When the regulator reads the docs

For virtually the entire existence of technical writing, manuals have existed for three reasonably harmless groups of people. Developers read them to assemble things, architects read them to plan things, and support engineers read them to discover why those things have exploded into a thousand smoking pieces. They read simply to get on with their day. But on 2 August 2025, the European Union entered the chat, meaning providers of general-purpose AI models suddenly found themselves saddled with a fourth, deeply humorless reader: someone who reads documentation purely to see if they can catch you out on a technicality.

The European AI Office can drop by whenever it pleases and demand your full technical portfolio. A third-party firm trying to build an app on your foundation model can demand the exact specifications needed to save their own skin, and the official Code of Practice gives you precisely 14 days to hand it over. And inside your own building, an increasingly terrified compliance officer needs to be able to present water-tight proof before the inspectors even finish taking off their coats. These people have zero interest in your Python endpoints. What they want to know is which Git commit produced that claim, which training run justifies it, and precisely which human being is prepared to stake their career on its accuracy.

This is fundamentally an information architecture problem masquerading as a catastrophic legal hazard. Which means it belongs on the technical writers' desks, because we already have the tools to sort it out. We shall examine this through two lenses: the weary writer trying to tame the content, and the engineer who actually owns the underlying facts. And then we will look at the cold, hard numbers for the enterprise.

On the new reader

Article 53 of the EU AI Act saddles every general-purpose AI provider with three separate documentation burdens. You must maintain deep technical documentation for the authorities under Annex XI, provide system integration information to downstream builders under Annex XII, and publish a comprehensive public summary of everything your scrapers digested during training. The Digital Omnibus on AI, Regulation (EU) 2026/1744, kicked the deadlines for high-risk systems down the road to late 2027 and 2028. But these core documentation duties? They didn't budge an inch.

As of 2 August 2026, Brussels can fine a company up to €15 million or 3% of total worldwide turnover—whichever hurts more. And right near the top of their list of unforgivable sins is handing over documentation that is incomplete, out of date, or just plain wrong. Google willingly signed the Code of Practice back in July 2025, which means agreeing to preserve every iteration of this technical evidence for at least ten years. Ten. Entire. Years.

Across the Atlantic, the NIST AI Risk Management Framework remains technically voluntary, though NIST is currently giving it a thorough overhaul. Yet its requirements read like a checklist of things you ought to have written down anyway: GOVERN 1.6 requires a meticulous inventory of all deployed models, MAP 2.2 insists on documenting cognitive blind spots and human safeguards, and MEASURE 2.9 expects the entire system to be rigorously tested, validated, and explained in clear prose. In AEGIS, these aren't treated as panic-inducing audit inquiries; they are simply treated as automated requirements within the pipeline.

Look at that list through the eyes of an experienced documentation architect. These aren't terrifying legal hurdles; they are audiences. Each has a specific deliverable, distinct clearance parameters, and tailored output targets. We have been solving this exact problem for twenty-five years using modular DITA maps, metadata profiling, and conditional reviews.

In source code, it looks delightfully simple. A regulatory requirement is managed by the documentation architect as a self-contained reference topic. It outlines the expectation in plain English and embeds the statutory citation right in its metadata so the final compiler knows where to point.

<reference id="aia-xi-2d">
  <title>Annex XI 2(d): computational resources used for training</title>
  <shortdesc>Describe the compute used to train the model, such as
    floating point operations and training time.</shortdesc>
  <prolog><metadata>
    <othermeta name="legal-source"
      content="Regulation (EU) 2024/1689, Annex XI, Section 1, point 2(d)"/>
    <othermeta name="required-for" content="authority"/>
  </metadata></prolog>
</reference>

A requirement is a topic, so it has an owner, a history and a review, like any other content.

<reltable title="Gemma 4 · Annex XI">
  <relheader>
    <relcolspec type="reference"/>  <!-- requirement -->
    <relcolspec type="reference"/>  <!-- evidence -->
  </relheader>
  <relrow>
    <relcell><topicref keyref="aia.xi-1e"/></relcell>
    <relcell><topicref href="gemma4/modalities.dita"/>
             <topicref href="gemma4/io-formats.dita"/></relcell>
  </relrow>
  <relrow>
    <relcell><topicref keyref="aia.xi-2d"/></relcell>
    <relcell><topicref href="gemma4/training-infrastructure.dita"/></relcell>
  </relrow>                        <!-- link proposed by AEGIS, approved in PR #457 -->
</reltable>

The evidence map is a separate map that only AEGIS builds, so these links never appear on the published model card.

<concept id="gemma4-languages" audience="public">
  <title>Language support</title>
  <prolog>
    <critdates><revised modified="2026-07-30"/></critdates>
    <metadata><othermeta name="model-version" content="gemma-4"/></metadata>
  </prolog>
  <conbody>
    <p>Gemma 4 is pre-trained on <ph keyref="gemma4-langs-pretrain"/> languages.
       It supports <ph keyref="gemma4-langs-supported"/> languages out of the box.</p>
  </conbody>
</concept>

The 140 and the 35 from the model card become two keys with two labels. Every pack, and the public page, reads the same values.

