Tech policy analysis: AI regulation, data privacy laws, antitrust enforcement, digital governance, and legislative updates affecting technology companies and professionals globally.
Compliance-as-Code: How Developers Meet the EU AI Act
Policies / Developer Focus
Compliance-as-Code: How Developers Meet the EU AI Act
By the NeuralWired Staff · Updated July 24, 2026 · 9 min read
A developer at a mid-size fintech company got a Slack message on a Tuesday: legal needed to know, by Friday, whether the new fraud-detection model complied with the EU AI Act. The honest answer was nobody knew, because the compliance policy lived in a PDF last opened eight months earlier. That gap, between a static document and a system that changes every sprint, is exactly what AI compliance as code is built to close.
Engineering teams are no longer waiting for legal to translate regulation into requirements after the fact. They’re writing the rules directly into the pipeline, as version-controlled policy files that run automatically on every pull request, every build, every deploy, and that can stop a release cold if something violates the rule. This is compliance-as-code, and it’s moving from a niche DevSecOps practice into the default way teams handle AI governance in 2026.
Here’s the uncomfortable number that should be driving this conversation more than any regulation: according to Vanta data reported in July 2026, roughly 70% of companies now have shadow AI somewhere in their environment, meaning AI tools with access to company data that were never vetted or approved. Shadow IT overall grew 36% year over year, and organizations discovered an average of about 140 unapproved tools within 90 days of scanning their environment. Only 2% of shadow IT vendors ever go through a security review at all. (Source: KESQ/Stacker, July 22, 2026)
A quarterly compliance review can’t see any of that. It’s a snapshot of a system that’s already moved on by the time the report gets written. That mismatch, static review versus continuously changing systems, is the actual argument for compliance-as-code. It’s not a regulatory checkbox exercise. It’s the only way to see what’s happening in real time.
The core shift: Compliance moves from something legal owns and checks once a quarter, to something the platform team owns and enforces on every single change, the same way failing unit tests block a merge today.
What Compliance-as-Code Actually Means
Strip away the buzzwords and the practice is simple. Instead of a written policy document that a human is supposed to remember to consult, the rule gets written in a machine-readable, declarative language, most commonly Rego, HashiCorp Sentinel, YAML, or CEL, and that rule gets checked automatically at defined points in the software lifecycle: a pull request, a CI build, a Terraform plan, a Kubernetes admission event, or an AI agent’s proposed action.
If the rule is violated, the pipeline fails. Not a warning. Not a note for someone to review later. The build stops.
For AI-specific obligations, some teams are now storing a single compliance.yaml file at the root of the model repository that auto-generates the technical documentation regulators expect under the EU AI Act’s Article 11 and Article 12 record-keeping requirements. That’s a practitioner pattern worth watching, not yet an industry standard, so treat it as an emerging convention rather than something auditors will universally recognize.
A simple example
A policy blocking a high-risk model from deploying without a documented human-oversight mechanism might look something like this in Rego:
package ai.deployment
deny[msg] {
input.model.risk_tier == “high”
not input.model.human_oversight_documented
msg := “High-risk model missing required human oversight documentation”
}
That’s it. No PDF. No email chain. The pipeline reads it, checks it, and either lets the deploy through or doesn’t.
The EU AI Act Deadline Forcing the Shift
The EU AI Act isn’t a distant threat anymore. Its prohibited-practices provisions have been enforceable since February 2, 2025. General-purpose AI model obligations kicked in on August 2, 2025 for new models. And the next major wave, obligations for high-risk systems, has a baseline date of August 2, 2026, with the EU’s Digital Omnibus proposal actively negotiating whether some sub-provisions shift into a 2027 window. The trilogue process on that shift is still active as of mid-2026, so treat “full compliance by August 2026” as directionally accurate but not settled in every detail. (Source: Holland & Knight, April 28, 2026)
Penalties for prohibited practices reach €35 million or 7% of global annual turnover, whichever is higher. And critically, this isn’t an EU-companies-only problem. Any provider, deployer, importer, or distributor whose system touches EU residents is in scope, regardless of where the company is headquartered. If your app has European users, this applies to you.
U.S. state law is moving just as fast, if less dramatically. Colorado’s original AI Act was frozen by a federal court and then repealed after litigation from Elon Musk’s xAI, replaced by SB 26-189, which sets new employer obligations. NeuralWired covered what that means for employers here. The pattern across jurisdictions is the same: rules that shift faster than any static document can track.
Inside the Stack: OPA, Gatekeeper, and the Tooling
The engine underneath most of this is Open Policy Agent, or OPA, a Cloud Native Computing Foundation graduated project, meaning it’s cleared the foundation’s highest maturity bar. OPA policies are version-controlled and reviewed through the same Git workflows developers already use for application code, which is precisely why adoption has been so fast: there’s no new mental model to learn. (Source: Wiz Academy)
According to a DevOpsTales analysis citing Snyk’s State of DevSecOps report and the SANS DevSecOps Survey, policy as code now has 71% overall enterprise adoption as a practice, with OPA specifically cited by 68% of enterprises as the leading tool. That’s not a niche technique anymore. It’s the default. (Source: DevOpsTales, Sept 2025)
Gatekeeper, the Kubernetes-native project that extends OPA, keeps shipping too, which matters because it shows this tooling is still actively maturing rather than sitting still. Gatekeeper reached general availability for CEL-based validating admission policies in version 3.18, management for those policies went to beta in 3.20, and in version 3.22 (February 2026) a scoped enforcement feature was enabled by default. (Source: Spacelift)
Quick comparison
Tool
Best for
Maturity signal
Open Policy Agent (OPA)
General-purpose policy across infra, APIs, CI/CD
CNCF graduated; 68% cited enterprise adoption
Gatekeeper
Kubernetes admission control
~4,200 GitHub stars; CEL-based policies GA in v3.18
HashiCorp Sentinel
Terraform plan enforcement
Embedded natively in Terraform Cloud/Enterprise
GitHub stars are one adoption signal among several, not a definitive market-share measure.
The Cost of Getting This Wrong
Gartner estimates global spend on AI governance platforms will reach $492 million in 2026, and cross $1 billion by 2030. Organizations that actually use these platforms are 3.4 times more likely to achieve high effectiveness in AI governance than those that don’t. (Source: Gartner, Feb 17, 2026)
The market’s growth also earned Gartner’s first-ever Magic Quadrant for AI Governance Platforms, published June 16, 2026, a formal signal that analysts now treat this as its own distinct category rather than a subset of general GRC tooling. (Source: Credo AI, citing Gartner)
On the downside-risk ledger, non-compliance carries costs well beyond the headline fine. Elevate Consult’s compiled 2026 analysis puts customer trust and revenue loss at 15% to 30% of affected revenue streams, legal costs between £500,000 and £5 million, operational disruption lasting three to twelve months, and insurance premium increases of 25% to 50%. (Source: Elevate Consult, May 28, 2026)
“Enterprises are treating AI agent governance as binary, either locked down or fully trusted, and that is the root cause of failure.”
— Shiva Varma, Senior Director Analyst, Gartner
Varma’s team backs that up with a genuinely striking prediction: by 2027, Gartner expects 40% of enterprises to demote or decommission autonomous AI agents entirely, because governance gaps only surface after something has already gone wrong in production. (Source: Gartner, May 26, 2026) NeuralWired’s earlier reporting on why 70% of AI agent deployments fail lines up with that pattern almost exactly.
“Cybersecurity leaders must identify both sanctioned and unsanctioned AI agents, enforce robust controls for each, and develop incident response playbooks to address potential risks.”
— Alex Michaels, Director Analyst, Gartner
And the human bottleneck driving all of this toward automation has a number attached too: 61% of compliance teams report regulatory complexity and resource fatigue, according to Amanda Carty, General Manager of Compliance Solutions at Diligent (a vendor in this space, worth noting as you weigh her framing). (Source: Governance Intelligence)
Automated Doesn’t Mean Correct
Here’s the pushback worth sitting with: a green checkmark from an automated policy check is not automatically more trustworthy than a signed PDF, if nobody is independently reviewing the logic of the policy itself.
Compliance-as-code inherits every known failure mode of static analysis tooling. A study of financial-services engineers found that out of 200 initial security alerts, only about 40 turned out to be legitimate, and developers reported spending roughly 5% of their working time just triaging false positives. Applied to AI compliance specifically, this cuts both ways: a rule written too strictly blocks legitimate model updates, and a rule written too loosely creates exactly the false assurance a checkbox audit already gave everyone. (Source: arXiv, Secure Software Engineering in Financial Services)
There’s also a structural incentive problem, not just a technical one. Research on third-party AI safety-framework reviews found that auditors face real pressure, client retention, and conflicts of interest when the same firm sells consulting alongside auditing, that can produce compliance results which look clean but aren’t. The same logic applies the moment an internally-written Rego policy becomes the artifact regulators or customers are asked to trust. (Source: arXiv 2505.01643)
Separately, even mature tooling doesn’t fix a leadership problem. BlackFog’s 2026 survey found 69% of C-suite executives are effectively tolerating unsanctioned AI tool use, prioritizing speed over governance.
“The efficiency gains and personnel cost savings are too large to ignore, and override any security concerns.”
— Darren Williams, Founder and CEO, BlackFog
Our read: a CI gate that leadership can override whenever a launch is at risk isn’t really a gate. The technical fix and the incentive fix have to land together, or the pipeline just becomes a slower version of the PDF nobody read.
One more voice worth including here, because it reframes the problem usefully for the developer audience specifically:
“Put yourself in the shoes of a software developer: you have a question and your organization hasn’t put in place the tools to answer that question. Instead, you use your phone to browse an unapproved GenAI website and get your question answered promptly.”
