When Institutions Buy Time That They Cannot Afford

The EU’s AI Act delay is not a regulatory story. It is a leadership story.

This week, European negotiators are converging on a political agreement that will postpone the most consequential obligations of the EU AI Act. High-risk systems classified under Annex III, originally due to come into compliance on 2 August 2026, will not be required to do so until 2 December 2027. AI embedded in regulated products under Annex I will move further still, to 2 August 2028. The official language emphasizes pragmatism. The implicit message is that the system is not ready. The technology has moved too quickly, the guidance is unfinished, and the industry is unprepared. So the deadline moves.

I understand why the decision was made. I have spent enough time in policy rooms to know how these compromises are built, and I do not want to be unfair to the people who shaped this one. But it is worth saying clearly what the delay represents. Eighty-eight percent of organizations now use generative AI in at least one core function. Ninety-seven percent of executives report having deployed AI agents in the past year. The EU is buying itself another 18 to 24 months to govern a technology that is already embedded in the operating models of nearly every large enterprise in its jurisdiction. The pace at which AI is being integrated into how institutions actually work no longer matches the pace at which we are agreeing on how it should be governed. That is the signal underneath the signal.

The deeper pattern is one I have been watching for some time. Across many institutions, public, private, and multilateral, the response to compounding change has become a familiar one. We acknowledge the urgency, set a deadline that reflects it, and then, as the deadline approaches and the work proves harder than anticipated, we move it. We treat the postponement as a return to realism. It is rarely framed as what it actually is: the deferral of decisions that will eventually have to be made under worse conditions. The institutions that buy themselves time in this way are usually the ones least equipped to spend it well. The leaders who needed the deadline to force action lost the only leverage they had. The technology, the conflict, the climate event, and the erosion of trust, none of these things wait.

This is the part that is easy to miss when we read regulatory news as a procedural matter rather than as evidence about the state of leadership. Regulatory delay tells us less about the rules and more about the readiness of the institutions that were supposed to enforce them. When a deadline moves, it is because the system didn’t produce the work required by the deadline. The technology did not slow down. The pressure to defer came from somewhere else. Usually, it came from a recognition that the underlying institutional capability, the audit infrastructure, the technical guidance, the supervisory capacity, and the workforce literacy were not at the level the rules assumed. Delay is, in that sense, a confession. It is information about the system, and leaders should read it as such.

This is why the conversation needs to move from regulation to governance, and from governance to leadership. Many boards I work with still treat AI governance as a compliance project. They appoint a working group, ask for a policy, wait for the rules to clarify, and intend to act once the picture stabilizes. The picture is not going to stabilize. The technology is evolving faster than the regulatory environment can settle, which means waiting for clarity is itself a strategic decision, and not a good one. The organizations that will lead the next decade are not the ones with the most thorough compliance documents. They are the ones whose governance is mature enough to make sound decisions before the rules are finalized. Governance maturity is no longer a back-office variable. It is the variable that determines whether AI exposes the organization or strengthens it.

I have written before that AI does not replace leaders. It exposes them. The same principle applies here at the institutional level. The EU’s delay does not weaken the AI Act, but it does reveal what has always been true: a regulation can only be as strong as the institutions behind it. The same is true inside the firm. A board can write any AI policy it wants, but the policy will only be as strong as the operating culture that has to live with it. If the leadership team has not done the slow work of building decision rights, escalation paths, model inventories, ethical thresholds, and the cultural permission to challenge AI outputs, then the policy will not hold when it is needed. The board will discover this in a moment of consequence, not in a moment of preparation. That is the part of the AI conversation we are not having loudly enough yet, because the technology story is so much louder.

There is a useful framing I find myself returning to in advisory conversations. Compliance asks: what must we do to satisfy the rule? Governance asks: what must we be able to do, regardless of what the rule says? The first question is satisfied by documentation. The second is only satisfied by capability. The institutions that will navigate the next phase of AI adoption with composure are the ones already investing in the second question, because they understand that the first question is unstable. Rules will move. Definitions will change. Deadlines will slip. The capability to govern AI well, to know which models are running where, to know what data they touch, to know who decides when to deploy and when to stop, is the asset that retains value through all those changes. That capability does not appear when a regulation is finalized. It is built slowly, in the years before the regulatory matters.

For boards, the implication is straightforward, even if the work is not. Governance maturity should now be on the agenda as a competitive variable, alongside cost discipline, talent strategy, and capital allocation. The questions worth asking are practical. Do we know which AI systems are operating within our organization, including those procured by individual teams? Do we know which decisions those systems are influencing or making? Do we know what would happen if one of them produced a serious error, and do we know who would be accountable? Have we, internally, earned the standing to slow down or stop an AI deployment when the situation calls for it? If the answer to any of these is uncertain, the board is exposed in a way that no policy document will compensate for. And the exposure is not theoretical. It is operational, and it is reputational, and it will become legal in time.

The leadership reflection at the heart of all of this is one I have come to take seriously. We are in a period when many of the institutions designed to absorb shocks are themselves becoming sources of uncertainty. Regulators move deadlines. Trade systems fragment. Trust contracts. Climate response struggles to keep pace with climate reality. In that environment, leaders cannot rely on the slow ratification of rules to tell them when to act. They have to develop the judgment and the cultural permission to act ahead of the rules, without abandoning the discipline that the rules were trying to embed. That is a different kind of leadership than the one most institutions have been practicing. It requires composed courage, not aggressive certainty. It requires resilience that is built before it is needed, not promised after it has failed. And it requires the honesty to recognize that buying time, while sometimes necessary, is never free.

The EU AI Act will eventually take full effect. The deadline that moved this week will be replaced by another. But the leaders who used the intervening months to wait will find themselves in the same position they were in when the original deadline approached, only with less time and more complicated technology. The leaders who used the intervening months to build capability will find that the regulation, when it arrives, simply ratifies what they already know how to do.

Governance maturity is no longer a compliance variable. It is becoming the variable that separates institutions that lead from institutions that catch up. That is the signal underneath this week’s news. It is worth reading carefully.

---

Resilience is a strategic advantage.