When the EU's high-risk conformity obligations under the AI Act were pushed back sixteen months, a lot of boards heard "the AI Act got delayed" and adjusted their timeline accordingly. That's not quite what happened, and the gap between the two versions is exactly the kind of thing that turns into an expensive surprise.

The deferral applies to one specific obligation set — the standalone high-risk conformity regime, now due December 2027. It does not apply to the obligations that were already binding on any company deploying AI in the EU: baseline AI-literacy requirements have applied since early 2025, and a set of prohibited-practice safeguards and content-marking requirements came due well before the deferral even took effect. The heavy compliance machinery got more runway. The cheap-to-breach obligations did not, and they're the ones most likely to be sitting unaddressed on a company's actual risk register right now.

There's a pattern worth noticing across the EU rule and the state-level rules moving alongside it: the obligations that survive political revision are consistently the transparency, documentation, and incident-reporting ones. Substantive duties — proving a system doesn't discriminate, assessing risk before deployment — are the ones getting deferred, narrowed, or rewritten. Procedural duties aren't. A governance program built around evidence production and disclosure is the one most likely to still be useful after the next revision, which is a different design brief than a lot of 2024-era compliance programs were built around.

The obligations a typical deployer can breach cheaply are already live; the obligations that require a conformity-assessment programme are not. Compliance sequencing should follow that order, not the reverse.

The instinct, on hearing about a sixteen-month deferral, is to slow down. The better move is usually the opposite: data governance, logging, and human-oversight documentation take longer to retrofit than to build in from the start, and every month of new deployment on ungoverned foundations is a month of retrofit debt accumulating quietly in the background. The deferral bought time for the conformity-assessment programme. It didn't buy time for the parts of the Act that were never deferred in the first place.