— Doug Ross, CTO and GenAI Lead, Capgemini
In other words, shadow AI usually isn’t a discipline failure by developers. It’s a tooling gap left open by employers. Compliance-as-code is only a real fix if it also gives developers a faster, sanctioned path to the answer they need, not just a faster way to say no.
What to Do This Quarter
The tools here are not the hard part. OPA, Conftest, Gatekeeper, and Kyverno are open-source, mature, and free. The actual lift is organizational.
Decide who owns policy authorship. Security, platform, or legal-translated-by-platform. Ambiguity here is the single biggest reason compliance-as-code initiatives stall.
Turn logging into blocking. A policy that only logs a violation isn’t compliance-as-code. It’s a slightly fancier audit trail. The gate has to actually fail the build.
Tier your AI agents by autonomy, not by a single locked-or-trusted switch. Gartner’s own data points to this as the difference between governance that works and governance that fails in production.
Build the audit trail once, reuse it everywhere. Teams writing policy-as-code now are finding it satisfies SOC 2, ISO 42001, and GDPR evidence requirements at the same time as the EU AI Act, a genuine “test once, satisfy many” pattern.
Reality check on timing: Ranking on page one of Google within two to three days through on-page content alone isn’t something any legitimate SEO practice can guarantee, no matter how well a piece is optimized. What is realistic in that window is getting cited inside AI Overviews and answer engines like ChatGPT, Perplexity, and Gemini, because those systems pull from freshly published, clearly sourced, well-structured content much faster than traditional organic rankings move. That’s the actual near-term win this piece is built for.
FAQ
What is compliance as code?
Compliance as code is the practice of writing regulatory and security requirements as executable, version-controlled policy files that run automatically in CI/CD pipelines, blocking non-compliant deployments before they reach production instead of flagging them after the fact.
What is policy as code?
Policy as code means defining organizational, security, or compliance rules in a declarative language like Rego, then enforcing them automatically across infrastructure, applications, and CI/CD workflows, replacing manual policy review with automated, testable checks.
When does the EU AI Act take full effect?
Most remaining provisions, including high-risk system obligations, carry a baseline date of August 2, 2026, though the Digital Omnibus proposal is actively negotiating moving some sub-provisions to 2027. Prohibited practices have been banned since February 2, 2025.
What is Open Policy Agent used for?
Open Policy Agent is an open-source, CNCF-graduated policy engine that lets teams enforce rules across Kubernetes admission control, Terraform plans, APIs, and CI/CD pipelines, using a Git-based workflow so policies get reviewed and tested like application code.
How much does non-compliance with AI regulation cost?
Non-compliance can trigger EU AI Act fines up to €35 million or 7% of global annual turnover, plus indirect costs including 15% to 30% customer trust and revenue loss, legal costs of £500,000 to £5 million, and insurance premium increases of 25% to 50%.
What is shadow AI?
Shadow AI refers to AI tools employees use at work without formal IT or security approval. As of mid-2026, Vanta data shows roughly 70% of companies have some shadow AI present in their environment, most of it never vetted or reviewed.
Where This Goes Next
What changes here isn’t just how audits get done. It’s who owns compliance day to day. That ownership is shifting from legal, working off a document nobody updates, to platform engineers, working off a policy file that runs on every single commit. Developers will start encountering Rego and OPA failures in CI the same way they already encounter a failing unit test today, not as a special event, just as part of the job.
Watch three things over the next six to eighteen months: whether the EU’s Digital Omnibus trilogue actually pushes high-risk obligations into 2027 or holds the August 2026 line; whether a harmonized compliance.yaml-style schema for AI Act technical documentation gets formal recognition, since right now teams are building against an unofficial standard; and whether Gartner’s 40%-by-2027 agent-decommissioning prediction actually plays out, which would be the clearest signal yet that governance gaps, not model capability, are the real ceiling on enterprise AI agent adoption.
None of this is a purchasing decision. OPA is free. Gatekeeper is free. The teams that get ahead of the August 2026 deadline are the ones who decide, now, who owns the policy and whether the gate is actually allowed to say no.
Want this kind of analysis in your inbox? Subscribe to The Neural Loop at neuralwired.com/newsletter for weekly breakdowns of the regulation, tooling, and incidents shaping how engineering teams actually build with AI.
MiCA Deadline Passed: Binance, MEXC Still Live in the EU
The EU’s MiCA compliance deadline hit on July 1, 2026, and by most coverage that should have been the end of the story for unlicensed exchanges. It wasn’t. Two weeks later, Binance, MEXC, and HTX are still processing trades for EU residents, according to a July 14 finding from AML Intelligence, an anti-money-laundering trade publication. If you’re holding funds on a platform you’re not sure is licensed, the deadline already passed and nothing changed. That gap between the law and what’s actually happening on your screen is the real story here, and it’s the part almost nobody’s telling you.
MiCA, the EU’s Markets in Crypto-Assets Regulation, has been rolling out in stages since 2023. The part that mattered most to ordinary users was Article 143’s grandfathering window: exchanges already operating under national registration before December 30, 2024 could keep serving customers while their full licence application worked through the system, with a hard backstop of July 1, 2026. Some countries cut that window short. The Netherlands, Finland, Latvia, Hungary, and Slovenia closed it at six months. France, Malta, Luxembourg, Czechia, and Estonia rode it all the way to the wire.
On June 23, 2026, the European Securities and Markets Authority made the closure official, telling every unauthorised crypto-asset service provider to wind down “in an orderly manner”: stop onboarding new users, stop marketing, and help clients move assets to licensed platforms or self-custody wallets. No member state extended the window. Spain’s CNMV said publicly there would be no exceptions.
That’s the version of the story most outlets ran with in the days around July 1: deadline hits, unlicensed platforms go dark. What actually happened is messier, and more useful to know if you have money sitting on one of these platforms right now.
Binance’s Greek rejection, and what it actually means
Binance is the headline case, and the timeline matters. The exchange had filed its CASP (Crypto-Asset Service Provider) application with Greece’s Hellenic Capital Market Commission. On June 24, six days before the deadline, Binance withdrew that application after Reuters reported the regulator was preparing to reject it. Reporting on the reason points to Binance’s “fit and proper” test, specifically its history of anti-money-laundering penalties and questions about majority owner Changpeng Zhao’s suitability, rather than incomplete paperwork.
From July 1, Binance stopped taking new spot orders, deposits, and sign-ups from EU residents, and shut off Earn and staking products. Withdrawals stayed open. That last detail matters: this wasn’t a fund freeze. It was a shutoff of new activity, which is a very different risk profile than what a lot of alarmed coverage implied.
Binance is not framing this as a ban, and it’s pushing back hard on that word.
MiCA’s success should be judged by how many firms it brings into the regulated system, not by who it excludes.
Gillian Lynch, Head of Europe, Binance. Comments reported by CoinDesk, July 3, 2026
Binance says it intends to relicense somewhere else in the EU, reportedly France, which is entirely legal under MiCA’s single-passport structure: one national licence covers all 27 member states plus the EEA. Whether that’s normal jurisdiction shopping or a workaround for a legitimate fitness concern is a judgment call the article can’t settle, and neither can the regulators yet. It’s worth watching either way.
Who’s licensed, who isn’t, who’s in between
Lumping every exchange into “has a MiCA licence” or “doesn’t” flattens three genuinely different situations into one. Here’s where the major platforms actually stand.
Exchange
Status
Detail
Coinbase
Licensed
Authorised via Ireland and Luxembourg entities, operating normally
Kraken
Licensed
Authorised via Ireland and Luxembourg entities
OKX
Licensed
Authorised in Malta
Crypto.com
Licensed
Authorised in Malta
Bybit EU
Licensed (partial)
Austrian entity is licensed; the global Bybit platform is not, so the brand is split
Binance
Withdrawn application
Pulled its Greek filing June 24, 2026 before an expected rejection; halted new EU activity July 1
KuCoin
Licensed, then suspended
Held an Austrian licence, then Austria’s FMA banned new onboarding in February 2026 over AML staffing gaps
MEXC
Never applied
Appears on ESMA’s non-compliant register as of the July 16 update
Combined estimated EU user base above 25 million accounts
The KuCoin case is the one worth sitting with. It’s not a “never licensed” story. It’s a “had the licence, then lost operational standing” story, over compliance-officer staffing failures rather than a fresh rejection. That’s a harder risk to spot from the outside, because the platform looked fully legitimate right up until it wasn’t.
The enforcement gap nobody’s talking about
Here’s the part that should be leading every piece on this topic and mostly isn’t. AML Intelligence reported on July 14, roughly two weeks after the legal deadline, that Binance, MEXC, and HTX all remained practically accessible to EU users despite lacking authorisation. The law changed on July 1. Access didn’t, at least not immediately and not completely.
The core finding: a platform being unlicensed under MiCA and a platform being unreachable are two different things right now. ESMA’s non-compliant register is a public list, not an internet kill switch. If your funds are on one of these platforms, “the deadline passed” is not the same as “my access is gone.”
The regulatory register itself tells a similar story of a system still catching up. It sat around 243 to 244 authorised CASPs in the weeks before the deadline. By July 3 it had jumped to 280. By July 16, ESMA had added 14 more, bringing the total to 294, while also adding two more firms to its non-compliant list following action from Italy’s CONSOB, pushing that list to 164 entries including MEXC. A number that moves three times in six weeks is not a settled number. Some platforms currently labeled “unlicensed” in headlines are simply still waiting in the queue.
And of those 294 authorisations, only around 14 to 15 actually cover the “operation of a trading platform” category, which is the one that matters most for a retail user placing orders. The rest are custody, brokerage, or payment-service licences. The headline number of authorised firms overstates how many of them are exchanges you’d recognize.
