Q1 2026, in one page

The quarter, compressed.

what happened#

Regulation got specific. The EU AI Act's high-risk obligations move from abstract to dated — 2 August. Post-quantum migration guidance firmed up across national agencies. The Cyber Resilience Act's reporting obligations approach. For the first time in a while, compliance work is a real line item on engineering roadmaps rather than a legal department concern.

Power stayed the constraint. Datacenter interconnection queues, transformer lead times, and utility rate cases continue to determine how fast compute capacity arrives. Nothing at GTC changed that; the roadmaps are downstream of the grid.

Agent tooling consolidated on conventions. Repository-level instruction files became standard practice. The delegated-agent product shape stabilized across vendors. The bottleneck stayed where it was: review.

The web platform quietly finished a decade of work. Container queries, :has(), popover, anchor positioning, view transitions — all baseline. The amount of JavaScript that can now be deleted from a typical application is larger than most teams realize.

the three pieces I would re-read#

"Verification is the whole job now" (8 January) — the argument that generation got two orders of magnitude cheaper and verification got no cheaper at all, and that everything else follows from that.

"Prompt injection is SQL injection without the fix" (9 February) — why the analogy everyone makes stops exactly before the part that matters, and what architecture actually holds.

"Schema design is the only design that lasts" (6 March) — your code gets rewritten, your schema does not.

the thing I got wrong#

In January I predicted review tooling would become a major funded category this year. Three months in, the funding is going to agent generation rather than agent review, which is the opposite of where the bottleneck is.

Either I am wrong about the bottleneck or the market is slower than I expected. Given that every practitioner I talk to names review as their constraint, I think it is the second, and I think it corrects.

what I am watching for Q2#

• Whether the August AI Act deadline holds or slips.
• Whether npm's publishing controls actually land and what breaks.
• Whether anyone ships a genuinely better code review interface.
• Node 26 and whether the no-build-step workflow becomes the default.
• Whether the small-model tier keeps compressing the frontier's addressable workload.

Back to normal programming on Wednesday.