Traceability and Human Oversight
Traceability and human oversight refers, in the context of spec-driven development, to the relationship between what the method produces (the requirement-to-commit chain, the documented gates, and the constitution) and what the high-risk framework of the European Artificial Intelligence Act requires, applicable from August 2, 2026. The relationship is one of usefulness, not obligation: SDD is not mandatory, but its artifacts support the conformity file.
It is a recent issue, with professional practice still taking shape, so it is best approached with precision and without overstating claims.
What the high-risk framework requires
For AI systems classified as high-risk, the Regulation requires three things that affect development:
- Automatic logging of operations (art. 12), so that the system's operation can be reconstructed.
- Human oversight assigned to people with the necessary competence, training, and authority, which falls to the deployer (art. 26).
- Transparency about AI-generated content (art. 50).
These are obligations for those who build and deploy the system, with deadlines that have already passed for the main categories.
The boundary: the system, not the tool
It is easy to state something false here, so the scope needs to be made precise. What the Regulation regulates is the high-risk AI system the team builds—for example, one that decides on access to credit or employment—not the use of AI to program that system. A team's use of coding agents does not make it subject to these obligations, and not using them does not exempt it if its product is high-risk. This is the difference from AI governance and human-in-the-loop oversight understood in a generic sense: here the regulated subject is the product, not the method.
What SDD contributes to the compliance file
When the product is regulated, two pieces the method already had take on new value:
- The requirement → commit chain. Each atomic commit is linked to a task, each task to a design, and each design to a set of requirements; that chain is exactly the traceability a conformity file needs to explain why the system does what it does.
- Documented approval gates. Each gate records that a person with sound judgement reviewed and approved a document at a specific point in time, and that is evidence of human oversight over the build process.
These are joined by the project constitution, which sets down in writing the constraints the system must respect and serves as a statement of technical policy. None of the three pieces is created for the regulator, and all three serve it. That is the key: usefulness, not obligation.
What SDD does not cover
SDD does not, by itself, cover the Regulation's obligations. Automatic event logging is a property of the system in production, not of its construction process, and transparency about generated content is addressed in the product, not in the spec. A team that confuses the traceability of its method with the conformity of its system is making a serious mistake. What is certain, however, is that those who work with approved specs and traceable commits come to that conversation with more material than those who start from conversations nobody keeps.
Common mistake
Claiming that the Regulation makes SDD mandatory. The Regulation governs the high-risk system, not the method used to program it; the relationship is one of usefulness. Two paired errors follow from this: believing that using agents turns the team into a regulated party—what is regulated is what the product does, not how it was built—and confusing the traceability of the process with the conformity of the system, when the logging of operations and transparency are addressed in production.
Resources
📊 Guía didáctica SDD [SDD Teaching Guide, in Spanish]Resources · Scrum Manager
🏦 SDD en equipos ágiles [SDD in Agile Teams, in Spanish]Skill Arena · Scrum Manager
References
- Regulation (EU) 2024/1689 of the European Parliament and of the Council (Artificial Intelligence Act), Arts. 12, 26, and 50.
- DORA. (2026). ROI of AI-assisted Software Development.
See also
Want to advance in agility? You can search for course and exam calls or go at your own pace by becoming a member of the Agile Club. This membership includes exclusive resources, e-learning classrooms, and access to Skill Arena: a space to practice and measure your agile skills at your own pace.