August 2 came and went. That was the date the EU AI Act's high-risk obligations were supposed to take effect, the one compliance teams have had circled for two years. The EU folded those obligations into its Digital Omnibus package instead, and the deadline moved to December 2027. Colorado's AI law has been delayed, blocked in court and replaced with a different law since I started tracking it. The regulatory forcing function for AI governance keeps receding.
So if your firm's AI governance program existed because of those dates, it just got sixteen months of permission to stall.
I think the delay is useful. It sorts the programs worth having from the ones that were compliance theater with a countdown clock.
The deadline was never the reason
Financial services didn't need an AI statute to make governance real. The Fed published SR 11-7, its guidance on model risk management, back in 2011 (that guidance is older than Kubernetes). Banks have spent fifteen years validating models, documenting their limits and answering for their behavior. The muscle predates the hype cycle by a decade.
And the real pressure in a regulated firm has never come from a statute's effective date. It arrives after something breaks, when the examiner sits down and starts asking questions. Nine days ago I wrote about the four that shaped my career at Moody's and Edward Jones: who approved this, how does it roll back, how many customers can it hurt, how will you prove what happened. No AI-specific law makes those questions apply. They already do.
Incidents don't publish their effective dates.
The same four questions, asked about a model's diff
The questions survive contact with AI-assisted delivery just fine. The place you have to build the answers moves.
Who approved this? A person did, or nobody did. The model can't approve its own output (I wrote a whole post on that one). Generation is now nearly free, which makes approval the scarce resource. Somebody in your firm has to decide who holds it, at what risk threshold, with what evidence in front of them. Most firms haven't decided. They've just noticed the PR queue getting longer.
How does it roll back? At Moody's in 2019 I proposed a change-management rule I still follow: every change scoped so it can be finished and rolled back inside 12 hours, no bundling. AI makes bundling more tempting than it's ever been, because the marginal cost of "while we're in here" dropped to zero. Hold the line anyway. Small reversible changes were good discipline when humans wrote them. Now they're survival.
How many customers can it hurt? Blast radius has to move upstream of the tool. You scope what an agent can touch before it runs: which repos, which environments, which data classes. Permissions are the new change window. If the tool can reach it, assume some Tuesday it will.
How will you prove what happened? The commit trail used to be where the story started. Now it's where the story ends. The model, the prompt, the context and the human review all need to land in the evidence trail, because "the AI did it" will not survive its first meeting with an examiner.
model ---+
prompt --+--> diff --> human review --> commit --> production
context -+
|________ what the examiner will ask for ________|
The commit used to open the evidence trail. With AI-assisted delivery, everything the examiner wants happens before it.
Regulated scale is an advantage now
For the first time in my thirty years, the financial services operating model is a head start.
Fiserv already operates golden paths for 7,500 developers under the same regulatory constraints everyone else complains about. At Edward Jones, getting GitOps to a yes took six months of architecture review, and that yes held for years because every objection got surfaced while it was cheap to fix. Slow approval, durable trust. The pattern works.
Startups spent two decades optimizing the other thing: shipping speed. Then generation got cheap and shipping stopped being the bottleneck. Answering for what you shipped is the constraint now, and regulated firms have run on exactly that muscle since before DevOps had a name.
There's one failure mode that erases the whole advantage, and I've watched it happen. It's classifying AI coding tools as developer convenience instead of infrastructure. GitOps got six months of scrutiny at a firm where Copilot got a pilot program and a Teams channel. Tools that write production code are infrastructure. Review them like infrastructure and hold them to the same rollback story you'd demand from anything else touching prod.
What to build during the sixteen months
Cheap, concrete, no statute required.
Start with inventory. Which AI tools are in use, touching which repos, under whose approval? Most firms can't answer this today, and it's a one-week exercise.
Write the acceptable-use boundary next, before the first incident instead of after. What can agents touch, what needs a human with authority, what's off limits entirely.
Then instrument. Acceptance rate, review time and defect escape rate on AI-assisted PRs, measured at the delivery layer, not the vendor-dashboard layer. Two months of your own data beats any benchmark a vendor will show you.
And audit yourself before anyone else does. I ran that audit on my own 41-repo framework on July 1 and found green checkmarks hiding two months of nothing. It stung. It was also free. The same finding in a regulator's report wouldn't have been.
None of this waits on Brussels or Denver.
When December 2027 finally arrives, the firms that built for their own reasons will spend a week mapping controls they already run onto whatever the final annex says. The firms that waited will be starting from the inventory step with interest due.
The deadline moved. The questions didn't.
Top comments (0)