For two years the message to every CEO was the same: get ready to comply. This month the regulators changed their minds. In early May the EU pushed its high-risk AI obligations from August 2026 to December 2027. On May 14 Colorado repealed the AI Act it had already passed, replacing it with a far lighter disclosure regime. On June 2 a White House order ruled out any federal licensing requirement for new models. The deadline you braced for is not coming.
Why It Matters
The pressure to govern your AI never came only from regulators. Picture a late-stage deal where the buyer’s security team asks for proof of how your models are reviewed and who is accountable when one gets a decision wrong. “The law did not make us track that” is the answer that stalls the deal while a competitor who can answer closes it. That pressure did not ease this month. Only the legal deadline did. Compliance was always the floor someone else set for you. Business-driven governance is the bar you set yourself, because trust, liability, and speed depend on it. When that bar was mandatory it was table stakes everyone had to clear. Now that it is optional, keeping it high is an advantage competitors are free to skip. Most will skip it.
The Decision
The question worth asking this week is what your AI governance is actually for. Treat it as compliance, and a relaxed law means you can relax too, banking the saved effort now. Treat it as a business asset, and the retreat changes nothing, because trust and liability never tracked the statute. Both are defensible, but they are not the same wager: one trades governance effort for savings now, the other holds the line for the moment a buyer, a board, or a bad outcome asks who was accountable.
What To Do This Week
- Audit your roadmap. Ask your team which AI governance practices were built only to meet a coming law, and which you would keep regardless. The split shows what you actually believe.
- Check your frontline. Ask whoever owns your biggest customer relationships whether buyers have started asking how you govern AI. They ask before regulators do.
- Pick one bar to hold. Choose a single standard you keep above what the law now requires, and decide whether it is worth saying out loud to a customer or your board.
What Not To Do
Don’t read the retreat as permission to stop. Don’t mistake a lighter rulebook for a safer position, because you still own the outcome of every automated decision you make. And don’t wait for the standard to return before raising your own. The law moved. Your responsibility did not.
Signal Boost
Crowell & Moring’s breakdown of Colorado SB 26-189 is the clearest read on which obligations the state dropped, from risk assessments to impact reports to the duty of care, and which it kept. It shows the floor that just moved, so you can decide where to hold your own.