Skip to content
Writing

The Review Shift Has a Prerequisite

March 21, 20264 min read
Technical
The State of Docs 2026 report landed this week with a clean finding: technical writers are spending less time drafting and more time fact-checking, validating, and reviewing AI output. The role isn't shrinking. It's being reshaped around what AI can't do: user empathy, product judgment, and the ability to make meaning out of complexity. This is accurate. And it's incomplete.
The review shift has a prerequisite: something has to produce the first draft. For API references, tutorials, and product docs, that prerequisite is met. Copilot drafts from code comments. Mintlify generates from OpenAPI specs. A writer reviews, corrects, adds context. The workflow works. For regulatory documentation, the prerequisite isn't met. The EU AI Act requires three categories of documentation for high-risk AI systems, all due August 2026: Article 11 (technical documentation following Annex IV), Article 12 (automatic logging and record-keeping), and Article 13 (transparency and user information). GDPR Article 30 adds a fourth: records of processing activities. No AI tool generates these from your codebase. Not ChatGPT. Not Copilot. Not the 130+ tools I surveyed across five categories. The current state of the art is questionnaires: a compliance platform asks what your system does, you fill in forms, a consultant produces a PDF. The industry charges $30K to $500K for this service. The writing-to-review shift doesn't apply here because there's nothing to review. The page is still blank.
The State of Docs team talked to practitioners at Docker, dbt Labs, New Relic, MongoDB, JetBrains, and others. Companies with AI-powered products. Companies with EU users. The August 2026 deadline applies to all of them. The report also found that teams believe documentation drives business value but struggle to prove it. This is the perennial docs problem: everyone agrees good docs matter, nobody can tie them to a number. Regulatory compliance documentation is the exception. The ROI proof is the requirement itself. You either have Annex IV documentation or you face enforcement action. There's no attribution model to argue about. There's no funnel to optimize. The business case is: do you want to operate in the EU after August? Yet the three industries that could build automated compliance documentation each have structural reasons not to. AI providers (Anthropic, OpenAI) won't interpret their own trace data against regulations. That's liability. Observability platforms (Langfuse, Arize) sell to engineers, not compliance teams; adding regulatory interpretation changes the buyer, the sales motion, and the support burden. GRC platforms (OneTrust, Vanta) start from policy and work toward data; connecting to actual codebases requires understanding OTel GenAI conventions and the gap between what LLMs log and what regulators need. Three industries. Same deadline. No shared buyer, expertise, or incentive to close the gap.
I built the generation layer. The AI Trace Auditor scans your codebase using Python AST parsing and regex, maps what it finds against regulatory requirements, and produces structured compliance documentation:
aitrace comply ./your-codebase --traces traces.json --split -o compliance/
Four outputs from one scan: Annex IV technical docs (Article 11), logging gap reports (Article 12), data flow diagrams with automatic GDPR role classification (Article 13), and a Record of Processing Activities (GDPR Article 30). I tested it on eight real codebases: three of my own projects and five major open-source frameworks (Haystack, CrewAI, LiteLLM, n8n, Dify). Auto-populates 33-56% of required documentation from code alone. The remaining sections require human judgment: risk assessment, intended purpose, legal basis, monitoring plans. That's the review shift applied to compliance. The tool writes the first draft from your actual code. A human reviews it, fills the gaps that require judgment, and signs off. Writer becomes reviewer. But only after something generates a draft worth reviewing.
One more finding from the report. Technical writers are only 35% of the people who care about documentation. The remaining 65% includes leadership (21%), engineers (15%), customer experience (7%), operations (6%), support and developer relations (5% each), and marketing (4%). Compliance documentation touches all of these groups differently. Legal needs Annex IV. Engineering needs data flow maps. Operations needs processing records. Leadership needs to know the deadline is met. None of them want to fill out a questionnaire. The tools that serve this 65% won't look like traditional documentation platforms. They'll look like CLI tools that run in CI/CD, produce artifacts engineers can review in pull requests, and generate reports that legal can file without learning a new platform.
The State of Docs 2026 is right about the direction. Writers are becoming reviewers. AI is handling more of the first draft. The role is consolidating around judgment, empathy, and contextual understanding. But the report describes a shift that's already happened for product documentation and hasn't started for regulatory documentation. The tools exist for one. They didn't exist for the other. Now they do. The question is whether documentation teams, compliance teams, and engineering teams can find each other across the gap before August.
The State of Docs 2026: stateofdocs.com/2026 AI Trace Auditor: github.com/BipinRimal314/ai-trace-auditor Previous: Three Industries That Don't Talk to Each Other