<val>
  <prop att="audience" val="public"     action="include"/>
  <prop att="audience" val="downstream" action="include"/>
  <prop att="audience" val="authority"  action="exclude"/>
</val>

One source builds three packs: public, downstream and authority. Each profile only adds audiences, so no reader gets a narrower audience's topics.

Once this plumbing is fastened together, the writer's life becomes remarkably civilized:

• Answer once. You wire a statutory requirement to an evidence topic exactly once in a pull request. From that moment on, every future dossier compiles automatically. Cost to handle the next request? Virtually zero.
• Drift becomes a broken test. If a technical chapter falls behind the current model build, check_currency trips an alarm in CI, unless it's drawing dynamically from updated keys.
• Gaps trigger early warnings. check_coverage audits the map and flags every unanswered requirement immediately. For those holes, Gemini proposes an existing topic, which a human architect either approves or rejects with a single click.
• Writers do actual writing. Feedback arrives as normal Git comments on lines of code, rather than panicked emails from lawyers asking what on earth a FLOP is.

Modelled for this post, not measured. The writer's share of the 32-hour manual pack in Figure 9.

The technical writing team already maintains the source of truth. The modern regulator simply insists we prove it.

On developers and facts

Engineers possess the raw data that regulators obsess over: GPU counts, petawatt-hours, compute calculations, evaluation benchmarks. Right now, developers are peppered with queries from every corner of the enterprise. Legal wants the compute stats for a memo. Compliance demands training metrics for a spreadsheet. And confidential hardware figures are flung across the company as insecure email attachments.

Then consider the poor sod building an application on your platform. They are legally required to integrate your model responsibly under Annex XII, yet they are forced to squint at a glossy marketing webpage and guess which performance metrics are actually up to date.

Google sorted out this philosophy years ago. In Software Engineering at Google, the doctrine is iron-clad: documentation should be treated exactly like code, documents must have explicit owners, and every change must pass through standard code review. AEGIS simply applies that exact same engineering discipline to regulatory compliance. A fact is a key. Its steward is a code owner. And its compliance sign-off is a regular Git review.

<map>
  <title>Gemma 4 training facts (authority only)</title>
  <keydef keys="gemma4-train-hardware" audience="authority">
    <topicmeta><keywords><keyword>[value from the training lead]</keyword></keywords></topicmeta>
  </keydef>
  <keydef keys="gemma4-train-flops" audience="authority">
    <topicmeta><keywords><keyword>[value from the training lead]</keyword></keywords></topicmeta>
  </keydef>
</map>

Placeholders, because these values aren't public. The engineer edits one file. Every authority pack picks up the change, and no public build can resolve these keys.

# Facts: only research engineering can approve a change
/keys/gemma4-authority.ditamap      @gemma-research-eng
# Requirements and links: the information architect
/requirements/                      @docs-ia
/maps/*-evidence.ditamap            @docs-ia
# Model docs: the Gemma writers
/gemma4/                            @gemma-docs

GitHub requests a review from the code owner of every file a pull request changes²¹. check_approval reads that review history. The agent's account is never a code owner.

on:
  pull_request: { paths: ["keys/**", "gemma4/**", "maps/**", "requirements/**"] }
jobs:
  evidence-checks:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: aegis check --set annex-xi --profile authority
      - run: aegis check --set annex-xii --profile downstream --leak-test

The checks run like a linter on every pull request, so a problem shows up while the author still has the change open.

$ aegis check --set annex-xii --profile downstream --leak-test
coverage      11/11 requirements answered
currency      12/12 topics current for gemma-4
approval      12/12 approved by a code owner
consistency   FAIL gemma4/io-formats.dita:41
              key gemma4-train-flops has audience="authority"
              and resolves in the downstream build
consistency   WARN gemma4/modalities.dita:18
              literal "video" has no key; modality table lists text, image, audio
result: blocked · 1 leak · fix the conref or move the sentence

Sample output. A leak fails the build with a file and a line, before the content reaches a downstream provider.

On AEGIS

AEGIS is built on Google's open-source Agent Development Kit. It operates as a stateless Cloud Run job—spinning up on demand, handling the request, and shutting down immediately on the standard GCP free tier. GitHub holds the master XML and code reviews, while a locked Cloud Storage bucket holds the compiled dossiers. Once a retention policy is locked in Google Cloud, not even an executive with a panic attack can shorten or delete it.

{
  "req": "aia.xi-2d",
  "topics": ["gemma4-training-infrastructure"],
  "revised": "2026-07-30", "commit": "9c41e7a",
  "approved_by": "training-lead", "pr": 462,
  "link": { "proposed_by": "propose_mapping", "confidence": 0.86,
            "approved_by": "information-architect", "pr": 457 }
},
{
  "req": "aia.xi-2e", "topics": [], "checks": "gap",
  "decision": { "by": "compliance-lead", "date": "2026-10-20",
                "note": "energy estimate due with next release; issue 458" }
}

Sample values. A link that Gemini proposed is labelled as proposed, with the person who approved it. The gap is in the pack, with a decision.

