July 2026 Summaries

The European Union's deadline for compliance with high-risk AI systems has been extended, moving from August 2026 to December 2027 for standalone systems and August 2028 for systems embedded in regulated products due to unprepared technical standards, not changes in governance obligations. The EU's Digital Omnibus on AI enforces new regulations as of July 2026, maintaining the original deadline of August 2026 for Article 50 transparency rules and penalty powers for general-purpose AI models. Compliance teams in sectors like banking, insurance, and healthcare, which use AI for high-risk applications such as credit scoring and fraud detection, must now focus on establishing deterministic lineage to demonstrate the origin and transformation of data throughout their AI systems. This requirement remains unchanged despite the deadline extension, emphasizing the need for robust governance infrastructure to meet conformity assessments. Organizations that proactively build this infrastructure can utilize the extended timeline to refine their processes, while waiting could lead to a rushed compliance effort.

Oracle databases often remain central systems of record in enterprise data estates, but conventional governance and lineage tools designed for cloud warehouses frequently miss the PL/SQL procedures, triggers, batch jobs, ETL scripts, and database links that govern how Oracle data is transformed and distributed. This creates a visibility gap between Oracle and downstream warehouses, applications, reporting layers, and models, compounded by specialized teams whose operational knowledge may not be formally documented. Effective Oracle governance requires direct source-code analysis capable of parsing Oracle-specific SQL and procedural logic, tracing data from source tables through extraction and transformation processes to consuming systems rather than relying primarily on query logs. Foundational presents its platform as addressing this need through deterministic, code-based lineage that can reveal the downstream effects of Oracle schema changes across the broader data estate.

On April 17, 2026, the Federal Reserve, OCC, and FDIC issued SR 26-2, which supersedes the longstanding SR 11-7 guidance, to update model risk management expectations for traditional statistical and machine learning models used in banking. Notably, SR 26-2 excludes generative and agentic AI models from its scope, leaving banks to independently devise and justify their governance approaches for these AI systems, which are not covered by any prescriptive federal framework. This shift places the onus on banks to demonstrate control over AI systems that impact credit, underwriting, and operational decisions by documenting data lineage and decision logic through source code analysis, rather than relying on compliance checklists. As banks navigate this regulatory gap, they must prepare to substantiate their AI governance practices during audits, emphasizing the importance of creating a reconstructible record of AI processes to meet examiner expectations.

Organizational reliance on catalog tools for data lineage is often compromised due to their inability to trace data transformations that occur outside SQL environments, such as in Python scripts, Java services, and ORMs, leading to incomplete lineage graphs, especially during audits or AI-driven processes. Catalog tools typically infer lineage from SQL query logs and warehouse metadata, which only cover data movements and transformations within the warehouse, but fail to account for operations performed at the application layer where most business logic resides. Deterministic lineage, derived directly from source code, offers a solution by tracing data transformations across all layers of a system, ensuring a complete and accurate representation of data flow from origin to destination. This approach helps address governance and compliance issues by providing a precise lineage map that reflects actual system behavior, allowing for better data trust and management. Companies like Lightricks have successfully integrated source code-based lineage, resulting in improved data issue prevention and alignment between lineage graphs and codebases, without needing to replace existing catalog tools.

Compliance with regulations like GDPR and CCPA requires organizations to trace the full journey of personally identifiable information (PII) fields across all systems, not just their current storage location in data warehouses. While traditional PII inventory tools scan warehouse metadata to identify where sensitive data resides, they fall short of tracing the path PII fields take through application layers, such as signup forms, ORM mappings, and backend services, before reaching the warehouse. This oversight can lead to compliance challenges during audits or data requests. Source code analysis addresses this gap by tracking PII from its creation in application code through every system it traverses, providing a more comprehensive view of data handling. This approach, exemplified by platforms like Foundational, enhances PII governance by ensuring that all transformations and transfers are accounted for, turning complex compliance inquiries into straightforward queries. By adopting cross-platform lineage tracing, organizations can significantly reduce potential data issues and improve response times to data subject access requests, ultimately leading to more robust and defensible compliance programs.

Banks face significant challenges in meeting the Comprehensive Capital Analysis and Review (CCAR) and Basel Committee on Banking Supervision's BCBS 239 requirements, which demand stringent proof of data accuracy and lineage rather than mere documentation. These standards require banks to provide a verifiable and reproducible path showing how risk and capital planning data are generated and transformed from their original source systems to final reporting, a process not satisfied by warehouse-level lineage alone. Established banking systems, often comprising legacy core platforms and newer cloud infrastructures, complicate this task as data frequently moves through multiple systems and transforms, which can obscure its origin. BCBS 239, introduced in response to the 2008 financial crisis, emphasizes the need for reliable risk data aggregation and risk reporting capabilities, while CCAR focuses on the verifiability of capital planning submissions. To comply, banks must leverage tools like source code analysis to map data lineage directly from the systems and application code that generate and manipulate data, ensuring an evidence trail that withstands regulatory scrutiny, thereby transforming regulatory reviews into straightforward verifications rather than protracted negotiations.

Addressing the gap between data catalog tools and comprehensive data governance platforms is crucial for organizations facing regulatory scrutiny and AI oversight. While data catalog tools are effective for indexing warehouse metadata and providing lineage diagrams based on SQL logs, they fall short of tracing the full data journey from origin through application layers, which is essential for verifying data provenance and transformations. A genuine data and AI governance platform extends beyond the warehouse by reading source code directly—covering Python services, Java applications, and AI feature pipelines—to produce deterministic lineage and ensure full traceability. This distinction is vital for audit readiness and regulatory compliance, as these platforms can answer questions about data origin that catalog tools cannot. Companies like Lemonade have seen benefits in regulatory processes by adopting platforms like Foundational, which complement existing catalog investments by providing comprehensive visibility into data's entire lifecycle.

AI governance hinges on trust in data, necessitating thorough cross-platform lineage and complete metadata that trace data back to its origin, rather than merely cataloging its current location. This meticulous tracing is critical for complying with regulations like the EU AI Act, which demand clear documentation of data provenance in AI systems. Many current data foundations fall short, focusing on warehouse-level summaries instead of source-level origins, thus leaving gaps in verifying model inputs. Deterministic lineage, drawn directly from source code, provides a robust solution by offering precise, repeatable paths from data creation to its final application in AI models. Foundational's platform exemplifies this approach, integrating source code analysis with existing data infrastructure to enhance governance maturity and ensure AI systems are defensible under scrutiny.