CH 1 · CHALLENGE OF THE AGES 7
the architectural commitments the regulations describe already in hand. They treat
the regulator's expectations not as a brake but as a blueprint. They recognize
that the architecture which satisfies the U.S. FDA and the EU AI Act simultane-
ously is the same architecture that produces the highest-quality outputs, the
cleanest audit trails, the most efficient post-market surveillance, and ultimately
the most trusted product. Compliance and capability are not in tension here.
They are the same thing, viewed from two angles.
The companies that will lose are the ones that buy the platform first and ask the
architectural questions afterwards. They will discover, eighteen months in, that
the grounding their AI outputs need was never citation-bound, the override
events that needed first-class capture were never recorded, the adaptation en-
velopes the regulations require were never authored, and the validator-agents
that were supposed to qualify the work were never qualified themselves. They
will be told by their auditors that the entire deployment is unfit for regulated
use. They will have to choose between rebuilding from underneath or remov-
ing the AI from the workflow it has now become indispensable to. Neither is a
happy quarter.
The window for getting this right is not a decade. The major regulatory mile-
stones are now.
Quality Management System Regulation (QMSR) — United States
effective February 2, 2026, the amended and retitled U.S. 21 CFR Part 820,
now incorporating ISO 13485:2016 by reference.
EU AI Act — European Union high-risk obligations currently applicable
August 2, 2026, with a provisionally agreed amendment (the Digital
Omnibus on AI) expected to defer them to December 2, 2027 (Annex III
standalone) and August 2, 2028 (Annex I embedded in regulated products)
transparency obligations from August 2, 2026.
Predetermined Change Control Plan (PCCP) — United States, FDA
guidance final guidance already issued.
U.S. FDA AI/ML Lifecycle — United States, FDA draft guidance expected to
finalize in the Center for Devices and Radiological Health (CDRH) FY2026
queue.
ISO/IEC 42001:2023 — international standard, Information technology —
Artificial intelligence — Management system already published.
prEN 18286 — draft European standard finalizing through 2026.
Every regulated vertical has its own parallel calendar the urgency is the same.
By the end of this calendar year, the regulatory architecture will be substan-
the architectural commitments the regulations describe already in hand. They treat
the regulator's expectations not as a brake but as a blueprint. They recognize
that the architecture which satisfies the U.S. FDA and the EU AI Act simultane-
ously is the same architecture that produces the highest-quality outputs, the
cleanest audit trails, the most efficient post-market surveillance, and ultimately
the most trusted product. Compliance and capability are not in tension here.
They are the same thing, viewed from two angles.
The companies that will lose are the ones that buy the platform first and ask the
architectural questions afterwards. They will discover, eighteen months in, that
the grounding their AI outputs need was never citation-bound, the override
events that needed first-class capture were never recorded, the adaptation en-
velopes the regulations require were never authored, and the validator-agents
that were supposed to qualify the work were never qualified themselves. They
will be told by their auditors that the entire deployment is unfit for regulated
use. They will have to choose between rebuilding from underneath or remov-
ing the AI from the workflow it has now become indispensable to. Neither is a
happy quarter.
The window for getting this right is not a decade. The major regulatory mile-
stones are now.
Quality Management System Regulation (QMSR) — United States
effective February 2, 2026, the amended and retitled U.S. 21 CFR Part 820,
now incorporating ISO 13485:2016 by reference.
EU AI Act — European Union high-risk obligations currently applicable
August 2, 2026, with a provisionally agreed amendment (the Digital
Omnibus on AI) expected to defer them to December 2, 2027 (Annex III
standalone) and August 2, 2028 (Annex I embedded in regulated products)
transparency obligations from August 2, 2026.
Predetermined Change Control Plan (PCCP) — United States, FDA
guidance final guidance already issued.
U.S. FDA AI/ML Lifecycle — United States, FDA draft guidance expected to
finalize in the Center for Devices and Radiological Health (CDRH) FY2026
queue.
ISO/IEC 42001:2023 — international standard, Information technology —
Artificial intelligence — Management system already published.
prEN 18286 — draft European standard finalizing through 2026.
Every regulated vertical has its own parallel calendar the urgency is the same.
By the end of this calendar year, the regulatory architecture will be substan-