On the organisation

Now, let's talk about money. What follows is a modelled projection rather than laboratory measurements, but the assumptions are deliberately stripped down so you can plug in your own reality. The hourly rates are median wage statistics from the US Bureau of Labor Statistics for May 2025: $43.46 for technical writers, $38.81 for compliance officers, and $64.44 for software engineers. That completely ignores corporate overhead and large-tech compensation packages, so these savings are conservative to the point of absurdity.

Saved hours are merely the most obvious benefit. There are three significantly more compelling advantages for the business:

• Evidence that actually holds up in an audit. Every technical claim in a released dossier cites its exact Git commit hash, its last modification timestamp, and the verifiable human who signed off on it. In a manual copy-paste workflow, that level of provenance is precisely zero percent.
• Drastically reduced regulatory exposure. Article 101 fines can reach up to 3% of global annual turnover for misrepresenting facts to European authorities. While predicting an audit fine is an impossible guessing game, AEGIS guarantees that every single claim is verifiably true as of a named repository commit, and any known technical gaps are explicitly disclosed with an authorized decision.
• Software that becomes cheaper over time. Operating costs run in literal pennies on Google Cloud's free tier. Every approved relationship link removes future model costs, and each newly introduced regulation reuses the exact same testing harness.

Technical writers have always quietly maintained the company's true technical reality. The only difference now is that international regulators are demanding we prove it on paper. Armed with a basic DITA relationship table, audience profiles, and Git revision history, we can deliver that proof effortlessly. And AEGIS turns that entire legal defence into an automated CI build step.

The complete architectural specification—complete with sequence diagrams, agent tool definitions, and a runnable test harness—is hosted in the AEGIS design document³. If you manage complex model documentation or own the underlying performance data, I should be delighted to hear where your current setup would break down under an actual audit.

References

1. Google Developers, "Site Policies." developers.google.com/site-policies
2. Google AI for Developers, "Gemma 4 model card," last updated 30 July 2026. ai.google.dev/gemma/docs/core/model_card_4
3. Siddharth Rao, "AEGIS," design document v0.1. siddharthraop.github.io/AEGIS
4. Google AI for Developers, "Gemma models overview," last updated 8 July 2026. ai.google.dev/gemma/docs/core
5. Regulation (EU) 2024/1689 (Artificial Intelligence Act), EUR-Lex. eur-lex.europa.eu/eli/reg/2024/1689/oj
6. EU AI Act, Article 53. artificialintelligenceact.eu/article/53
7. EU AI Act, Annex XI. artificialintelligenceact.eu/annex/11
8. EU AI Act, Annex XII. artificialintelligenceact.eu/annex/12
9. EU AI Act, Article 101. artificialintelligenceact.eu/article/101
10. "Digital Omnibus on AI," Regulation (EU) 2026/1744. artificialintelligenceact.eu/ai-act-explorer/digital-omnibus
11. ActuIA, "AI Act: obligations in force and delays under omnibus 2026/1744." actuia.com/en/news/ai-act-obligations-in-force-and-delays-under-omnibus-2026-1744
12. European Commission, "The General-Purpose AI Code of Practice." digital-strategy.ec.europa.eu/en/policies/gpai-code-practice
13. AI Act Explorer, "Overview of the Code of Practice." artificialintelligenceact.eu/code-of-practice-overview
14. TechCrunch, "Google says it will sign EU's AI code of practice," 30 July 2025. techcrunch.com/2025/07/30/google-says-it-will-sign-eus-ai-code-of-practice
15. NIST, "AI Risk Management Framework." nist.gov/itl/ai-risk-management-framework
16. NIST AI 100-1, "AI RMF 1.0," January 2023. nvlpubs.nist.gov/nistpubs/ai/nist.ai.100-1.pdf
17. OASIS DITA 1.3, "reltable." docs.oasis-open.org/dita/dita/v1.3/os/part1-base/langRef/base/reltable.html
18. DITA 1.3, "Conditional processing (profiling)." dita-lang.org/1.3/dita/archspec/base/condproc
19. Tom Manshreck, "Documentation," in Software Engineering at Google, chapter 10. abseil.io/resources/swe-book/html/ch10.html
20. Google Cloud, "Bucket Lock." docs.cloud.google.com/storage/docs/bucket-lock
21. GitHub Docs, "About code owners." docs.github.com/.../about-code-owners
22. Google, Agent Development Kit documentation. github.com/google/adk-docs
23. Google AI for Developers, "Structured outputs." ai.google.dev/gemini-api/docs/structured-output
24. Google Cloud, "Free Google Cloud features." cloud.google.com/free
25. U.S. Bureau of Labor Statistics, "Technical Writers," Occupational Outlook Handbook, May 2025 data. bls.gov/ooh/media-and-communication/technical-writers.htm
26. U.S. Bureau of Labor Statistics, "Compliance Officers," Occupational Outlook Handbook, May 2025 data. bls.gov/ooh/business-and-financial/compliance-officers.htm
27. U.S. Bureau of Labor Statistics, "Software Developers, Quality Assurance Analysts, and Testers," Occupational Outlook Handbook, May 2025 data. bls.gov/ooh/computer-and-information-technology/software-developers.htm