Field notes, week of June 7, 2026

Three pieces this week. Each one answers a standing objection to a signed runtime record. It is too slow to sit in the path. No one required us to produce it. A signature proves nothing.

Latency, contract, identity. The record only counts as evidence when all three answers hold at once.

This week.

Sixty-One Microseconds (June 1). In-flight governance has one standing objection. A governor that fires before the next inference sits in the decision path, and every decision waits for it. We built the runtime and measured it. Sixty-one microseconds at the mean, eighty-three at the ninety-fifth percentile, across thirty thousand governed decisions. The same governor in a second language signs a byte-identical record. That is the answer to the latency objection.

The Procurement Clause (June 3). SR 26-2 carved agentic AI out of scope and pointed institutions back at their own risk practices, written for a model you buy once. An agent run is a service you rent, and the record lives wherever the vendor decides. The control moved to the contract, and the buyer has leverage exactly once. Before signature.

Who Signs the Run (June 5). Every piece in this series ends at the same place. The record gets signed. A signature attests to an identity, and the identity is the part nobody has specified. Identity-governance for agents answers whether the agent may act, not which agent did. A trajectory signed with one shared platform key proves the platform emitted bytes. It does not prove which agent, which version, under which policy.

What changed.

The EU Digital Omnibus is moving from agreement to law. The Council and Parliament reached provisional agreement on May 7 on the package that streamlines the AI Act. The change takes legal effect only on formal adoption and publication in the Official Journal, expected before August 2, 2026. The high-risk deadlines shift toward December 2, 2027 for stand-alone Annex III systems and August 2, 2028 for AI embedded in regulated products. The runway is longer. The evidence the obligation asks for is the same.

SR 26-2 still carves generative and agentic AI out of scope. No new movement in the last seven days. The agencies have signaled a forthcoming interagency RFI that addresses AI, generative AI, and agentic AI directly, and the carve-out points institutions back at their existing risk practices in the meantime. That is the gap, stated in the guidance itself.

The NAIC AI Systems Evaluation Tool pilot runs January through September across twelve states. The tool is expected to be adopted at the Fall National Meeting on pilot feedback. The state insurance examiner is still on track to move before the federal banking examiner does.

What we are tracking.

The agent identity question. A signed record is only evidence if a stranger can verify which agent stood behind the signature. Identity-governance launches are answering authorization, not attribution. The two get conflated, and the gap stays open until someone names attribution as a separate requirement.

The Omnibus adoption window. Provisional agreement is not law. The text takes effect on publication in the Official Journal, and the date that publication lands is the date the revised timeline becomes real. Until then the old deadlines remain the ones on the books.

The cost basis for in-path governance. Once the latency number is on the table, the objection shifts from whether you can afford to govern in the path to what it costs not to. The reconstruction bill for a run that was never recorded is the other side of that ledger.