The EU Gave AI Governance Sixteen More Months. It Did Not Give You Less Work.

Most enterprises will read the AI Omnibus as relief. Sixteen months back on the high-risk obligations, a program that was running late suddenly running on time, and a slide that can be quietly updated before the next steering committee.

I think that reading is wrong, and the reason has nothing to do with Brussels.

The August 2026 date was, in many organizations, the only answer to "why are we doing this now?" It was a forcing function without which an AI system inventory would not have been built more carefully over a longer period. Noone would have build it at all!

What Actually Changed, and What Didn't

Three things are being reported as one thing, so lets separate them out:

What moved. The obligations attaching to high-risk systems. Conformity assessment, risk management, technical documentation, human oversight, the expensive parts. Standalone Annex III systems now have until 2 December 2027. AI embedded in products already regulated under Annex I has until 2 August 2028.

What did not move. The transparency obligations under Article 50, which apply from 2 August 2026. These are narrower than the shorthand suggests: they attach to particular categories of system and content rather than to every interaction, and the specific duty depends on what the system is and what it produces. Worth reading properly rather than summarising, because the summary version is where people get this wrong in both directions.

What this does not touch at all. Every obligation you have to customers, insurers, auditors and your own board about systems already in production. None of that was ever contingent on a European date.

So the accurate summary is not "AI Act delayed." It is that the expensive obligations moved, some visible ones landed, and the reasons you needed an inventory in the first place are exactly where they were a month ago.

The Time Nobody Allocates

A moved deadline hands back capacity. That capacity is spent immediately, on something with a live date, and it is rarely recovered when the deadline returns.

The tell is that nobody books it. When a deadline slips, no organisation records sixteen months as a resource and allocates them deliberately. The programme stops being urgent, the people doing the inventory get pulled onto whatever is on fire, and the calendar absorbs the difference without anyone deciding anything. Then the new date arrives with the same volume of work, a larger estate, and less institutional memory than before.

This is not a European phenomenon or an AI phenomenon. An external date was carrying a program that had no internal owner willing to carry it.

Why the Inventory Outlives the Regulation

Take the regulation out entirely for a moment.

Can you produce a list of every material AI system running in your company, who owns each one, what data it touches, which decisions it influences, and what happens if it is switched off? Material is doing real work in that sentence, because literal completeness is impossible once AI is embedded in features of products you buy. The question is whether you can account for the systems that would matter if something went wrong.

For most organisations above a few thousand people, the honest answer is no. And that is a problem that exists whether or not anyone in Brussels writes another word on the subject.

You cannot cost what you cannot list. You cannot retire it, consolidate it, renegotiate the contract underneath it, or describe it to an insurer. You cannot tell your board how exposed you are, because exposure is a ratio and you are missing the denominator. When a model provider changes terms, deprecates an endpoint, or has an outage, your ability to answer "what does this affect?" in hours rather than weeks is a function of a register that either exists or does not.

The inventory is not a compliance artefact. It is the asset register for the fastest-growing category of operational dependency in the company. The regulation was the invoice that got it funded.

What Sixteen Months Is Actually For

If you intend to spend the time rather than lose it, the useful distinction is between building this defensively and building it properly.

Defensive version: a spreadsheet assembled under pressure, listing the systems people remembered, accurate on the day it is submitted and wrong within a fortnight.

Proper version: a register that maintains itself because it is wired into procurement and deployment, so that a new model, agent or embedded feature cannot enter the estate without appearing on it. Retrofitting that is considerably harder than building it in, which is the argument for starting while the estate is still small enough to survey.

Three things worth checking this month, none of which need a budget line.

1. Ask whoever owns procurement how a business unit currently buys an AI-enabled tool. If the answer involves a corporate card and a click-through agreement, you do not have an inventory problem. You have an inventory impossibility, and that is the thing to fix first.
2. Pick one high-risk-adjacent system and try to answer the December 2027 questions about it today. Not to comply. To find out how long it takes. Then multiply by the size of your estate and decide whether the number you get is survivable.
3. Find out whether anyone has updated the programme plan since the Omnibus entered into force. If the plan still says August 2026, nobody has read the news. If it says December 2027 with unchanged resourcing, somebody read it and gave the time away.

The Honest Counter-Argument

There is a real case for the deferral and it deserves stating properly.

The obligations as originally drafted were, in places, difficult to satisfy on the original timeline. Harmonised standards were not ready. Conformity assessment capacity was thin. A deferral that produces workable rules in 2027 is better than a rush that produces documentation theatre in 2026, and people I respect hold this view without any hidden motive.

But that argument is about the quality of the eventual obligation. It says nothing about what happens inside your organisation between now and then. Those are separate questions, and only one of them is anybody else's responsibility.

The Artefact Test

Ask whoever owns your AI programme to name the artefact that would still be worth having if the AI Act were repealed tomorrow.

If they can name one, you have a programme. If the honest answer is "the documentation," you have a compliance response wearing a programme's clothes.

I would like to know which artefact people name. My guess is that the register comes up more often than anything else, and that almost nobody has one that updates itself. Tell me if yours does, and how.

Originally published on LinkedIn on August 11, 2026.