prompts is a genuinely attractive answer. Regulation arrives as natural-language rules, agents are steered by natural-language instructions, and a compliance team can read the result — which is more than can be said for most technical controls.

The limit is structural. A guardrail written as a prompt sits in the same token stream as everything else the model reads, with no privilege boundary between them. It is a strong suggestion competing with whatever arrives later in the context.

That does not make it useless. Most compliance failures are accidents, not attacks, and a strong suggestion catches accidents reliably. It makes it unsuitable as the only control — and the literature is considerably clearer about that distinction than most deployments are.

What the category will actually need

Enforcement outside the model. Tool-layer permissions, network policy, operating-system sandboxing — the boring machinery that assumes the model will eventually be convinced of something and is designed so that being convinced is survivable.

Which is the same conclusion arriving from the security side, where authorization propagation is being framed as infrastructure rather than application. Both are saying the control cannot live in the thing being controlled.

arXiv — Policy-as-prompt: turning AI governance rules into guardrails for AI agents → · Goodwin — Not delayed, not deferred: EU AI Act transparency obligations are now in force → · Help Net Security — Prompt injection still drives most agentic AI security failures in production →