The EU AI Act deadline moved. Your buyers' questionnaires didn't.

Five weeks before the EU AI Act’s high-risk obligations were due to apply, the EU moved the deadline. The Digital Omnibus on AI, adopted by the European Parliament on 16 June and given final approval by the Council on 29 June 2026, defers the stand-alone high-risk obligations from 2 August 2026 to 2 December 2027, and the obligations for AI embedded in regulated products to 2 August 2028. It enters into force once published in the Official Journal, expected this month.

If your company spent the last year building toward August, that’s a strange feeling. If it spent the last year waiting, it feels like vindication. Both readings miss what actually happened.

The whipsaw is the pattern now

The EU deferral is the third major reversal in twelve months. Colorado passed the first comprehensive US state AI law in 2024, delayed it in a 2025 special session, then repealed and replaced it in May 2026 with a narrower transparency law effective January 2027 — the original never took effect at all. A December 2025 executive order directed the US Justice Department to challenge state AI laws and ordered a federal preemption framework drafted, with outcomes still unresolved in the courts.

Meanwhile, quieter rules landed and stayed. Texas’s TRAIGA has applied since 1 January 2026, including patient-disclosure duties for healthcare AI. California’s SB 53 and AB 2013 took effect the same day, and AB 316 closed an argument before anyone seriously made it in court: it is no longer a defense that “the artificial intelligence autonomously caused the harm.”

Planning a multi-year compliance program against that backdrop, at any fixed snapshot of the rules, is planning against a moving target.

What never moves

Strip the dates away and look at what each regime demands, and the whipsaw resolves into something stable. The EU AI Act’s high-risk core is automatic logging (Article 12) and effective human oversight (Article 14), now due later, still due. Colorado’s replacement keeps pre-decision notice and post-decision explanation. Texas wants disclosure. The GPAI obligations that did keep their dates are documentation obligations, and the Commission’s power to enforce them begins 2 August 2026, deferral or no deferral.

Four artifacts keep recurring, in every regime, on every date: a log that can reconstruct what the system did, a human who can oversee and stop it, evidence the system was evaluated and works, and a process for when it doesn’t. Regulators disagree about deadlines. They have not disagreed about the artifacts.

The enforcement that matters has no deadline

For most companies selling AI-touched products, the binding constraint in 2026 was never a regulator. It’s the buyer’s security review. Enterprise procurement teams now routinely ask AI vendors for governance evidence: oversight design, logging, evaluation results, incident history, and increasingly a certification: ISO/IEC 42001 announcements have become a trust signal, with major model and cloud providers among the certified (Anthropic announced its certification in January 2025). In insurance, about half the states have adopted the NAIC’s model bulletin expecting insurers to run written AI governance programs and oversee AI vendors, which turns every insurer’s vendor list into an examination surface.

A questionnaire from your biggest prospect doesn’t get deferred by the Council. It arrives when the deal does, and “the EU moved its deadline” is not an answer to any question on it.

Build to the bar that survives every version

The rational response to regulatory whiplash is to stop tracking versions and build the invariant core once: logging, oversight, evaluation, incident response, with named ownership. That set satisfies the strictest plausible reading of the current rules, answers the procurement questionnaires that are live today, and has the useful property of also being what makes the system operable. It’s the same list as the Observability, Ownership, and Evaluation dimensions of the production-readiness bar, which is the point: compliance-durable and production-ready are mostly the same artifacts.

If your AI feature needs to survive both a buyer’s diligence and whichever version of the rules is in force when you ship, that’s what the AI production readiness engagement assesses: the artifacts, against the bar, before the questionnaire arrives.