Stablecoins got hit too: USDT’s quiet EU exit
The exchange story has absorbed most of the attention, but MiCA’s e-money-token rules are reshaping the stablecoin market in parallel. Tether has not sought EMT authorisation for USDT, reportedly objecting to the reserve-composition and bank-deposit requirements that come with it. Licensed EU exchanges, including Coinbase and Kraken, have delisted or restricted USDT trading pairs as a result. Revolut is removing USDT from eligible European accounts by August 31, with new purchases already disabled since July 6.
To be clear: holding USDT is not illegal for an individual in the EU. What’s closed is the regulated on-exchange path to buy or sell it. Circle’s USDC and EURC, which do hold EU e-money authorisation, picked up the shelf space Tether left behind, a clean first-mover payoff for the compliant option.
The other side: is MiCA pricing out everyone but giants?
Not everyone thinks the attrition here is a success story for consumer protection. Erald Ghoos, CEO of OKX Europe, a licensed competitor with something to gain from this exact narrative, has put a number on the scale of the shakeout.
Almost 80% of the roughly 3,000 registered virtual asset service providers operating in the EU may not survive MiCA’s requirements.
Erald Ghoos, CEO, OKX Europe. Reported via CoinDesk / Cryptonomist, July 3, 2026
That figure, and the similar 75 percent estimate circulating in industry coverage, comes from interested parties, not from ESMA itself, and it’s worth flagging that Ghoos runs a firm that stands to pick up displaced users. It’s also worth weighing against a different number from Paybis: roughly 70 percent of EU crypto trading volume was already flowing through CASP-authorised platforms back in May 2026, months before enforcement began. If that’s right, the “80 percent of firms” framing may be technically accurate on headcount while overstating the real disruption to trading volume and user funds, since a large share of the at-risk registrations were small or dormant.
The compliance cost argument has real teeth beyond the big-exchange story, though. Mateusz Kara, founder of the Polish exchange Ari10, one of the only Polish-founded firms to secure MiCA authorisation, said his company was effectively the sole survivor among roughly 2,000 registered Polish VASPs.
The capital, paperwork, governance, and local-presence requirements combine to create costs that smaller projects may struggle to bear.
Yuliya Barabash, Founder and Managing Partner, SBSB Fintech Lawyers. Guest column in CryptoSlate, July 16, 2026
Alex Fazel, Chief Partnership Officer at Swissborg, framed the consumer side of the same coin: more than 10 million EU crypto users may need to find a new platform as unlicensed providers wind down. That’s the number that should worry a retail reader more than any exchange’s PR statement.
What this actually means for you
If you’re an EU resident with funds on Binance, MEXC, HTX, or a smaller unlicensed platform, check ESMA’s interim CASP register directly rather than assuming your platform’s marketing emails are the full picture. Don’t wait for withdrawals to close before you act. If you’re outside the EU, this doesn’t bind you directly, but a platform’s regulatory exit or restriction anywhere is a legitimate signal for how you think about counterparty risk everywhere else it operates.
If you’re building in this space, the licence-versus-no-licence decision now runs through a specific gate: MiCA authorisation costs run into the millions of euros once you account for governance, AML/KYC infrastructure, and capital requirements, a real barrier if you’re pre-seed or scrappy. And if you already have a licence, KuCoin’s case is the reminder that “MiCA licensed” isn’t a permanent badge. It’s an ongoing supervisory relationship you can lose over an unfilled compliance role.
Frequently asked questions
Does the lack of a Binance MiCA licence mean EU users lose their funds?
No. Binance says user assets remain safe and withdrawals stay open. What stopped on July 1 is new activity: new orders, deposits, sign-ups, and Earn or staking products for EU residents.
Is USDT banned in Europe?
No. Holding USDT is not illegal for EU individuals. MiCA-licensed exchanges have delisted USDT trading pairs because Tether hasn’t sought e-money-token authorisation, while Circle’s USDC and EURC remain listed.
Can one EU country’s MiCA licence cover the whole bloc?
Yes. A CASP licence from any single EU member state passports across all 27 countries and the wider EEA, which is why Binance can legally pursue relicensing through a different country after its Greek rejection.
What happens if an exchange keeps serving EU users without a MiCA licence?
Per ESMA’s April 2026 statement, any entity providing crypto-asset services to EU clients without authorisation is in breach of EU law and is required to cease those services, though enforcement on the ground is still catching up to that requirement.
How many crypto exchanges are actually MiCA licensed right now?
294 entities hold CASP authorisation across the EEA as of ESMA’s July 16, 2026 update, though only around 14 to 15 of those hold the specific trading-platform authorisation that covers a typical retail exchange.
Where this goes next
MiCA’s deadline was never going to be a single clean cut. It’s a legal line that passed on July 1 and an enforcement process that’s still working through a backlog on the other side of it, with the authorised list growing by dozens of firms every couple of weeks. Watch three things over the next six to eighteen months: whether ESMA moves from public naming to actual access restrictions for the firms on its non-compliant list, whether Binance’s French relicensing attempt succeeds or runs into the same fitness questions that sank its Greek bid, and whether the EBA’s proposed stablecoin fine framework, up to 12.5 percent of annual turnover, survives its consultation period ending September 28, 2026.
Our read: the platforms betting that “orderly wind-down” means “slow enough to keep collecting fees” are making a reasonable bet for now. That won’t hold indefinitely once the register stabilizes and enforcement tools mature. If you’re holding assets on an unlicensed platform, the smart move is to migrate before that changes, not after.
Want the next regulatory shift before it hits your feed? Subscribe to The Neural Loop at neuralwired.com/newsletter.
Illinois Just Joined the AI Law Rebellion. Here’s What It Means
AI Policy · State Regulation
Illinois Just Joined the AI Law Rebellion. Here’s What It Means
Published July 17, 2026 · 9 min read · NeuralWired
On July 6, 2026, Illinois Governor JB Pritzker signed a law that requires companies to audit their AI systems every single year, not once, not when a regulator asks, every year, by an outside auditor. It’s the strictest AI accountability rule in the country. And it landed six months after President Trump signed an executive order specifically designed to stop states from doing exactly this.
That collision is the story. The White House wants one national AI rulebook. States keep writing their own anyway, and as of July 1, 2026, they’ve enacted 109 AI laws this year alone. If you run compliance, legal, or engineering for a company that touches AI in hiring, lending, healthcare, or any consumer product, the gap between what Washington wants and what’s actually enforceable is the thing you need to understand right now, not in six months when Congress maybe does something.
Illinois’s new Artificial Intelligence Safety Measures Act follows the same basic template as California’s and New York’s frontier-AI laws, transparency requirements, safety disclosures, penalties for noncompliance. What makes it different is the audit clause. New York’s RAISE Act requires a one-time third-party audit once a company crosses a size threshold. Illinois requires one every year, indefinitely, making it the first mandatory annual AI audit law in the country.
Illinois lawmakers made a point of noting that Illinois, California, and New York together represent roughly 40 percent of the U.S. AI market. Do the compliance math on that and you get an uncomfortable conclusion for anyone hoping to wait out the federal debate: you don’t need all 50 states to pass a law for a de facto national standard to exist. You need three, if they’re the right three. A company building its AI governance program to satisfy the strictest of these three states is, in practice, already compliant almost everywhere that matters, federal legislation or not.
The number everyone cites is the wrong number
Here’s a distinction that gets flattened constantly in coverage of this topic, and it matters more than almost anything else in this story: 1,561 AI-related bills were introduced across 45 states as of March 2026. That’s the number the White House and its allies cite when they warn about regulatory chaos. But introduced is not enacted. Most bills die in committee. The actual count of AI laws states have signed into force in 2026, according to the Center on Technology Policy at NYU, is 109, plus 28 data-center laws, as of July 1. That’s slightly behind 2025’s pace of 121 by the same date.
In other words: the volume of proposed regulation is rising, but the volume of actual, binding regulation isn’t accelerating out of control. It’s roughly flat. That’s a very different story than “50 states are about to bury AI companies in conflicting rules,” and it’s a distinction worth holding onto every time you read a headline about the patchwork spiraling.
Quick fact check: If you see a figure claiming “over 1,000 state AI laws” this year, someone conflated bills introduced with laws enacted. The real 2026 number, as of July 1, is 109 AI laws and 28 data-center laws.
Why Washington’s preemption push keeps failing
The Trump administration has tried, twice through Congress and once through the courts, to shut this down at the federal level. Both congressional attempts collapsed.
In July 2025, the Senate voted 99-1 to strip a 10-year moratorium on state AI enforcement out of the “One Big Beautiful Bill Act,” after the House had already passed it. A second attempt to sneak preemption language into the FY2026 National Defense Authorization Act also failed, in early December 2025. Two must-pass bills, two rejections, near-unanimous both times.
So the administration switched tactics. On December 11, 2025, the president signed Executive Order 14365, creating a DOJ AI Litigation Task Force to challenge state AI laws in court instead of Congress. In March 2026, the White House followed up with a non-binding National Policy Framework urging Congress to preempt “unduly burdensome” state laws, while carving out three categories states could keep regulating: child safety, AI data-center infrastructure, and state government procurement.
David Sacks, the White House’s AI and crypto czar, has been the public face of the argument for why this matters.
“A patchwork of 50 different regulatory regimes.”
David Sacks, White House AI & Crypto Czar · Benzinga, December 9, 2025
The most concrete legislative attempt to formalize that vision is the Great American AI Act, a 269-page bipartisan discussion draft released June 4, 2026 by Reps. Jay Obernolte (R-CA) and Lori Trahan (D-MA). It would trade a federal frontier-AI governance regime for a three-year freeze on new state AI development laws (not deployment or use laws). It is not introduced legislation. It’s a draft seeking feedback, and it drew opposition from the House Democratic Commission on AI within hours of release.
