AI Compliance Readiness: Regulatory Gap Analysis

Date: 2026-07-01 Prepared by: Research (grāmatr-assisted) For: Covington Place Partners — internal advisory use only Status: Draft — not legal advice; not for external distribution without review

Disclaimer

This document is a capability gap analysis, not legal advice. Conformity assessments, compliance certifications, and legal determinations are the province of licensed legal counsel. The honest framing throughout is "designed to support," "maps to," and "evidence-ready for" — never "certified," "compliant," or "guarantees compliance." grāmatr and CPP cannot guarantee regulatory compliance; they can provide tooling and advisory that supports the operational obligations those regulations impose.

Founders referenced: Shea Long & Mike Burns (Covington Place Partners).

How grāmatr Capability States Are Classified

grāmatr capabilities appear in three states throughout this document. The distinction matters for compliance claims:

Claims marked [DEPLOYMENT-UNVERIFIED] indicate where this analysis cannot confirm the live state. Open questions for the grāmatr team are collected at the end of the document.

Live platform identity confirmed: grāmatr v0.27.6 at https://api.gramatr.com/mcp, caller Brian Handrigan (d2293e01), org gramatr, role super_admin. All entity counts from live API calls 2026-07-01.

Part 1 — Regulatory Requirements

1A. EU AI Act — Digital Omnibus Package (as of July 2026)

The EU AI Act (Regulation (EU) 2024/1689) entered into force August 1, 2024. The "Digital Omnibus" simplification package was provisionally agreed May 7, 2026, endorsed by the European Parliament June 16, 2026, and received Council final approval June 29, 2026. Publication in the Official Journal was pending as of this writing — the high-risk deferral dates are legislatively confirmed but not yet formally operative until that publication.

Sources: Council press release, May 7, 2026; Gibson Dunn — Omnibus: Postponed Deadlines and Key Changes; ComplianceHub.wiki — Annex III deferral; ComplianceHub.wiki — Art. 50 and Omnibus; Modulos.ai — Omnibus deadlines fixed; Latham & Watkins — Timeline Relief and Simplification; Latham & Watkins — GPAI Obligations in Force; Dastra — Inside the Omnibus Deal; EU AI Act — Art. 53 text; DLA Piper — Omnibus update

Active Obligations (July 2026)

Deferred Obligations — High-Risk AI Systems (Annex III standalone: Dec 2, 2027; Annex I product-embedded: Aug 2, 2028)

Provider vs. deployer: Providers (build/place on market) carry the heaviest documentation and conformity burden. Deployers (use in their context) carry logging, human oversight, and monitoring duties when they apply a high-risk system outside the provider's specified scope.

1B. Colorado SB 26-189 — Automated Decision-Making Technology Act

Status: SB 24-205 (the original Colorado AI Act) was repealed May 14, 2026, after enforcement was paused by a federal court injunction (April 27, 2026). Its replacement, SB 26-189, was signed by Governor Polis on May 14, 2026 and takes effect January 1, 2027.

Sources: Colorado General Assembly — SB 26-189; Seyfarth Shaw — Colorado Enacts AI Replacement Law; Littler — Colorado Amends AI Law; Hunton — Colorado AI Act Amended; Consumer Finance Monitor — SB 26-189 Unpacked; Monitaur — SB 26-189 Compliance Strategies; TechjackSolutions — What Law Firm Analysis Confirms

Scope definitions:

• ADMT (Automated Decision-Making Technology): Technology that processes personal data and uses computation to generate output — predictions, recommendations, classifications, rankings, scores — used to make, guide, or assist a decision concerning an individual.
• Consequential decision: A decision relating to an individual's access to or eligibility for education, employment, housing, financial/lending services, insurance, healthcare, essential government services, or public benefits.
• Developers: Entities that create or substantially modify covered ADMT.
• Deployers: Entities that use covered ADMT to make consequential decisions.

Obligation Table — Colorado SB 26-189 (Effective January 1, 2027)

Enforcement: AG enforces via Colorado Consumer Protection Act. Violations are deceptive trade practices. 60-day notice + cure opportunity before AG action, until Jan 1, 2030. No private right of action (removed from the original law).

Key scope change vs. SB 24-205: The mandatory risk management program and annual impact assessments are gone. SB 26-189 is a disclosure + consumer-rights framework, not a full governance mandate.

