The AI rulebook timelines moved. Your controls should not
The EU delayed its high-risk AI deadlines, Colorado replaced its AI Act, and insurance regulators are piloting AI evaluation tools. Why we keep building to the stricter standard anyway.
If you were planning AI compliance around dates set a year ago, most of them have changed.
The EU pushed back high-risk deadlines
The EU's Digital Omnibus on AI was published on July 24 and entered into force on July 27. High-risk obligations for Annex III systems, such as those used in employment and education, now apply from December 2, 2027, and from August 2, 2028 for products covered by Annex I. Article 50 transparency obligations still applied from August 2, 2026, with a transition to December 2, 2026 for labelling outputs of generative systems already on the market.
Colorado replaced its AI Act
Colorado's comprehensive AI law never took effect in its original form. A federal magistrate judge stayed its enforcement in April, and the legislature passed SB 26-189 to repeal and reenact it as a narrower notice and disclosure regime for automated decision-making technology. Obligations begin January 1, 2027.
Insurance regulators are building tools
In insurance, the direction is toward more scrutiny, not less. As of March, 25 states had adopted the NAIC Model Bulletin on insurers' use of AI, and the NAIC has been piloting an AI Systems Evaluation Tool in 12 states from March to September, for use in market conduct exams and financial analysis.
Why we do not slow down our controls
It is tempting to read delays as permission to wait. We read them differently:
- Delays change dates, not direction. Inventories, risk ratings, testing, logging and human oversight appear in every regime, in Canada's OSFI E-23 too.
- Examiners are arriving first. An insurer's AI will be questioned in a market conduct exam well before most statutory deadlines bite.
- Retrofitting is the expensive path. A control designed into an agent costs days. One added after a year in production costs a project.
So every agent we deliver ships with the same pack regardless of jurisdiction: what it does and decides, how it was tested, how it is monitored, who reviews it, and how to turn it off. When the rules settle, our clients are already compliant with the stricter version.
Sources
- The AI Digital Omnibus Regulation has been published, redefining deadlines and simplifying requirements for companies and developers, Garrigues, July 24, 2026.
- Major Developments Put Colorado's AI Law on Ice Ahead of Implementation, Proskauer Rose, May 11, 2026.
- NAIC using evaluation tool pilot to monitor insurance AI use, Repairer Driven News, April 2, 2026.