“A disastrous proposal that Big Tech is celebrating.”
J.B. Branch, AI Governance and Technology Policy Counsel, Public Citizen · Public Citizen, June 4, 2026
Brad Carson, president of Americans for Responsible Innovation, framed the stakes more structurally: preemption of this kind would move AI law from what he called a state floor to a federal ceiling, replacing a minimum standard states can build on with a cap nobody can exceed, according to reporting from ThePlanetTools.ai.
Colorado: the lawsuit that could decide everything
If there’s one case to bookmark, it’s this one. Colorado’s SB 24-205, the country’s first comprehensive AI anti-discrimination law, was set to take effect June 30, 2026. It’s currently frozen, and the fight over it is the closest thing this story has to a live courtroom drama.
On April 9, 2026, xAI sued Colorado’s attorney general to block the law on First Amendment, Dormant Commerce Clause, vagueness, and equal protection grounds. Two weeks later, the Department of Justice formally intervened on xAI’s side, the first time the federal government has stepped into litigation against a state AI law. By April 27, a magistrate judge had suspended enforcement of the law until 14 days after ruling on xAI’s forthcoming preliminary injunction motion, according to Norton Rose Fulbright’s analysis.
Here’s the part worth flagging for anyone tempted to write Colorado’s law off as dead: the stay is procedural. It’s tied to Colorado’s own rulemaking process and a legislative rework already underway, not a permanent injunction. Governor Jared Polis’s AI Policy Work Group had already proposed narrowing the law toward a CCPA-style model with a 90-day cure period and pushing the effective date to January 1, 2027. Companies that assumed this fight is over should keep building toward compliance, because a revised version of this law is very likely coming back.
Is the “50-state patchwork” even real?
This is where the story gets genuinely contested, and it’s the part most coverage skips. The Institute for Family Studies ran the numbers on every state AI law enacted between 2023 and 2025 and found that only 33 of 276, about 12 percent, actually contained developer or deployer-specific mandates. Those 33 laws were concentrated in just 12 states, according to the IFS policy brief. That directly undercuts the “50 states going in 50 different directions” framing Sacks and others have used.
Cary Coglianese, a professor of law and political science at the University of Pennsylvania, has argued the opposite of the doom framing entirely: state-level experimentation could actually strengthen AI governance over time by letting different approaches get tested before anything consolidates at the federal level, a point he made to GovTech. Meanwhile, Forrester analyst Alla Valente has noted that for enterprise compliance teams, a single federal law would ease the burden compared to tracking dozens of jurisdictions, though she’s pointed out the deeper challenge is internal change management, not just keeping a list of new rules.
Both things can be true at once. The compliance burden is real for the handful of companies operating in the 12 states with substantive mandates. The apocalyptic “chaos” framing used to justify blanket federal preemption is not supported by the actual count of laws with teeth.
What compliance teams should do this quarter
Waiting for federal clarity is not a strategy right now. Two congressional attempts at preemption have already failed, and the GAAIA draft hasn’t even been formally introduced. Meanwhile every existing state law stays enforceable regardless of how the federal fight ends.
Deadline or obligation
Jurisdiction
What it requires
August 2, 2026
California (SB 942)
AI content transparency and watermarking, delayed from January 1
Ongoing, annual
Illinois (AI Safety Measures Act)
Mandatory annual third-party AI audit
Ongoing
New York City (Local Law 144)
Bias audits for automated hiring tools, actively enforced
Frozen, likely January 1, 2027
Colorado (SB 24-205)
Algorithmic discrimination protections, currently stayed pending litigation and rulemaking
In force since January 1, 2026
Texas (TRAIGA)
Responsible AI governance obligations
Several law firms tracking this space, including Goodwin and King & Spalding, converge on the same advice: build a system inventory now, document your impact assessments now, and design your governance program to satisfy the strictest of Illinois, California, and New York. That single move covers roughly 40 percent of the U.S. AI market and future-proofs you against most of what’s still coming down the pipe in other states.
The risk nobody’s pricing in: if a GAAIA-style preemption bill eventually passes with broad “development law” language, it could freeze states out of regulating not just today’s models but future model capabilities through 2029, according to Lawfare’s analysis of the discussion draft. That’s a durability problem that pure compliance-cost arguments for preemption tend to leave out.
Frequently asked questions
Is there a federal AI law in the United States?
No. As of July 2026, Congress has twice rejected broad federal preemption of state AI laws, once in the reconciliation bill and once in the NDAA. The Great American AI Act remains an unintroduced discussion draft. Compliance today is governed entirely by state law and sector-specific federal agency rules.
Is the Colorado AI Act still in effect?
No, enforcement is currently suspended. A federal magistrate judge paused SB 24-205 on April 27, 2026, after xAI sued and the DOJ intervened. The law is unenforceable pending Colorado’s rulemaking process and a forthcoming ruling on xAI’s injunction request.
How many AI laws have states passed in 2026?
States had enacted 109 AI-specific laws and 28 data-center laws as of July 1, 2026, according to the Center on Technology Policy at NYU, a pace close to but slightly behind 2025’s activity over the same period.
What is the Great American AI Act?
A 269-page bipartisan discussion draft released June 4, 2026 by Reps. Jay Obernolte and Lori Trahan. It would create federal frontier-AI rules in exchange for a three-year freeze on new state AI development laws. It has not been formally introduced in Congress.
Which states have the strictest AI laws?
Colorado, California, New York, and, as of July 6, 2026, Illinois generally have the most comprehensive regimes, covering algorithmic discrimination, frontier-model transparency, and mandatory bias or safety audits.
Where this goes next
Here’s what’s actually settled after all of this: no federal AI statute exists, Congress has rejected preemption twice, and the strongest legal challenge to a state AI law (Colorado’s) is stayed, not won. What’s unsettled, and worth watching over the next 6 to 18 months, is whether the xAI v. Weiser ruling sets a precedent other states have to work around, whether GAAIA actually gets introduced as a bill, and whether more states follow Illinois’s annual-audit model rather than New York’s one-time version.
Our read: the “patchwork” framing has become a political argument more than an accurate description of the legal landscape. Companies that build their compliance programs around Illinois, California, and New York today will be in good shape no matter which way the federal fight breaks. Companies still waiting for Washington to hand them a single rulebook are the ones who’ll be scrambling.
Three things to watch before your next board meeting: the ruling on xAI’s preliminary injunction in Colorado, whether GAAIA gets a formal introduction with a floor vote scheduled, and California’s August 2 transparency deadline under SB 942.
Deployment frequency is up. Lead time is down. Every dashboard is green. And your VP of Engineering still can’t explain why the roadmap slipped a quarter behind. If that sounds familiar, you’re not measuring the wrong things badly. You’re measuring the wrong things well.
DORA metrics, the deployment frequency, lead time, change failure rate, and recovery time framework born out of Google Cloud’s DevOps Research and Assessment program, have become the default scoreboard for engineering performance. In 2024, only 19% of teams surveyed hit “elite” status on that scoreboard. Yet DORA’s own research team has publicly warned against using these numbers to judge team performance at all. So what are engineering leaders supposed to trust instead?
DORA started as a research program, not a dashboard. Dr. Nicole Forsgren, Jez Humble, and Gene Kim built it, and their 2018 book Accelerate introduced what became known as the Four Keys: deployment frequency, lead time for changes, change failure rate, and time to restore service. Google Cloud has run the program since acquiring the founding team’s research in 2018.
In 2024, DORA added a fifth metric: rework rate, which tracks how many deployments are actually emergency fixes for problems the last deployment caused. That addition alone tells you something. The original four measure how fast you move. Rework rate exists because moving fast and moving in circles started to look identical on the old dashboard.
Quick definition: An “elite” DORA performer deploys on demand, has a lead time under one day, keeps change failure rate near 5%, and restores service in under an hour. In 2024, roughly one in five surveyed teams qualified. Source: DORA 2024 State of DevOps Report
The “Elite Performer” Number Nobody Questions
Here’s the stat that gets stapled to every engineering leadership deck: elite performers deploy 182 times more frequently than low performers, and they restore service 2,293 times faster. Those numbers are real, pulled from a survey of more than 39,000 professionals for the 2024 State of DevOps Report. They’re also the least useful numbers in the report if you’re trying to explain a missed quarter.
Look at what happened to the middle of the distribution instead. Between 2023 and 2024, the share of low-performing teams grew from 17% to 25%. The share of high performers shrank from 31% to 22%. The industry didn’t get better at DevOps last year. It got worse, on average, while adopting more DevOps tooling than ever.
Metric
2023
2024
Low-performing teams
17%
25%
High-performing teams
31%
22%
Elite-performing teams
not tracked
19%
That’s the gap the headline is pointing at. A team can hit every DORA benchmark and still be part of a shrinking pool of teams whose actual delivery outcomes are stagnant or backsliding.
Why Speed and Goals Keep Diverging
DORA’s own research team saw this coming. In October 2023, according to reporting cited on DORA’s Wikipedia entry, the team explicitly warned against using the Four Keys to evaluate individual teams’ performance. That’s an unusual thing for a research program to say about its own flagship metrics. It’s also exactly what you’d expect once a research tool turns into a KPI baked into Jira, GitLab, and every engineering-analytics dashboard on the market.
This is Goodhart’s Law showing up in production code. Once deployment frequency becomes the target, it stops measuring what it used to measure. Teams under pressure to hit a number will split pull requests into smaller, more frequent deploys without changing what actually ships. They’ll quietly under-report incidents to protect their change failure rate. None of that improves the product. All of it improves the chart.
Teams pressured to raise their deployment rate by a fixed percentage can hit that target simply by shipping smaller changes more often, without touching the bugs or incidents that actually determine whether users are happy.
