August 2, 2026 is when the EU AI Act's high-risk obligations reach full enforcement, and that date is now four days away. Article 12 of the Act requires a queryable record of AI-driven decisions, including whether each governance intervention was a hard gate or a soft gate. Most production agent deployments produce neither kind of record right now. The gap is structural, not just a matter of turning on more logging. Standard application logs tell you an API call occurred; they don't capture the system prompt version, the retrieved context, the tool execution history, or the reasoning that led to a given action. Regulatory-grade audit trails need to be tamper-evident by design: write-once storage with no update or delete operations, cryptographic batch signatures stored independently of the logs themselves, and periodic integrity checks that confirm records still match their stored hashes. There's a proposal circulating to push the deadline back to December 2027 via the EU Digital Omnibus, but as of this writing that extension hasn't become law, and teams building compliance infrastructure can't plan around a delay that doesn't legally exist yet. The harder problem underneath the paperwork is attribution in multi-agent systems. When a chain of agents spanning dozens of intermediate decisions causes harm, legal analysts broadly agree that responsibility still rests with the humans who design, deploy, authorize, or benefit from the system — autonomy redistributes accountability but doesn't erase it. Reconstructing which agent, and which human authorization, sits behind a specific consequential action becomes technically difficult once delegation chains get long, which is exactly the scenario regulators are now asking companies to document on demand. This is compounded by a visibility problem that predates the compliance deadline: a widely cited estimate holds that 82% of enterprises already have AI agents or workflows running that their security teams don't know about. You can't build a queryable audit trail for an agent your compliance team doesn't know exists. That's the quieter half of the August 2 deadline — before anyone gets to tamper-evident logging, they need an accurate inventory of what's actually running. The practical shift some teams are making is treating the audit trail not as a byproduct of the agent's operation but as the primary output of a governance layer that checks every tool call against policy before it executes, rather than reviewing logs after the fact. That reframing — enforcement and auditing as the same act rather than sequential steps — is likely to become the default architecture once enforcement actually starts.