Full research and the plugin → github.com/bcanfield/agentic-tech-debt
On August 2, some AI systems operating in the EU have to start keeping a permanent, queryable record of the decisions they make. Miss it and the fine tops out at 3% of global turnover. Your coding agent isn't one of the systems covered, and once you look at why not, that turns out to be the more useful fact than the deadline.
The EU AI Act's high-risk obligations (Regulation 2024/1689) enter full force that day. Article 12 is the logging requirement: automatic, tamper-evident event records are required for anything classified "high-risk" under Annex III. Annex III lists eight categories: biometrics, critical infrastructure, education, employment decisions, essential services, law enforcement, migration and border control, the justice system. A general-purpose coding assistant doesn't land in any of them unless one is specifically deployed to make, say, hiring decisions. Claude Code, Cursor, Copilot: none of it is in scope.
My first draft of this piece led with "your AI coding agent has three weeks to comply." It's a better headline. It's also wrong, and I only caught it because a fact-check pass sent me to the actual Annex III text instead of the three SEO blogs already running the scarier version with invented statistics bolted on. One cited an "8.1-million-pull-request study" I couldn't find anywhere. Turned out to be GitClear's real 48% duplication figure and CodeRabbit's real 1.7x-more-issues figure, laundered through a site that sells AI-app rescue services and has every incentive to make the sky look like it's falling.
So: no compliance story here, at least not yet. But sit with why the EU decided any AI needed a mandatory paper trail in the first place. It isn't that biometric identification or employment screening feel more futuristic than autocomplete. It's that those systems make consequential calls fast, with a person rubber-stamping output they didn't fully derive, and until now nothing forced them to leave a record anyone could reconstruct after the fact. Article 12 exists because "it seemed right at the time" stopped being an acceptable answer once the decisions got expensive enough. That is, word for word, the argument for logging what a coding agent decides. It's just sitting a few rungs below the threshold a regulator bothered to write down. Amazon CTO Werner Vogels named the coding-agent version of it at his last re:Invent keynote, months before the incidents at his own company made the point for him:
"AI can generate code faster than you can understand it... That gap allows software to move toward production before anyone has truly validated what it actually does."
A coding agent makes dozens of small, unrecorded calls a session, from what I've watched mine do: a default picked because it was fastest, a type loosened to get the build green, a check skipped to hit a deadline. None of it requires a regulator's definition of "high-risk" to matter. Apiiro's audit of Fortune 50 repos found privilege-escalation paths up 322% and architectural design flaws up 153% on AI-assisted code, even as syntax errors fell. Code revised within two weeks of landing, about as close to a real-time debt indicator as the data gets, climbed from 3.1% to 5.7% of all changes in a year, per GitClear. CodeRabbit's read of 470 real pull requests found the AI-touched ones carrying 1.7x more issues than the human-only ones. None of that is a hack or a breach, just the ordinary residue of decisions nobody wrote down.
The New Stack ran a piece less than two weeks ago with a line I keep turning over: "Vibe slop is the symptom. Context debt is the disease." Bad-looking AI output is the thing you can see and complain about. The actual damage is upstream of it: the accumulating pile of unrecorded decisions and shortcuts that neither the agent nor the next engineer can fully reconstruct once the session ends. Slop gets caught in review. Context debt doesn't, because nothing in the diff flags it as a decision at all.
I'd stop short of arguing every one of those small calls deserves its own log line. That's a real risk on the other side of this. A registry entry for literally everything an agent decides is its own kind of debt: a compliance ritual nobody reads, the software equivalent of a cookie banner nobody's ever actually declined a cookie because of. Fowler's debt quadrants exist for exactly this filter. The deliberate-prudent corner, the shortcut you'd defend out loud, is worth a line. The rest is noise, and pretending otherwise buries the entries that matter under the ones that don't.
Here's what that filter looks like when it's not hypothetical. This repo's own debt registry has an entry, 20260626124215-articles-fail-visual-density-gate.md, filed the day the article pipeline's own visual rules changed and every article written before that point stopped clearing its own gate. Quadrant: prudent-deliberate. Payoff trigger: before republishing anything old. It's a plain sentence, written by the same automation that produces these posts, explaining a shortcut it took and the condition under which someone has to come back and fix it. Twenty-two ADRs and a folder of entries like that one are the closest thing this project has to an Article 12 log, and nobody made anyone write it. You're not going to be fined for what your coding agent doesn't record either, not on August 2 and probably not for a while after. That's sort of the point. The audit-trail requirement was only written down after the EU decided certain failures were too expensive to keep happening invisibly. The rest of us still get to make that call ourselves, for our own repos, before a regulator or a Sev-1 makes it for us. I built debt-ops as the smallest version of that call I could ship: an agent hits a "why this way?" moment, it writes one line to a registry before it moves on, the same instinct Article 12 runs on, just applied a few rungs down and without a regulator making anyone do it.
Cover photo by Magic Fan on Unsplash.