Laura Tacho, CTO, DX · getdx.com/podcast
DORA even flags this tension inside its own 2024 data. Teams that adopted internal developer platforms saw individual productivity and overall organizational performance improve, but the report also found decreased change stability and throughput as a side effect. Speed up one lever, and another one moves without anyone touching it.
What AI Adoption Did to the Data
If DORA metrics were shaky before, AI made the cracks visible. The 2024 report found that a 25% increase in AI adoption correlated with a 1.5% decrease in throughput and a 7.2% decrease in stability, DORA’s own team flagged this as correlational rather than causal, but the direction is notable.
By the time the 2025 State of AI-assisted Software Development Report came out, AI use had reached 90% of surveyed professionals, with more than 80% reporting productivity gains. But 30% still said they had little or no trust in the code AI generated for them. The report’s core finding, drawn from nearly 5,000 professionals and over 100 hours of qualitative interviews, was blunt: AI doesn’t fix a broken team. It amplifies whatever was already there. Strong teams get stronger. Struggling teams get their existing dysfunction on fast-forward.
That’s the mechanism behind the headline. A team with process debt that starts using AI coding tools doesn’t quietly improve. It ships more, faster, with the same underlying gaps, and those gaps show up downstream as missed goals rather than upstream as slow commits.
The Case Against DORA Entirely
Not everyone thinks DORA metrics deserve the reverence they get. Dr. Junade Ali, a software engineering manager who ran independent polling with Survation and J.L. Partners, published a pointed critique on HackerNoon in January 2024 arguing the entire premise is backwards.
His research found that both software engineers and the general public rank data security, data accuracy, and bug prevention well above deployment speed when asked what matters in software delivery. That directly contradicts what the Four Keys are built to optimize for. Ali also points out that DORA’s team doesn’t publish raw survey data, unlike polling organizations bound by disclosure rules such as the British Polling Council, which require full data tables within two working days of publication.
It’s hard to find a hypothesis connecting the Four Key Metrics to the outcomes that developers and the public actually say they care about most.
Dr. Junade Ali, Software Engineering Manager · HackerNoon, January 2024
His research also found something worth sitting with: 98% of UK business decision-makers and 96% of their US counterparts agreed that the actual goal of an engineering team is delivering high-quality software on time, not shipping the highest possible number of deploys. Nobody polled thinks speed is the goal. Yet speed is what gets measured, reported, and rewarded.
What Replaces DORA in 2026
The clearest answer to “what should we measure instead” so far is DX Core 4, a framework announced in December 2024 by DX co-founder and CEO Abi Noda and DX CTO Laura Tacho, built with input from DORA co-creator Dr. Nicole Forsgren and Dr. Margaret-Anne Storey. It’s worth being upfront here: DX sells the platform that implements this framework, so its published outcomes come from the vendor itself, not an independent auditor.
With that disclosed, the numbers are still notable. Tested across more than 300 organizations, DX Core 4 has been associated with 3 to 12% increases in engineering efficiency and a 14% increase in R&D time spent on new feature development. The framework’s structure is the real change: it pairs DORA’s speed metrics with effectiveness, quality, and business impact measures, so a team can’t improve one number by quietly breaking another.
The big question is, what should we actually be measuring? DORA’s throughput numbers alone were never built to capture developer experience or business impact.
Abi Noda, Co-founder & CEO, DX · LeadDev, December 2024
The market is already voting with its budget
Platform engineering investment backs this shift up. Gartner projections cited in industry compilations put platform engineering team adoption at 80% of large software organizations by 2026, up from 45% in 2022 (worth verifying directly against a current Gartner release before you cite the figure yourself). The broader DevOps software market itself is priced anywhere from roughly $15 billion to nearly $19 billion for 2026 depending on which research firm you ask, a wide enough range that any single number should be treated as directional, not precise.
Our read: this signals engineering leadership is done treating DORA as a finished answer. The direction for 2026 is DORA plus a counterbalancing quality or business-impact metric, not DORA replaced outright.
Frequently Asked Questions
What are the DORA metrics?
DORA metrics are five software delivery measurements, deployment frequency, lead time for changes, change failure rate, failed deployment recovery time, and rework rate (added in 2024), developed by Google Cloud’s DORA research program to evaluate delivery speed and stability.
What is an elite DORA performer?
In DORA’s 2024 report, elite performers deploy on demand, have lead times under a day, keep change failure rates near 5%, and recover from failures in under an hour. Only about 19% of surveyed teams qualified as elite that year.
Are DORA metrics enough to measure engineering success?
No. DORA’s own team warned in October 2023 against using the Four Keys to evaluate individual teams. Newer frameworks like DX Core 4 pair DORA with developer experience and business impact metrics to avoid a narrow, gameable view of performance.
What is Goodhart’s Law and how does it apply to DORA metrics?
Goodhart’s Law holds that once a measure becomes a target, it stops being a good measure. Applied to DORA, teams pressured to hit deployment-frequency targets can split pull requests artificially or under-report incidents to protect their numbers, without improving actual delivery outcomes.
What is DX Core 4?
DX Core 4 is a 2024 framework combining DORA, SPACE, and DevEx research into four dimensions: speed, effectiveness, quality, and business impact. It was built by DX’s Abi Noda and Laura Tacho with input from DORA co-creator Dr. Nicole Forsgren.
Where This Goes Next
Here’s what the data actually tells you, once you stop reading the headline numbers in isolation: DORA metrics were never designed to be a scoreboard for individual teams, and the program’s own researchers said so in writing back in 2023. What they measure well is delivery speed and stability at an aggregate level. What they can’t tell you is whether that speed is producing anything your business actually wanted.
Over the next 6 to 18 months, expect three things to play out. First, more engineering orgs will pair DORA with a second framework, DX Core 4 or something built in-house, rather than reporting DORA numbers alone in board decks. Second, AI’s split effect (individual productivity up, organizational stability shaky) will keep showing up in DORA’s own annual reports until teams fix underlying process debt instead of layering AI on top of it. Third, watch for tooling vendors to start marketing “beyond DORA” dashboards as a category, the same way “shift-left security” became a category once perimeter security stopped being enough on its own.
Three things worth watching yourself over the next few quarters: whether your org’s change failure rate moves in the same direction as your deployment frequency, whether anyone above you is asking about rework rate at all, and whether a platform engineering investment is quietly trading stability for speed without anyone naming the tradeoff out loud.
AI Copyright Rulings Diverge Across 6 Countries in 2026
GLOBAL AI POLICY
Your AI Content Runs on Copyrighted Data. Six Countries Now Disagree on What That Means.
By NeuralWired Research Desk | July 6, 2026
A judge in San Francisco says training an AI model on copyrighted books is fair use. A judge in Munich just ruled the opposite about song lyrics. If your company runs the same generative AI tool in both markets, you are not operating under one set of rules. You are operating under six, and they contradict each other in ways that should worry your legal team more than any single lawsuit does.
This is the real story of AI copyright risk in 2026: not one landmark case, but a fractured global map where the United States, the UK, Germany, China, India, and Canada have each drawn their own line, sometimes in direct opposition to one another. Here is what each country has actually decided, what it means if you build or publish with AI, and where the next ruling could flip the board again.
United States: A Win on Training, a $1.5 Billion Loss on Piracy
Start with the case that set the tone for everything after it. In Bartz v. Anthropic, Judge William Alsup ruled on June 23, 2025 that training Claude on legally acquired books was, in his words, “exceedingly transformative,” comparing it to a human reading widely to learn how to write. That part was a clear win for AI developers.
But Alsup drew a sharp line: acquiring and storing roughly 7 million pirated books to build that training set was not fair use, piracy is piracy, no matter what you do with the files afterward. Anthropic settled for $1.5 billion, covering about 482,000 works at an implied rate of roughly $3,113 per work. Final court approval is set for April 23, 2026. That figure now works as the industry’s first real benchmark for what unauthorized training data can cost.
Two weeks later, Kadrey v. Meta reached a similar outcome on training but split from Alsup’s reasoning entirely. That court found training is fair use “regardless of whether the underlying materials were obtained from legitimate sources or not,” while flagging market dilution as a stronger, if still unproven, theory of harm. Some of Meta’s torrenting claims remain active.
Not every U.S. ruling has gone the AI industry’s way. In Thomson Reuters v. Ross Intelligence, the District of Delaware ruled in February 2025 that training a non-generative legal search tool on Westlaw headnotes was not fair use, the only U.S. loss so far at the training stage. The Third Circuit heard oral argument on the appeal June 11, 2026, and legal analysts expect that ruling to shape every pending generative AI case regardless of the outcome.
Meanwhile, the NYT/Authors Guild v. OpenAI multidistrict litigation is quietly becoming the biggest discovery event in copyright history. Judge Sidney Stein ordered OpenAI to hand over 20 million anonymized ChatGPT logs in January 2026, then expanded that order in March to cover pools of 78 million and 10 million more. If your team pipes proprietary prompts through a vendor’s model, that is now a data governance question, not just a legal one.
“I personally think that training your gen AI model on copyrighted works is fair use, ought to be fair use.”
Jessica Litman, Law Professor, University of Michigan | Source: Generative AI in the Newsroom
The U.S. Supreme Court closed one door entirely on March 2, 2026, denying certiorari in Thaler v. Perlmutter and leaving intact the rule that copyright requires a human author. As of mid-2026, more than 70 active or recently resolved AI copyright suits are working through U.S. courts, with cumulative claimed damages estimated above $50 billion.
United Kingdom: A Hollow Victory for Rights Holders
Getty Images spent years and millions of dollars suing Stability AI over Stable Diffusion. The High Court’s November 2025 ruling in Getty Images v. Stability AI rejected Getty’s secondary infringement claim outright, finding that model weights are not “infringing copies” under UK law because the model does not retain reproductions of the training images themselves.
