fix(compliance): correct EU AI Act high-risk dates deferred by Reg (EU) 2026/1744

[peycheff-com]

What moved

Regulation (EU) 2026/1744 (Digital Omnibus on AI), adopted 2026-07-08 and in force 2026-07-27, amends Regulation (EU) 2024/1689 and defers application of Chapter III, Sections 1-3:

Obligation	Was	Is
Annex III high-risk	2026-08-02	2027-12-02
Annex I high-risk (regulated products)	2027-08-02	2028-08-02
Art. 50 transparency	2026-08-02	2026-08-02 — not deferred

Verified against EUR-Lex on 2026-08-06: CELEX 32026R1744, http://data.europa.eu/eli/reg/2026/1744/oj

Why this is not a documentation fix

Two of the six stale surfaces are not docs:

1. core/pkg/compliance/euaiact exported DateHighRiskObligations and DateAnnexIHighRisk as compiled time.Date values, with tests pinning them. Any caller comparing against these returned a wrong answer.
2. reference_packs/eu_ai_act_high_risk.v1.json ships as a GitHub release asset inside sample-policy-material.tar and is one of the packs cited as public evidence. Customers key compliance timelines off it.

Approach

A new v2 pack rather than an in-place patch, so nobody's timeline changes silently:

• eu_ai_act_high_risk.v2.json is canonical and now referenced by release.high_risk.v3.toml, the release staging and dry-run scripts, and the docs.
• v1 stays in the repo marked "status": "superseded" with superseded_by / superseded_on / superseded_reason. Its original values are preserved so previously shipped evidence remains auditable.
• The v1 key high_risk_full becomes high_risk_annex_iii — it was ambiguous once the two high-risk dates diverged — and transparency_art_50 is added so no reader concludes everything moved.
• v2 adds an enforcement_dates_provenance block: legal basis, source URLs, verified_on, review_owner, next_review. This is the durable fix — the estate audit found that externally-sourced values are shipped with no citation and no as-of date, so they rot silently.

Gates

go build ./... · go test ./pkg/compliance/... ./cmd/helm-ai-kernel/ · make docs-coverage · make docs-truth · make verify-boundary (1103 entries, manifest matches) — all green locally.

Needs your signature

docs/compliance/eu-ai-act-high-risk-pack.md is a public docs route (compliance/eu-ai-act-high-risk-pack), so this carries a public-surface change and is not self-merged.

Context

Found by an estate-wide truth audit of external claims (2026-08-06). The same superseded date sits in five further surfaces outside this repo — helm-ai-enterprise GTM positioning, autonomy model, and frontier-governance crosswalk, plus two Pricing Genesis lanes where it anchors a $50K price. Those follow in separate PRs. helm-ai-enterprise/docs/public/product/eu-ai-act-high-risk.md had already been corrected in isolation, which is how the fan-out was missed.

🤖 Generated with Claude Code

[strix-security]

Strix is installed on this repository, but we couldn't run this PR security review because this workspace's trial has ended. Add a card to resume code reviews here.