Enterprises Still Can't Govern Their AI Agents. Brussels Just Moved the Deadline.

OpenAI closed a $122 billion funding round on March 31, 2026. The same week, Anthropic accidentally leaked the full source code of its own coding agent. We covered both events in April as evidence that enterprises were racing to deploy autonomous systems they could not fully secure, next to a Cloud Security Alliance finding that nearly 70% of companies already run AI agents in production. That finding still holds.

What does not hold is the deadline we treated as the forcing function: the EU AI Act's August 2026 compliance date for high-risk AI systems no longer exists. The Council of the EU pushed it to December 2, 2027, in a package finalized June 29, and anyone who filed that date away in April is now working off the wrong calendar.

What actually changed since April

The shift is called the Digital Omnibus, and it does one specific thing. It moves the compliance date for Annex III high-risk AI systems, the category that covers most agentic deployments in hiring, credit and internal operations tools, from August 2, 2026 to December 2, 2027 for standalone systems, according to the European Commission's own AI Act service desk. Systems embedded in other products get until August 2, 2028.

Full conformity assessments, CE marking and the detailed documentation trail our original piece treated as urgent are on that new timeline now, not the old one.

One obligation did not move. Article 50, the transparency rule requiring that people be told when they are talking to an AI system and that AI generated content be labeled, still takes effect August 2, 2026, per the European Commission's Article 50 guidance. A support chatbot with no human disclosure is still non-compliant next week. A hiring algorithm with no full audit trail has 16 more months.

The identity numbers, updated

The Cloud Security Alliance and Strata Identity refreshed their agent-governance survey in March, and the more granular numbers are worse than the round figures our original piece cited. 82% of organizations say they lack confidence in their identity systems for AI agents, only 23% have a formal, enterprise-wide agent identity strategy, and 84% doubt they could pass a compliance audit focused on agent behavior or access, according to the CSA's own release.

Just 21% keep a real-time registry of what agents they have running. Only 28% can reliably trace an agent's action back to a specific human across every environment it touches.

The mechanism is architectural, not a training gap. Identity systems like Microsoft's Azure AD were built for login events: a human authenticates, a session opens, a person makes a judgment call. An agent has no session. It receives a token, completes a task, and stops. 44% of enterprises still authenticate those agents with static API keys, the CSA found, a method built for a service account that never changes scope, handed to a system that changes its plan on every run.

Anthropic's own leak is still the best evidence

If you want to see why governance is hard even at a company that sells security as a feature, Anthropic supplied the case study in the same week as the OpenAI round. A 59.8MB source map bundled into version 2.1.88 of the npm package for the leaked coding agent exposed roughly 513,000 lines of unobfuscated code across 1,906 files, first flagged publicly by security researcher Chaofan Shou, according to Axios.

The code was mirrored to GitHub and forked more than 41,500 times before takedown notices went out. Anthropic says no customer credentials were exposed and attributes the leak to human error in release packaging, not an attack.

That is the part worth sitting with. Nobody breached Anthropic's perimeter. A routine build step shipped a debugging artifact nobody meant to publish, and it stayed live long enough to spread past any single company's ability to pull it back. A three-layer governance framework built around agent tokens does not catch a leaked build file, which is exactly why visibility, not just access control, has to be the first layer, not an afterthought bolted onto identity work already underway.

This changes less than the delay suggests

The obvious reading of a 16-month extension is that enterprises can wait. That is wrong in two separate ways. First, Article 50 still lands on the original date regardless of what happens to Annex III, so any customer-facing agent without a disclosure banner is exposed next week, not in 2027.

Second, the exposure this piece is actually about was never primarily a Brussels compliance problem. Back in April, Iran's Islamic Revolutionary Guard Corps had already named 18 US technology firms as targets, Nvidia among them, over a threat set to expire April 1. Google was on the same list. None of the 18 confirmed a breach tied to that specific warning.

But a separate Iranian-linked campaign did not stay theoretical. CISA and six partner agencies confirmed through the following months that a group tracked as Cyber Av3ngers had compromised operational-technology equipment from Rockwell Automation, Siemens and Schneider Electric, using the vendors' own engineering software to disable safety alarms and falsify sensor readings. That is what an ungoverned access path costs in practice. No EU filing deadline changes it.