Getty won only a narrow trademark claim tied to watermarks appearing in early model outputs. Then came the twist: Getty was ordered to pay 69.4% of Stability’s legal costs. Commentators have called it a financially pyrrhic result, a technical win that cost the plaintiff more than it recovered.
Why it matters: The UK court never actually ruled on whether training itself infringes copyright, because Getty withdrew that claim mid trial. That leaves the UK’s core question on AI training completely untested, a gap enterprises operating there should not mistake for settled law.
Germany: The Only Country to Rule Against an AI Company Outright
If the U.S. story is “training wins, piracy loses,” Germany flips that on its head. The Munich Regional Court ruled on November 11, 2025 in GEMA v. OpenAI that OpenAI violated German copyright law by using lyrics from GEMA’s more than 100,000 represented composers and publishers to both train and generate output through ChatGPT. This is the first European court finding of direct copyright liability against a major generative AI company.
GEMA CEO Tobias Holzmüller described the ruling as a precedent that protects authors’ rights against unauthorized AI training and output.
Source: Built In / The Conversation
Separately, three 2026 German rulings from Munich, Frankfurt, and Düsseldorf courts tackled a different question entirely: can AI-generated output itself be copyrighted? Applying the CJEU’s “free and creative choices” standard, the courts found that short or purely functional prompts do not create a protectable work, but human-authored lyrics later modified by AI retained protection because the human’s original creative choices were still recognizable in the final product.
Put simply, Germany is currently the only major jurisdiction to find an AI company directly liable for both training and output infringement, the opposite conclusion the U.S. and UK reached in the same 18 month window.
China: Three Rulings, Three Different Answers
China’s courts have handed down more AI copyright decisions than any other jurisdiction, and they do not agree with each other. In the Guangzhou Internet Court’s 2024 “Ultraman” case, an unnamed LoRA model platform was ordered to pay roughly $4,200 after users generated Ultraman derivative images for commercial gain, the first Chinese ruling to hold an AI platform liable for contributory infringement. The Hangzhou Intermediate People’s Court upheld it on appeal in December 2024.
Then, in September 2025, the Beijing Internet Court ruled in the “Cat Crystal Diamond Pendant” case that copyright can exist in AI-generated images, but only if the claimant documents their actual creative process, prompts, and iterative edits. Post-hoc recreations of the generation process do not count.
Six months earlier, the Zhangjiagang People’s Court went the other direction entirely. In the “Fantasy Wings” case, decided March 19, 2025 and upheld on appeal that April, the court found that prompts alone convey ideas rather than protectable expression, and that unpredictable model output cannot be attributed to the user as their own work, the first Chinese decision to deny AI-generated images copyright protection altogether.
The takeaway: China is not converging toward a single rule. It is producing case-by-case outcomes that hinge entirely on how well a claimant documented their prompting process, which makes prompt logging a genuine legal asset there, not just good practice.
India: The Next Big Swing Vote
India has not issued a merits ruling yet, but the case to watch, ANI Media v. OpenAI, filed in the Delhi High Court in November 2024, could move fast. Judgment was reserved on March 27, 2026, and Justice Bansal has signaled he intends to rule under India’s 1957 Copyright Act without leaning on foreign precedent. That means the outcome could break sharply from the “transformative use” framework the U.S. and UK have relied on.
OpenAI has argued the Delhi court lacks jurisdiction and pointed out that no interim injunction has been granted against it in comparable U.S., Canadian, or German cases. Times of India publisher Bennett Coleman has joined the suit, raising the stakes for a ruling that could set India’s first real doctrine on AI training.
Canada: Cases Move Forward, Questions Stay Open
Canada’s courts have so far only cleared procedural hurdles, not ruled on the substance. The Ontario Superior Court in December 2025 and the Federal Court of Appeal in July 2025 both allowed Canadian AI-training copyright claims to proceed past jurisdictional challenges. A second Quebec class action against Meta over LLaMA training was filed in October 2025.
Canada’s Copyright Act, last substantively updated in 2012, has never been tested on fair-dealing-for-AI-training on the merits. Government consultations wrapped in November 2024 and could still prompt legislative changes before any court gets the chance to rule.
The Global Ruling Matrix
Here is where each jurisdiction actually stands right now, at a glance.
Country
Training on Copyrighted Data
AI-Generated Output Ownership
Status
United States
Fair use if legally acquired; piracy is not covered
Requires human author (Thaler)
Ross Intelligence appeal pending, June 2026
United Kingdom
Untested; Getty withdrew the claim
Not directly ruled on
Narrow trademark ruling only
Germany
Ruled infringing (GEMA)
Protectable only if human creative choices are recognizable
Only jurisdiction with direct liability finding
China
Platform liability found (Ultraman)
Case-by-case; depends on documented creative process
Inconsistent, most active docket globally
India
Undecided
Undecided
Judgment reserved, ANI v. OpenAI
Canada
Undecided on merits
Undecided
Cases cleared jurisdictional stage only
What This Means If You Publish or Build With AI
If your company operates across more than one of these markets, and most sizable enterprises do, a single global AI use policy no longer covers you. Here’s what actually needs to change.
Jurisdiction-by-jurisdiction risk scoring, not a blanket policy
The same generative AI deployment can be compliant in the U.S., directly exposed in Germany, and legally undefined in India. Legal teams need a market-by-market risk matrix, not a single global sign-off.
Treat training and output as two separate legal questions
Nearly every ruling so far, American, German, and Chinese, treats where the training data came from and whether the output resembles existing copyrighted work as entirely separate issues with separate defenses. Audit both independently.
Log your prompts and iterations
Chinese courts explicitly require documented evidence of creative process to claim copyright in AI-assisted output, and German courts apply a similar test. Prompt and revision logs are becoming a legal asset, not just a workflow nicety.
Push for real indemnification in vendor contracts
With a public settlement benchmark now on the record ($3,113 per work in Bartz), legal teams finally have a number to model worst-case exposure against when negotiating indemnification caps with AI vendors.
“The actual practices that the AI companies are engaging in probably go beyond what would be considered a fair use.”
Nina Brown, Attorney and Communications Professor, Syracuse University | Source: Generative AI in the Newsroom
Watch two decisions closely for the rest of 2026: the Third Circuit’s ruling on the Ross Intelligence appeal, and the Delhi High Court’s judgment in ANI v. OpenAI. Either could shift the fragmented map covered above in a matter of weeks.
The Case Against the “AI Is Winning” Narrative
Most coverage of these cases reads like the AI industry is running the table. That’s not quite right. Of the handful of merits rulings issued so far, only Bartz and Kadrey squarely favor AI companies on training, and even those carved out real losses on piracy and acquisition. Germany’s GEMA ruling is a direct counterexample from the same 18 month window, a fact that rarely makes it into U.S.-centric coverage.
The Ross Intelligence loss also remains the outlier working against AI companies, and it is now in front of an appellate court for the first time. Northwestern’s Peter DiCola has cautioned that neither Ross nor the Meta outcome should be treated as decisive, since both are still pending appellate review.
A risk most coverage misses entirely: if courts keep ruling that AI-generated content is broadly uncopyrightable, as Dennis Crouch of the University of Missouri put it, we may be “rapidly building a vast new public domain.” That cuts both ways. Companies pouring money into AI-produced marketing, media, or code face the real possibility that their own outputs carry zero protectable IP, a mirror image of the infringement risk that dominates most headlines.
“If we’re not going to hold the technology maker liable for the technology itself, then the creator of the output is the AI. But we’ve already said they’re not an author. So if they’re not an author then they can’t create an infringing work.”
Rob Heverly, Associate Professor, Albany Law School | Source: Built In
China’s doctrine is not converging with the West either, despite some analyst framing suggesting otherwise. Within an 18 month span, Chinese courts issued a landmark pro-copyrightability ruling, then a flat denial, then a stricter evidentiary bar. That is not a stable rule enterprises can build long-term compliance around, it is a moving target.
FAQ
Is AI-generated content protected by copyright?
In most jurisdictions, no. U.S., German, and Indian law all currently require a human author, and the U.S. Supreme Court declined to revisit that rule in March 2026. China is the exception, allowing copyright where a claimant documents sufficient human creative input through prompting and iteration.
Is it legal to train AI on copyrighted books?
In the U.S., courts have ruled that training on legally acquired copyrighted books is fair use, as in Bartz v. Anthropic and Kadrey v. Meta, but downloading pirated copies is not. Germany’s GEMA ruling reached the opposite conclusion for song lyrics used to train ChatGPT.
Did Anthropic lose its AI copyright lawsuit?
Anthropic won on the core training question, a judge ruled that using books to train Claude was fair use, but lost on the separate question of acquiring pirated copies. That led to a $1.5 billion settlement covering roughly 482,000 works, pending final court approval on April 23, 2026.
Can you copyright something made with Midjourney or ChatGPT?
Only the human-authored elements. U.S. and German courts require the human’s own creative choices to be identifiable in the final work. Simple or purely descriptive prompts generally don’t qualify, though extensively edited or combined human-AI works may retain partial protection.
What is the AI copyright case in India?
ANI Media v. OpenAI, filed in the Delhi High Court in November 2024, alleges OpenAI used ANI’s news content without permission to train ChatGPT. Judgment was reserved on March 27, 2026, and the ruling is expected to set India’s first legal doctrine on AI training and copyright.
Where This Leaves Us
Six countries, six different answers, and none of them final. What you now understand that most coverage glosses over: the U.S. and Germany have both ruled on the training question and landed in opposite places, the UK never actually decided it, China is producing contradictory rulings by the month, and India and Canada haven’t reached the merits yet at all.