Part 2 — grāmatr Capabilities (Live-Platform Verified)

All LIVE/DEPLOYED claims are based on direct API queries to https://api.gramatr.com/mcp (grāmatr v0.27.6) executed 2026-07-01. IN-REPO claims are based on source code in /home/research3/work/gramatr/. NOTE/ASPIRATIONAL claims are from design docs only.

2A. Capabilities Confirmed LIVE/DEPLOYED

These were verified by querying the live platform and receiving actual records or active definitions.

2B. Capabilities That Are IN-REPO (Code Present, Deployment Unconfirmed)

These are grounded in source code at /home/research3/work/gramatr/ but were not independently confirmed as deployed during this review. The NIST AI RMF alignment statement (dated 2026-06-11) provides the most recent attestation.

2C. Capabilities That Are NOTE/ASPIRATIONAL (Docs Only)

These were not found in the live platform or confirmed in runnable code. They are explicitly named as gaps or roadmap items in grāmatr's own documentation.

Part 3 — Gap-Analysis Matrix

3A. EU AI Act — Current Active Obligations

3B. EU AI Act — High-Risk Obligations (Deferred; Prepare Now)

Not yet legally operative but the December 2027 deadline justifies preparation starting now.

3C. Colorado SB 26-189 (Effective January 1, 2027)

Part 4 — The CPP Opportunity

4A. Framing the Offering

"AI Compliance Readiness" sits at the intersection of CPP's existing AI Governance & Audit advisory product and two urgent market drivers: EU AI Act GPAI and transparency obligations (live now), and Colorado SB 26-189 coming online January 1, 2027 — with a growing list of states in similar territory.

CPP's role: advisory, assessment, and remediation design — the human judgment layer that maps regulatory obligations to a client's specific systems, authors required artifacts (technical documentation, risk management plans, conformity assessment prep), and designs the organizational processes (human oversight programs, incident response, consumer-appeal workflows).

grāmatr's role: the evidence and enforcement substrate — automatically generating the per-turn audit trail, enforcing policy pre-model, tracking model provenance, and surfacing the telemetry a compliance reviewer draws on. Designed to support clients' compliance obligations, not to certify or guarantee them.

The combined offer: CPP tells you what you have to do and authors the required artifacts; grāmatr makes sure your AI systems are leaving the evidentiary trail those artifacts describe, and that your policies are actually enforced (not just documented).

4B. The Three Strongest Wedges

Wedge 1 — EU AI Act Article 12: Automatic Logging (build toward Dec 2027) Art. 12 requires that high-risk AI systems automatically generate event logs over their lifetime — a manual export does not satisfy it. grāmatr's per-turn decision log is confirmed LIVE/DEPLOYED at 23,822+ classification_telemetry records and 22,097 turn records, auto-generated on every classified turn, with soft_delete_cascade immutability preventing backdating. Each record carries turn_id, session_id, project_id, model used, requires_approval score, and the full primitives_composed list showing which policies were active — the structural shape Art. 12 demands. The single remaining gap (retention window confirmation) is a configuration question, not an architecture question. CPP positions this as: "start building your Art. 12-ready log now, before the Dec 2027 deadline."

Wedge 2 — Colorado SB 26-189: Consumer Explanation Right (active Jan 1, 2027) The 30-day adverse-decision explanation requirement is an operational process clients must build before January 1, 2027. grāmatr's live turn records contain the full prompt text and AI-generated summary per decision; the classification_telemetry records contain the model, intent, requires_approval score, and bound policies. Together they are the raw material for a plain-language explanation — but the workflow, template, and consumer intake surface do not yet exist and must be built. CPP's advisory layer designs the workflow; grāmatr supplies the underlying data. Clients deploying ADMT for consequential decisions (lending, employment, healthcare, housing) need both, and the January 2027 deadline creates urgency now.

Wedge 3 — NIST AI RMF as the US Enterprise Anchor Enterprise buyers, insurers, and procurement requirements increasingly treat NIST AI RMF alignment as table-stakes for AI vendor due diligence. grāmatr has a self-attested crosswalk to all four NIST AI RMF functions (GOVERN/MAP/MEASURE/MANAGE) published 2026-06-11, with requires_approval BERT head confirmed live in 23,822 records (GOVERN 3.1–3.2), and the per-turn telemetry system confirmed live with 45,919+ total records across classification_telemetry + turn (MEASURE 2.8 "explain to a regulator in 48h"). CPP can offer NIST AI RMF readiness assessments with grāmatr as the evidence substrate — positioning the combined offering as "compliance-ready by architecture, not just by documentation."