What to watch

Two dates matter more than August 2. The first is whether OpenAI or any other lab discloses an agent-specific security incident before December 2027, which would test whether the delay was a reasonable sequencing call or a compliance holiday nobody can defend later. The second is December 2, 2027 itself: if enterprise agent registries are still sitting at 21% coverage when Annex III actually arrives, the extension bought time nobody used.

Governance built for the deadline that vanished is not governance. The identity numbers say most companies do not have it yet, and agents like Claude Code are not waiting for Brussels to decide when that becomes everyone's problem.

Frequently asked questions

Did the EU delay the AI Act deadline for AI agent governance?

Yes, for the high-risk compliance category. The Council of the EU finalized the Digital Omnibus package on June 29, 2026, moving Annex III high-risk AI system obligations from August 2, 2026 to December 2, 2027 for standalone systems and August 2, 2028 for systems embedded in other products. Article 50's separate transparency rule, requiring AI disclosure to users, was not delayed and still applies from August 2, 2026.

What does Article 50 of the EU AI Act still require on August 2, 2026?

Providers and deployers must make clear that a person is interacting with an AI system, such as a chatbot or agent, at the start of that interaction. AI-generated or manipulated content, including deepfakes, must also be labeled. This applies regardless of whether the system counts as high-risk under Annex III.

How many enterprises are running AI agents in production without proper governance?

Nearly 70% of enterprises already run AI agents or assistants in production, according to a 2026 Cloud Security Alliance and Strata Identity survey. Of those, 82% report lacking confidence in their identity systems for governing those agents, and only 23% have a formal, enterprise-wide agent identity strategy.

What happened in the Anthropic Claude Code source code leak?

In March 2026, Anthropic accidentally published a 59.8MB source map inside a public npm package update for Claude Code, exposing roughly 513,000 lines of unobfuscated code. The code was mirrored and forked more than 41,500 times before takedown notices went out. Anthropic attributed the leak to human error in release packaging and said no customer credentials were exposed.

Why do traditional identity systems like Azure AD fail for AI agents?

Systems such as Microsoft's Azure AD were designed around human login events: a person authenticates, a session opens, and a human makes judgment calls during that session. An autonomous agent has no session in that sense. It receives a token, completes a task, and stops, which is why 44% of enterprises still authenticate agents with static API keys built for accounts that never change scope.

Covered in this guide

• its own coding agent: Claude Code scores 80.8% on SWE-bench Verified, reads entire codebases autonomously, and ships production PRs from your terminal. Pro plan starts at $17/mo.
• OpenAI: OpenAI builds the GPT-5.6 model family (Sol, Terra, Luna), o3, ChatGPT (900M+ weekly users), and the OpenAI API. Closed a $122B round at an $852B valuation in March 2026, the largest private funding round in history.
• Anthropic: Anthropic, founded 2021 by 7 ex-OpenAI researchers, builds Claude and was valued near $965B after its May 2026 Series H round.
• Google: Google (Alphabet, NASDAQ: GOOGL), founded 1998, serves 8B+ monthly Search users with Gemini 3.5, 190,820 employees, and $402.84B FY2025 revenue.
• Microsoft's Azure AD: Microsoft, founded 1975, is a $2.77T public company (NASDAQ: MSFT) with 228,000 employees and $245.3B FY2025 revenue. Copilot AI business run rate exceeded $37B in Q3 FY2026.
• Nvidia: Founded 1993, NVIDIA is the world's most valuable company (~$4.85T, July 2026), building the GPUs, CUDA stack, and open Nemotron models that run most of the AI industry.

Sources

• OpenAI closes funding round at an $852 billion valuation
• Claude Code Leak: Critical AI Security Threat 2026
• More Than Two-Thirds of Organizations Cannot Clearly Distinguish AI Agent From Human Actions
• Securing Autonomous AI Agents: CSA Survey Report 2026
• Transparency obligations under Article 50 of the AI Act
• EU agrees to delay key AI Act compliance deadlines
• Iran threatens Nvidia, Apple and other tech giants with attacks
• Iranian Hackers Infiltrate Siemens and Schneider PLCs, Blinding Operators With Fake Readings