From Feature Flag to Risk Tier: Auditing AI Capabilities Against the Digital Omnibus on AI
Regulation (EU) 2026/1744, the Digital Omnibus on AI, is the headline. The engineering question is whether you can answer which of your AI capabilities it actually touches. This walkthrough builds that missing layer: verify the legal text first, then inventory AI capabilities as manifests that declare facts, derive the risk tier with a classifier, and fail the build when the declared facts match a prohibited practice. What the post covers: - A table separating confirmed facts from inference in the source item about the Digital Omnibus - Checking the ELI identifier on EUR-Lex and logging the fetch date before citing any article - What counts as an AI capability versus shared infrastructure like a gateway or vector store - Why the manifest never stores riskTier, and why the feature flag is not the compliance control plane - Using the type checker as the inventory completeness check - Prohibited practices as a build failure with no override - Retiring manifests explicitly and running a weekly orphan-flag check in CI This is engineering guidance, not legal advice. Article references are to Regulation (EU) 2024/1689 as the author reads it; claims about the Digital Omnibus are marked unverified. Your counsel decides your obligations; the code makes them executable. Full post: https://hackyjs.com/posts/from-feature-flag-to-risk-tier-auditing-ai-capabilities-against-the-digital-omnibus-on-ai