4C. Top Three Build Gaps to Close First

Build Gap 1 — Confirm and extend log retention [DEPLOYMENT-UNVERIFIED → needs grāmatr team answer today] This is the single highest-priority open question. The NIST alignment doc stated "60-day rolling window" as of June 2026. EU AI Act Art. 12 requires ≥6 months; Colorado SB 26-189 requires 3 years. Until the grāmatr team confirms (a) the actual current retention window in production and (b) whether a configurable longer-retention tier exists and is tested, every Art. 12 and SB 26-189 record-retention claim carries a material caveat. Closing it: confirm the live retention policy; if under 6 months, implement a configurable retention configuration with a documented deployment guide and a verified query path for records older than 60 days. No new architecture needed — the soft-delete immutable records already exist; the question is the database retention window.

Scope note (added 2026-07-01): this obligation is scoped, not universal. EU Art. 12 automatic-logging applies ONLY to high-risk (Annex III/I) AI systems; Colorado SB 26-189's 3-year retention applies ONLY to records for consequential-decision ADMT (lending, employment, housing, healthcare, insurance, government benefits). Neither law requires that every grāmatr turn be stored audit-proof. So this is not a platform-wide default change — the correct build is a per-app/org configurable long-retention tier for the compliance-relevant records of a client's regulated deployment, leaving the 60-day working-memory default untouched. For clients not running a high-risk / consequential-decision system, this retention obligation does not bind.

Build Gap 2 — Consumer explanation + appeal workflow (4–6 weeks engineering) Neither the EU Act's deployer transparency obligations nor Colorado SB 26-189's 30-day explanation right can be satisfied by a per-turn log alone. They require a consumer-facing workflow: accept a turn_id or session reference, generate a plain-language explanation from the live turn + classification_telemetry records, and route for human review if the consumer requests appeal. The underlying data is confirmed LIVE/DEPLOYED (23,822 telemetry + 22,097 turn records). The surface does not exist. Closing it: an explanation-generation API endpoint (input: turn_id; output: human-readable explanation citing the underlying records) and a deployer-configurable consumer intake workflow. This is the gap between grāmatr's strongest evidence asset and a consumer-facing compliance deliverable.

Build Gap 3 — AI incident disclosure runbook (1 day documentation + tracked engineering) EU AI Act Art. 73 requires documented 48-hour notification to national authorities after a serious AI system incident. The 27 live runbooks cover security credential incidents (rotate_compromised_credential, respond_to_secret_in_commit_or_log) but none covers AI system behavior incidents. There is no trigger definition (what constitutes a "serious AI incident" for a routing system), no notification template, no regulatory contact structure, no escalation chain for AI-specific failures. Without this, CPP cannot credibly offer incident-response advisory backed by grāmatr infrastructure. Closing it: a documented AI incident response + disclosure runbook as a first-class live runbook (~1 day, overlapping with planned SOC 2 work), followed by anomaly-detection → alert automation (#3698/#3718) to make 48-hour response operationally achievable rather than aspirational.

Open Questions for the grāmatr Team

These items could not be resolved from live platform queries or repo review. They are blocking or materially qualifying compliance claims and should be confirmed before this analysis is used in external advisory work.

1. [HIGH PRIORITY] Log retention window: What is the actual retention window for classification_telemetry and turn entity records in the current production database? Is there a configurable longer-retention deployment option? Can records older than 60 days be queried? This gates every EU AI Act Art. 12 and Colorado SB 26-189 record-retention claim in this document.
2. Directive resolver deployment: Is packages/intelligence/src/services/directive-resolver-unified.ts (the scoped policy hierarchy enforcing system→org→team→project→user directives) currently deployed in the production grāmatr server, and is per-turn policy enforcement via this code path active for all clients?
3. Pattern analyzer deployment: Is packages/intelligence/src/services/pattern-analyzer.ts currently running in production? If so, does it produce output that would constitute post-market monitoring evidence?
4. requires_approval routing behavior: When the requires_approval BERT head fires with label true for a given turn in production, what actually happens? Is there a live human review queue, or is it a classification signal that the calling client must act on?
5. AI literacy documentation: Does grāmatr have any documented staff AI literacy training program covering grāmatr's own operations as a provider (for Art. 4 compliance for grāmatr itself)?

