The KISS Principle Was Never About Simplicity
What replaces it when machines write the code
On 2 August 2026, a deadline that thousands of engineering and risk teams spent two years building toward did not arrive.
The EU AI Act's obligations for high-risk systems were supposed to switch on. They didn't. Regulation (EU) 2026/1744 — the Digital Omnibus on AI — was published in the Official Journal on 24 July and entered into force three days later, pushing stand-alone high-risk obligations to December 2027 and embedded ones to August 2028.
The obvious reading is that regulators blinked, and that the compliance panic was overblown.
That reading has it exactly backwards. Look at why it moved: the harmonised standards and conformity assessment machinery weren't ready. Not the AI. The apparatus for proving things about the AI. Europe did not delay because the technology was slower than expected. It delayed because the ability to attest to the technology was slower than expected.
And note what did not move. Article 50 — disclosure when a user is interacting with an AI system, identification of deepfakes — applied from that same day. The obligation to mark synthetic content got a short transition for systems already on the market, and even that was tightened rather than loosened: the grace period was cut from six months to three, landing on 2 December 2026. Of everything on the calendar, the surviving obligation is the one about provenance. About proving what a machine made.
That is not a coincidence. It is the shape of the next decade.
What Kelly Johnson actually meant
The KISS principle comes from Kelly Johnson at Lockheed's Skunk Works, around 1960. The story is that he handed his engineers a set of basic tools and told them the jet they were designing had to be repairable by an average mechanic, in the field, under combat conditions, with nothing more than what was in front of them.
Read that again, because almost everyone quotes the acronym and forgets the constraint. Johnson was not making an aesthetic argument. He did not think simple things were prettier. He was solving for a downstream human — someone who would encounter the system later, under pressure, with limited context and limited time, and who had to understand it well enough to be confident in it.
Simplicity was never the goal. Simplicity was a proxy. It was the cheapest available heuristic for something harder to measure: can a human verify this?
The proxy worked for sixty years for one reason. The cost of building a system and the cost of understanding it scaled together. Complicated things were slow to write and slow to review. Keep it simple, and you got both — fast to build, fast to verify. The two constraints pointed in the same direction, so you only ever had to optimize for one.
That coupling is now broken.
The asymmetry
An agent can produce a four-hundred-line service in ninety seconds. It can write the tests. It can write the documentation. It can open the pull request and respond to review comments.
What it has not compressed by a single minute is the change management process that has to bless that service before it touches production. Or the evidence trail your auditor will ask for in eleven months. Or the control attestation. Or the model documentation your regulator expects if that service makes a decision about a human being.
Generation collapsed toward zero. Verification did not move.
The practical consequence is that teams are now producing artifacts faster than any organisation's ability to account for them. And the accounting is not optional — it is the part with statutory penalties attached.
Here is the uncomfortable part for anyone who still believes simplicity is sufficient: a beautifully simple function whose origin nobody can establish will fail an audit. A genuinely complex system with a complete, queryable evidence chain will pass one. The auditor is not grading your code. The auditor is grading your ability to make claims about your code and substantiate them.
Simple has stopped being the thing that gets you through the door.
KICS: Keep It Compliant & Simple
So the rule needs updating. Not replacing — updating. Simplicity still matters enormously; it has just been demoted from goal to instrument. You keep things simple because simple things are easier to prove, not because simple is virtuous on its own.
Keep It Compliant & Simple. In that order, because the order is the argument.
In practice, KICS resolves to three questions you should be able to answer about any system your organisation ships, at any moment, without a fire drill:
Where did this come from? Which model, which prompt, which version, which human accepted it, against which policy. Provenance is no longer a nice-to-have engineering hygiene concern; it is the substance of Article 50 and it is the first thing a serious auditor now asks.
Who authorised it? Not "was there a PR approval" but a defensible chain of accountability, in which a named human took responsibility for a machine-generated artifact and had enough context to do so meaningfully. Rubber-stamp review at agent throughput is not authorisation. It is theatre with a timestamp.
What did it do, and why? For anything touching a consequential decision about a person, the system must be able to explain itself after the fact — not with a post-hoc rationalisation, but with a real account of the inputs that drove the outcome.
Provenance, authorisation, explainability. If you cannot produce all three on demand, you do not have a system. You have an exposure.
Why financial services gets there first
Banks have been doing this for fifteen years without calling it AI governance.
The Federal Reserve's SR 11-7 guidance on model risk management has required documented model lineage, independent validation, and ongoing monitoring since 2011. Adverse action requirements under ECOA mean that if a model declines someone's credit application, the institution owes that person a specific, accurate reason — which is to say, American lending law has mandated model explainability since long before anyone was arguing about it on conference panels. Add DORA's operational resilience regime, PCI DSS 4.0's expanded requirements, and SOX controls over anything touching financial reporting, and the picture is clear.
Financial services already had KICS. It was called model risk management, and the industry mostly experienced it as a tax.
That tax is about to look like a moat. The institutions that spent a decade building model inventories, validation functions, and evidence pipelines are the ones that can adopt agentic development at speed, because they already have somewhere to put the evidence. The organisations discovering all of this in 2026 are the ones who will find that their velocity advantage evaporates at the compliance gate.
And this does not stay in finance. HIPAA's requirements around automated handling of protected health information do not care that a model generated the code. SOC 2 change management controls do not have an exemption for commits authored by an agent. GDPR's Article 22 provisions on automated decision-making apply to anyone processing European personal data. If you sell software to enterprises, your customers' auditors are already writing AI provenance questions into their vendor questionnaires.
Every regulated industry is converging on the same demand, and the unregulated ones are getting it from their customers instead.
The objection worth taking seriously
The honest counterargument runs like this: this is how you build a bureaucracy. Compliance-first thinking is how organisations become too slow to compete, and the last thing a technology this fast-moving needs is a governance function with veto power over every commit.
I have some sympathy for it. Compliance functions can absolutely calcify into pure friction, and plenty have.
But the choice is not between compliance and velocity. It is between compliance designed in and compliance retrofitted — and the Digital Omnibus is the strongest available evidence that retrofit does not scale. An entire continent, with two years of notice and enormous institutional resources, could not assemble the conformity assessment apparatus in time and had to grant itself a sixteen-month extension. Your organisation will not do better by improvising.
The teams getting this right are not adding review gates. They are moving the controls to generation time: policy encoded as executable rules that agents operate within, evidence emitted as a build artifact rather than assembled during audit season, provenance captured automatically at the moment of creation because reconstructing it later is impossible.
That is not bureaucracy. That is the same instinct Kelly Johnson had — design for the person downstream who has to trust this thing — applied to a world where the downstream person is an auditor, a regulator, or a customer asking a question you had better be able to answer.
Keep it compliant
Sixty years ago the constraint was a mechanic in a field with a wrench. Today it is an examiner with a document request and a statutory deadline.
The principle has not changed. Build so the person who comes after you can verify what you did. What changed is that simplicity alone no longer accomplishes that, because the volume and velocity of what we produce have outrun the human capacity to inspect it directly. Verifiability has to be engineered in deliberately rather than emerging as a happy side effect of restraint.
So: keep it compliant, and keep it simple, and know which one is doing the work.
Or, if you prefer the original spirit of the thing — keep it compliant, stupid. Johnson would have appreciated the bluntness. He was not being polite either.
