Issue #28
"Deregulation Is Not Relief"
THE TAKE
Brussels blinked. Under the Digital Omnibus agreed in May, the EU AI Act's high-risk obligations for Annex III systems — hiring, credit scoring, law enforcement — slid from August 2, 2026 to December 2, 2027, and Annex I systems embedded in regulated products moved to August 2028. Washington is pushing the same way: Executive Order 14365 stood up a DOJ AI Litigation Task Force to challenge state AI statutes and told agencies to weigh state alignment when awarding federal funds. Two governments signaling less regulation in the same year. Predictably, AI governance programs got quietly deprioritized.
California is developing a separate oversight path. SB 813 addresses independent verification organizations, while AB 1405 addresses registered auditors. SB 813 does not require every developer or deployer to obtain an independent audit. On September 18, the governor called for recommendations on potential onsite verification and emergency shutoffs; those measures are still being developed, not universal current mandates. Customer and insurer requirements can also shape governance work alongside applicable law.
The delay postponed specified high-risk obligations; it did not remove other applicable duties. Customer and insurer requirements may arrive before some delayed deadlines. Build a defensible AI inventory, document risk classification and human oversight, and prepare evidence for review. A shared evidence base can support these requirements, but it still needs to be mapped to each applicable obligation.
THREE THINGS BOARDS SHOULD KNOW
- Delayed is not repealed — Annex III moved to December 2027 and Annex I to August 2028, but the AI Act's transparency and AI-content disclosure obligations still land on the 2026 schedule.
- Independent assurance is developing — California distinguishes independent verification organizations under SB 813 from registered auditors under AB 1405. Check which duties apply before treating an audit as required.
- Federal challenges do not automatically suspend state laws — track applicable requirements, effective dates and relevant court orders.
THE QUESTION I'M HEARING
"Brussels pushed the deadline. Can we slow down our AI governance spend?"
No — but change what you're buying with it. Shift money out of legal interpretation and into evidence production. The delay postponed specified high-risk obligations; it did not remove other applicable duties. You still need to know which AI systems you operate, what decisions they influence, whose data they touch, and who owns them.
Commercial requirements can arrive before delayed regulatory deadlines. Legal obligations still apply according to your systems, sector and jurisdiction. Check what your customers and insurers require at onboarding, contract review and renewal. Preparing evidence early can reduce last-minute work.
The recommendation is unglamorous and it works: one system of record for AI inventory and risk classification, mapped to ISO/IEC 42001:2023 and the NIST AI RMF, owned by a named executive who reports to the board quarterly. Do not build twelve frameworks for twelve jurisdictions. A shared evidence base can support these requirements, but it still needs to be mapped to each applicable obligation.
THE BOTTOM LINE
The deadline moved; the expectation didn't. Your auditors, insurers, and customers are writing the rules that will actually bind you — and not one of them granted an extension.