Summary Assessment

"AI compliance readiness + tracking" is a credible CPP offering. The regulatory pressure is real and near-term: GPAI obligations are live now, Art. 50 transparency is active August 2026, high-risk obligations arrive December 2027, and Colorado SB 26-189 takes effect January 1, 2027.

grāmatr's strongest confirmed proof point is the automatic, immutable per-turn audit trail — 23,822 classification_telemetry records + 22,097 turn records confirmed LIVE/DEPLOYED today on the production platform, auto-generated on every classified turn, protected by mandatory soft-delete standards confirmed live. The requires_approval classification head fires on every turn. The user_data_isolation_is_inviolable principle is live and inviolable-strength.

The most-cited gap — log retention — is a scoped configuration problem, not a platform-wide one. It binds only when a client runs a high-risk (EU Art. 12) or consequential-decision (Colorado) system, and even then it concerns a per-app configurable long-retention tier for the compliance-relevant records — not the general 60-day working-memory window. The records exist and are immutable (soft-delete); the open question is the retention/queryability window on the compliance-relevant layer, for regulated deployments only.

The next largest gaps (AI incident disclosure runbook, consumer explanation workflow) are buildable in days to weeks; neither requires architectural changes. CPP's advisory layer is the necessary complement throughout: regulatory obligations require human authors for technical documentation artifacts, organizational design for human oversight processes, and legal review for conformity assessment — none of which grāmatr can substitute for, and all of which CPP is positioned to deliver.

Source Index

Regulatory sources:

• Council of EU — Digital Omnibus political agreement, May 7, 2026
• Gibson Dunn — EU AI Act Omnibus: Postponed Deadlines
• ComplianceHub.wiki — Omnibus Annex III deferral
• ComplianceHub.wiki — Article 50 and Omnibus
• Modulos.ai — Omnibus Deadlines Fixed
• Latham & Watkins — Timeline Relief, Simplification
• Latham & Watkins — GPAI Obligations in Force, Code of Practice
• Dastra — Inside the EU AI Omnibus Deal
• EU AI Act official — Article 53 text
• EU AI Act — Implementation Timeline
• DLA Piper — Omnibus Update
• Inside Privacy — EU AI Act Update
• Colorado General Assembly — SB 26-189
• Seyfarth Shaw — Colorado Enacts AI Replacement Law
• Littler — Colorado Amends AI Law
• Hunton — Colorado AI Act Amended
• Consumer Finance Monitor — SB 26-189 Unpacked
• Monitaur — SB 26-189 Compliance Strategies
• TechjackSolutions — SB 26-189 What Law Firms Confirm
• Aguardic — Colorado AI Act Compliance Guide

grāmatr live-platform evidence (all queries executed 2026-07-01, grāmatr v0.27.6):

• Server identity: gramatr_whoami → https://api.gramatr.com/mcp, v0.27.6
• classification_telemetry: 23,822 records — list_entities (total_count confirmed)
• turn: 22,097 records — list_entities (total_count confirmed)
• audit_log: 24 records — list_entities (total_count confirmed)
• Standards LIVE confirmed via list_definitions: soft_delete_cascade, conversation_observations_immutable, user_id_filter_on_every_query, rls_policy_for_user_scoped_tables, parameterized_queries_only, no_secrets_in_logs, no_hardcoded_credentials, execution_summary_on_every_tool_response
• Principles LIVE confirmed via list_definitions: user_data_isolation_is_inviolable (inviolable), secrets_come_from_secret_manager_only (inviolable), gitops_is_the_only_path_to_production (inviolable)
• Runbooks LIVE confirmed via list_definitions: change_embedding_model, rotate_compromised_credential, respond_to_secret_in_commit_or_log, restore_from_backup, rollback_failed_deploy (27 total runbooks queried)
• Capabilities LIVE confirmed via list_capabilities: all 25, sections A–F

grāmatr in-repo evidence:

• /home/research3/work/gramatr/docs/nist-ai-rmf-alignment-2026-06-11.md
• /home/research3/work/gramatr/docs/design-consistency-model.md
• /home/research3/work/gramatr/docs/gramatr-capability-inventory-2026-05-13.md
• /home/research3/work/gramatr/docs/cpp-gramatr/ai-governance-standards-alignment-2026-06-10.md
• /home/research3/work/gramatr/docs/cpp-gramatr/cpp-engagement-audit-trail-2026-06-10.md