Over the next 6 to 18 months, expect the Third Circuit’s Ross Intelligence appeal and the Delhi High Court’s ANI v. OpenAI judgment to be the two rulings that move this map the most. Three things worth watching in the meantime: whether the Bartz settlement’s $3,113-per-work benchmark shows up in future case valuations, whether any jurisdiction outside China starts requiring documented prompt logs as evidence of human authorship, and whether the EU AI Act’s training-data-transparency rules start generating their own wave of litigation separate from copyright court.
Anyone telling you there’s a stable global compliance standard coming in 2026 hasn’t read the actual rulings. There isn’t one. Plan accordingly.
IBM Owns Terraform Now: Inside Pulumi’s 2026 HCL MoveCloud Infrastructure
IBM Owns Terraform Now. So Pulumi Learned Its Language.
A quiet feature launch in January 2026 tells you more about where infrastructure as code is heading than any market share number floating around Google right now.
If you searched “terraform vs pulumi market share 2026” and landed here expecting a clean percentage, you’ve found the same wall we hit. A number like “Terraform owns 72% of the market” is repeated across dozens of sites this year. It’s also attributed to the CNCF’s 2024 survey, which, when you actually open the PDF, contains no IaC market share question at all. It covers Kubernetes, GitOps, and service mesh, not Terraform versus Pulumi versus OpenTofu. That statistic doesn’t exist. It’s a content farm number that got copied enough times to look true.
Here’s what does exist, and it’s a better story anyway: in January 2026, Pulumi started shipping native support for HashiCorp Configuration Language, the actual syntax Terraform users write in. It also began hosting Terraform and OpenTofu state files directly inside Pulumi Cloud, a direct shot at HashiCorp’s own hosted product. That’s not a rumor. That’s a company built on the opposite philosophy from Terraform (write infrastructure in Python or TypeScript, not a config language) deciding the config language was worth absorbing anyway.
Why this matters if you manage infrastructure: You no longer face an all or nothing rewrite to leave Terraform. Pulumi’s bridge means you can keep existing Terraform or OpenTofu state under new governance while migrating components on your own schedule. That changes the calculus for any team stuck deciding what to do about HashiCorp’s licensing shift.
The Real Story: Why Pulumi Started Speaking HCL
Pulumi’s founder and CEO, Joe Duffy, didn’t dress up the reasoning. Asked why a multi-language platform would add support for the one language it was built to avoid, he pointed to demand from Terraform users looking for an exit ramp after HashiCorp’s 2023 licensing change.
“That time has come for HCL.”
Joe Duffy, Founder and CEO, Pulumi, via InfoQ, January 17, 2026
In a separate interview a few weeks later, Duffy went further, saying the Terraform relicense had noticeably pushed existing Terraform users to look at Pulumi (The New Stack, February 2026). Take that with the appropriate grain of salt. He’s the CEO selling the migration story. But the product decision itself, shipping a language Pulumi spent seven years arguing against, is hard evidence regardless of who’s narrating it.
That decision doesn’t happen in a vacuum. It happens because of what came before it.
The Three Shocks That Actually Reshaped IaC
Strip away the SEO noise and this isn’t really a two horse race between Terraform and Pulumi. It’s a three way story, and OpenTofu is the part most “Terraform vs Pulumi” articles conveniently skip.
Event
Date
What actually happened
Terraform relicensed to BSL
August 2023
HashiCorp moved Terraform off the open source MPL 2.0 license onto the Business Source License, restricting competitors from reselling managed Terraform products.
OpenTofu forks Terraform
September 2023
Founded under the Linux Foundation by Spacelift, env0, Harness, Scalr, and others, days after the BSL announcement.
HashiCorp vs OpenTofu dispute
April 2024
A cease and desist alleging code theft was publicly rebutted line by line. Linux Foundation’s Jim Zemlin backed OpenTofu; InfoWorld’s Matt Asay reversed his initial position after reviewing the rebuttal.
IBM acquires HashiCorp
February 27, 2025
A confirmed $6.4 billion deal, per IBM’s own newsroom. Terraform now sits inside IBM’s automation portfolio next to Vault, Consul, and Nomad.
OpenTofu joins CNCF
April 2025
Accepted at the Sandbox tier, giving it vendor neutral governance credibility a single company fork rarely earns this fast.
Pulumi adds native HCL support
January 2026
Announced in private beta, targeting general availability in Q1 2026. Confirm current GA status before assuming it’s fully live.
Notice what’s missing from most coverage: the CLOUD Act and data jurisdiction angle. If your organization stores Terraform state inside HCP Terraform, that platform now sits under IBM, a U.S. company. For teams with GDPR obligations or data residency requirements, that’s worth a conversation with legal, even if it’s not the deciding factor.
The Numbers You Can Actually Check Yourself
Forget the disputed percentages. The most defensible signal in this whole debate is public, live, and anyone can verify it in thirty seconds on GitHub.
Tool
GitHub stars
Trend
Terraform
~48,749
Still the largest, unsurprising given its head start
OpenTofu
~29,000
Roughly doubled from ~22,400 in under two years
Pulumi
~25,378
Now trailing OpenTofu, despite Pulumi being nearly six years older
That last row is the one nobody’s writing about. OpenTofu launched in September 2023. Pulumi launched in 2017. And OpenTofu has already pulled ahead of it on developer mindshare by star count. If you wanted one sentence to summarize where developer attention is actually going, that’s it, and it’s not the sentence most headlines are using.
Two infrastructure orchestration vendors back this up with real usage data, not surveys. Spacelift reports that roughly half its platform deployments now run OpenTofu instead of Terraform. Scalr reports OpenTofu at around 63% of runs and 72% of newly created workspaces, up from about 56% of new workspaces earlier in 2026. That second number matters more than the first: new workspace share reflects fresh decisions being made today, not legacy projects nobody’s touched since 2022.
On the provider ecosystem, the gap that used to favor Terraform by three to one has narrowed sharply. OpenTofu’s registry now lists more than 3,900 providers and 23,600 modules against Terraform’s roughly 4,800 providers, closer to a 20% gap than the old blowout. Pulumi’s native registry is smaller at around 1,800 packages, but its “Any Terraform Provider” bridge lets it generate a typed SDK from essentially any Terraform or OpenTofu provider, which closes that distance more than the raw numbers suggest.
What The People Building These Tools Are Actually Saying
Matt Gowie, founder of the IaC consulting firm Masterpoint and a former Terraform contributor, told TechTarget that starting in January 2026 he began actively steering client work toward OpenTofu over licensing objections. By his account, all but one of roughly eight client engagements that year ended up on OpenTofu.
Sebastian Stadil, CEO of Scalr and an OpenTofu core member, put the licensing contrast bluntly when OpenTofu shipped native state encryption, a feature the open Terraform CLI still lacks. Worth remembering he runs a company that competes directly with HashiCorp’s commercial products, so weigh the framing accordingly.
The Case Against The “Pulumi Is Winning” Narrative
Not everyone buys the displacement story, and the skeptical case deserves real airtime rather than a token paragraph at the bottom.
“I have not seen any of the predicted tsunami of large businesses dumping HashiCorp Terraform for OpenTofu.”
Andi Mann, Global CTO and Founder, Sageable, via TechTarget
Mann’s read, that adoption is real but concentrated in smaller, open source first shops rather than sweeping the enterprise, lines up with a fact most “Terraform is dying” articles leave out: HashiCorp’s last public quarter before the IBM acquisition closed showed revenue up 15% year over year and customer count up 10% among accounts spending six figures. That’s not a company in freefall.
Our read: the loudest part of this story, GitHub stars and vendor platform data, tells you where developer enthusiasm and new project decisions are trending. It does not yet tell you that large regulated enterprises are ripping out production Terraform at scale. Those are two different claims, and a lot of 2026 coverage blurs them into one.
There’s also a small base problem worth flagging directly for anyone quoting a “45% growth” style figure for Pulumi or OpenTofu. A percentage jump looks dramatic against a small starting number. Pulumi’s last verified customer count sits around 2,000 (a 2023 figure, likely stale by now), against HashiCorp’s roughly 4,700 paying customers reported in 2024. Growth rate and absolute scale are not the same story, and reporting on this topic tends to conflate them.
One more open thread: the HashiCorp and OpenTofu legal dispute over alleged code copying was never resolved in public record. It went quiet after OpenTofu’s rebuttal, but “no further communication” isn’t the same as “resolved.” Any team betting heavily on OpenTofu’s long term legal footing should know that history exists.
Quick Answers
Is Terraform still open source?
No, not in the traditional sense. HashiCorp moved Terraform from the open source MPL 2.0 license to the Business Source License 1.1 in August 2023. You can still view, run, and self-host it for free, but competitors can’t resell managed Terraform products without a commercial license.
What’s the actual difference between Terraform and Pulumi?
Terraform uses HCL, a declarative configuration language built specifically for infrastructure. Pulumi lets you write infrastructure in Python, TypeScript, Go, C#, or Java, giving you real loops, functions, and IDE tooling that HCL doesn’t offer.
Is OpenTofu a safe replacement for Terraform?
For most teams, yes. It’s a Linux Foundation governed fork of Terraform 1.6, fully open source under MPL 2.0, and largely drop-in compatible. Most migrations just swap the terraform binary for tofu with no code changes required.
Who owns Terraform now?
IBM. The acquisition closed February 27, 2025, for $6.4 billion. Terraform now sits inside IBM’s automation software lineup alongside Vault, Consul, and Nomad.
Can Pulumi actually use Terraform providers?
Yes. Pulumi’s bridging mechanism lets it use existing Terraform and OpenTofu providers directly, generating a typed Pulumi SDK from any provider already in either registry.
Where This Goes Next
What you now know that most search results won’t tell you straight: the “market share” framing dominating this topic is mostly unverifiable noise traced back to a survey that never asked the question. The real signal is quieter. OpenTofu is pulling developer attention away from both Terraform and Pulumi. Pulumi is responding by absorbing the one thing that used to separate it from Terraform entirely. And IBM’s ownership has turned a licensing dispute into a jurisdiction and governance question that has nothing to do with syntax.
Three things worth watching over the next six to eighteen months: whether Pulumi’s HCL support reaches full general availability and actually moves enterprise workloads, whether HashiCorp’s new capped free tier (effective March 31, 2026) pushes more teams toward OpenTofu, and whether a named enterprise like Fidelity’s reported OpenTofu migration gets an official confirmation rather than staying a secondhand claim.
If you’re deciding what to do with your own Terraform footprint right now, don’t anchor on a percentage you can’t trace back to a source. Anchor on what your team can actually observe: your provider coverage, your state hosting requirements, and how much of your organization’s new work is already quietly running on tofu instead of terraform.
Subscribe to The Neural Loop for the next update on this story, including GA confirmation on Pulumi’s HCL support and fresh registry numbers as they land.
DORA Report: AI Code Review Time Jumps 441% | NeuralWired
DevOps & Engineering
DORA Report: AI Code Review Time Jumps 441%
By the NeuralWired Engineering Desk · Updated July 2026 · 11 min read
Your team ships AI generated code faster than ever. Your review queue is where that speed goes to die. New data from Google’s DORA team and a 22,000 developer telemetry study from Faros AI both point to the same uncomfortable number: median time spent in code review is up 441.5% as AI adoption climbed, not down. If you’re an engineering leader who assumed AI code review would fix the bottleneck AI code generation created, the 2026 numbers say otherwise, and you need to see them before your next tooling decision.
Every AI coding tool vendor is currently selling some version of the same promise: write code faster, review it faster, ship it faster. The generation half of that promise is real. The review half is where the story falls apart.
Faros AI’s “AI Engineering Report 2026: The Acceleration Whiplash” is the most current dataset available on this question. It draws on two years of telemetry from 22,000 developers across more than 4,000 teams, comparing each organization’s lowest AI adoption periods to its highest. The headline findings:
Median time to first PR review is up 156.6%
Average time spent in code review is up 199.6%
Median time in review overall is up 441.5%
AI code acceptance rate rose from 20% to 60%
Faros AI sells engineering analytics software built on DORA metrics, so treat this as vendor research with a stake in the outcome, not a neutral academic study. Still, the direction of the finding lines up with Google’s own 2025 DORA State of AI Assisted Software Development report, produced with GitHub and IT Revolution. DORA’s framing is that AI acts as an amplifier: it strengthens teams that already have solid engineering practices, and it exposes the weaknesses of teams that don’t. Roughly 90% of developers now use AI daily, according to the report, but nearly a third, 30%, say they have little to no trust in AI generated code.
That distrust has a name in the DORA report: the “verification tax.” Time saved writing code gets spent auditing it instead, and that tax lands squarely on reviewers.
A note on the “4.2 hours vs 90 seconds” claim you might have seen elsewhere. That comparison doesn’t hold up against any primary source we checked. Real human review times range from roughly 4 hours at Google internally to 3 to 5 days at typical enterprise teams, and AI review tools themselves range from about 30 seconds (GitHub Copilot) to several minutes for deep-index tools like Greptile. We’re using the sourced numbers above instead.
Why Review Time Is Exploding, Not Shrinking
Kent Beck, the creator of Extreme Programming and a co-author of the Agile Manifesto, put it about as bluntly as anyone in the industry has:
“We’re accumulating code faster than we are accumulating trust.”
Kent Beck, “Trust Factory” newsletter, newsletter.kentbeck.com
That’s the whole problem in one sentence. AI generated code is, by multiple accounts, superficially convincing. It’s idiomatic. It’s well named. It reads like something a competent engineer wrote. Which is exactly why surface level review, the thing AI review tools are best at, becomes less useful over time: the bugs living in that code tend to be structural, not stylistic. Faros AI’s analysis makes the point directly, arguing that the engineers with the deepest system knowledge are the ones spending their most valuable hours unraveling plausible looking code that should never have reached them in that state.
An independent academic study published on arXiv in December 2024, still the most cited empirical study of its kind as of mid-2026, tested an LLM based automated review tool in real production repositories. Average PR closure time rose from 5 hours 52 minutes before the bot to 8 hours 20 minutes after, a statistically significant increase. Results varied by project. One project’s closure time dropped from 6 hours 6 minutes to 3 hours 7 minutes. Another rose from 20 hours 22 minutes to 30 hours 51 minutes. Roughly 73.8% of the tool’s comments were acted on, and developers reported a modest quality improvement, but the bot also introduced faulty reviews and irrelevant comments that added friction of its own.
Stack Overflow’s 2025 Developer Survey backs this up from the sentiment side: 84% of developers use or plan to use AI tools, yet 66% say their biggest pain point is AI output that’s “almost right,” and 45% say debugging AI generated code takes longer than debugging their own. Sonar’s State of Code 2026 survey of 1,149 developers found 96% don’t trust that AI generated code is functionally correct, but only 48% say they always review before committing. That gap between distrust and actual review discipline is worth sitting with.
The Benchmark Problem: Nobody Agrees What “Accurate” Means
Here’s the part that should worry anyone about to sign a contract with an AI code review vendor: the bug catch rate numbers those vendors publish don’t agree with each other, and they don’t agree with independent testing either.
Tool
Vendor-reported catch rate
Independent benchmark result
Greptile
82% (own 50-PR benchmark)
24% (Martian benchmark)
GitHub Copilot
54% (Greptile’s benchmark)
Not independently ranked in same test
CodeRabbit
44 to 51% (varies by benchmark)
46% (Macroscope’s ranking)
Cursor BugBot
Not separately vendor-reported
42% (Macroscope’s ranking)
Macroscope
Self-reported top performer
48% (its own ranking)
Source: Augment Code’s tool comparison, which flags the discrepancy directly, and buildmvpfast.com’s 2026 tool roundup. There is currently no independent, consensus benchmark for AI code review accuracy. Every number circulating in vendor decks was either run by the vendor or selected by the vendor. Treat any single “catch rate” claim as a marketing input, not a procurement fact, and run a short pilot against known bugs in your own codebase before you buy anything.
CodeRabbit’s own analysis of 470 pull requests, worth noting as vendor data about a competitor’s output rather than its own, found reviewers spend 91% more time reviewing AI generated code than human written code, with three times more readability problems and 75% more logic errors.
What This Means If You Run an Engineering Org
If you’re a VP of Engineering, a Director, or a staff engineer sitting on a tooling decision right now, here’s the shift that matters. Review is the bottleneck now, not code generation. If you’ve been measuring success by PRs merged or deployment frequency alone, you’re getting a misleading picture, because DORA’s and Faros’s data both show throughput metrics improving at the exact same time that stability metrics, change failure rate and rework rate especially, get worse.
DORA’s response to this was structural: the framework expanded from four metrics to five in 2024, adding “rework rate” specifically because AI driven throughput gains were making the old four-metric picture insufficient. That’s the metric to start tracking alongside deployment frequency, not instead of it.
GitHub’s own product team has landed on a position that’s becoming the de facto industry norm: a human always owns the merge button. From GitHub’s official blog:
The team’s interviews with developers found something specific worth stealing for your own workflow: running a Copilot self-review before opening a PR eliminated roughly a third of trivial back-and-forth comments. That’s the actual win available right now, catching the small stuff before a human ever sees the diff, not replacing the human’s judgment call on whether the change should exist at all.
Jon Wiggins, a machine learning engineer at Respondology, put the accountability question in plain terms:
“If an AI agent writes code, it’s on me to clean it up before my name shows up in git blame.”
Jon Wiggins, ML Engineer, Respondology · via github.blog
Any team that’s dropped the human merge gate entirely should be treated as an outlier taking on real production risk, not a leading indicator of where the industry is headed.
The Contrarian Case: 19% Slower, Not 20% Faster
The single strongest piece of contrarian evidence in this entire dataset comes from METR, the nonprofit Model Evaluation and Threat Research group. Its randomized controlled trial, reported in MIT Technology Review, found experienced developers believed AI made them 20% faster. Objective measurement of the same developers found they were actually 19% slower.
That’s not a survey. It’s a controlled study, which makes it much harder to wave away than the productivity claims coming out of vendor marketing. Mike Judge, a principal developer at the software consultancy Substantial, described the gap between perception and reality from the inside:
“I was complaining to people because I was like, ‘It’s helping me but I can’t figure out how to make it really help me a lot.’”
Mike Judge, Principal Developer, Substantial · via MIT Technology Review
Is the “AI review saves time” story realistic on a 2026 timeline? Not straightforwardly. The one controlled academic production study we found (the arXiv paper above) showed AI review increasing PR closure time. Any claim that AI review is a simple time saver needs that caveat attached, because in the best documented empirical test available, it wasn’t one.
GitHub Code Quality’s July Launch: A Real Test Case
There’s a genuinely useful stress test coming. GitHub Code Quality, the governance and quality gate product bundling CodeQL analysis with Copilot code review, moves from public preview to a paid, generally available product on July 20, 2026. More than 10,000 enterprises used the preview. Pricing lands at $10 per active committer per month on enabled repositories, plus usage based consumption for AI powered features like Copilot code review and Copilot Autofix.
Watch what happens to review time metrics at organizations adopting this over the next two quarters. If GitHub’s human-gated model actually closes the gap the data above describes, that’s the strongest real-world signal we’re likely to get all year.
