The Deferral Window: What Pausing AI Enforcement Does Not Pause

THE BRIEF

Regulation (EU) 2026/1744, in force since 27 July 2026, defers the EU AI Act's high-risk obligations from August 2026 to December 2027 and August 2028 [3][4]. Colorado repealed its AI Act's duty-of-care architecture before it ever applied, replacing it with a narrower disclosure statute effective January 2027 [9].

The deferrals moved compliance dates, not exposure. Organisational AI adoption reached 88% in 2025, and documented AI incidents rose to 362, up from 233 in 2024 [14].

The law that governs AI conduct today did not move. EU prohibitions and general-purpose AI obligations remain in application [2], Illinois and Texas statutes have been in force since January 2026 [10][11], and general anti-discrimination law is already carrying a nationwide collective action over AI screening tools [12].

Boards that pace AI governance to enforcement calendars are anchoring to the one variable regulators have just shown to be movable. The deferral window is a construction period, and organisations that treat it as relief will be compressing two years of governance into the months before December 2027.

I. THE 2026 RETREAT FROM THE AI COMPLIANCE CALENDAR

Two of the most consequential AI statutes in the Western regulatory landscape were rescheduled or rewritten within weeks of each other. The EU AI Act, Regulation (EU) 2024/1689 [1], entered into force on 1 August 2024 with a staggered application calendar: prohibitions and AI literacy provisions from 2 February 2025, and general-purpose AI obligations together with governance and penalty provisions from 2 August 2025 [2]. The core high-risk regime for systems listed in Annex III was to apply from 2 August 2026 [4]. That date was the anchor around which European compliance programmes were built. It no longer exists. Following a provisional political agreement on 6 May 2026, confirmed by Member State representatives on 13 May 2026, the Digital Omnibus on AI was adopted as Regulation (EU) 2026/1744 of 8 July 2026 and entered into force on 27 July 2026 [3, 4]. High-risk obligations for Annex III systems now apply from 2 December 2027, and for high-risk systems embedded in regulated products under Annex I from 2 August 2028 [4, 16].

Colorado compressed the same arc into thirteen months. Its 2024 statute, SB 24-205, required developers and deployers of high-risk AI systems to use reasonable care to avoid algorithmic discrimination, supported by risk management programmes, impact assessments, and consumer notification, with enforcement assigned to the attorney general [6, 7]. Implementation was first postponed from 1 February 2026 to 30 June 2026 by SB 25B-004, signed on 28 August 2025 [7]. On 9 April 2026, xAI filed a constitutional challenge to the law; the Department of Justice moved to intervene on 24 April in support of the effort to invalidate it; and on 27 April a federal magistrate judge stayed enforcement pending a ruling on the forthcoming preliminary injunction motion [8].

Before that motion was decided, the legislature replaced the statute. SB 26-189, signed on 14 May 2026 and effective 1 January 2027, removes the duty of care, the impact assessment requirement, and the rebuttable presumption of compliance, and substitutes disclosure obligations, three-year record-keeping, and a sixty-day pre-enforcement cure period administered by the attorney general [9]. The duty-of-care model died before its first day in force.

II. THE LAW THAT DID NOT MOVE

Reading the deferrals as a general retreat from AI regulation misreads what was actually rescheduled. In the EU, the prohibitions on unacceptable-risk practices have applied since 2 February 2025, and the obligations on general-purpose AI models, together with the governance architecture and penalty provisions, have applied since 2 August 2025; none of this was deferred [2, 4]. Transparency obligations under Article 50 largely proceed as scheduled from 2 August 2026 [4]. Nor did the omnibus narrow the Act's conception of risk. Annex III still designates the same categories, including employment and worker management, education, creditworthiness and access to essential services, biometrics, critical infrastructure, law enforcement, migration, and the administration of justice [5]. The deferral changes when obligations attach, not which deployments the regime regards as consequential.

In the United States, the statutes that did take effect are governing now. The Texas Responsible Artificial Intelligence Governance Act, HB 149, signed on 22 June 2025, has been in force since 1 January 2026, with exclusive attorney general enforcement, a sixty-day cure period, and penalties reaching USD 200,000 per uncurable violation [10]. Illinois HB 3773, amending the Illinois Human Rights Act with effect from the same date, prohibits the use of AI in hiring and promotion decisions that results in discrimination on protected characteristics, imposes plain-language notice obligations on employers, requires four-year retention of AI-related records, and exposes violators to actual damages, civil penalties, and compliance reporting; the Illinois Department of Human Rights has released draft implementing rules [11].

Beneath both sits the deepest layer: employment, consumer protection, and data protection law of general application, which never needed an AI-specific commencement date.

III. LITIGATION RUNS ON ITS OWN CALENDAR

The most instructive AI accountability development of the deferral period proceeds under a statute enacted in 1967. In Mobley v. Workday, the United States District Court for the Northern District of California granted preliminary certification on 16 May 2025 to a nationwide collective action under the Age Discrimination in Employment Act, on a disparate impact theory, against the operator of AI-driven applicant screening tools that score, sort, rank, or screen candidates [12]. The collective reaches applicants aged 40 and over denied employment recommendations through the platform since 24 September 2020 [12]. On 17 February 2026 the court authorised notice to potential members, with an opt-in deadline of 7 March 2026 [13].

Three features of the case should discipline how boards read the 2026 deferrals. First, the claim required no AI statute; disparate impact doctrine attached to algorithmic screening exactly as it attaches to any other selection procedure. Second, the collective proceeds against the platform operator itself rather than against the employers who used its recommendations, which makes procurement and contracting decisions liability decisions [12]. Third, the relevant conduct period opened in 2020, years before any AI-specific regime was in prospect. A deployment decision taken today sits inside whatever conduct period a future collective action defines, whether or not Annex III obligations or a Colorado disclosure duty have yet attached to it. Enforcement calendars are negotiable in a way that litigation exposure is not.

IV. WHAT ACCUMULATES WHILE ENFORCEMENT WAITS

The deferral window is not a quiet period in the underlying risk. The Stanford AI Index 2026 records organisational AI adoption reaching 88%, while the AI Incident Database recorded 362 documented incidents in 2025, up from 233 in 2024 [14]. Governance is formalising, but unevenly: AI-specific governance roles grew 17% in 2025, and the share of businesses with no responsible AI policies fell from 24% to 11%, while reporting against responsible AI benchmarks remains sparse even among leading developers [14]. Adoption, incident frequency, and partially built governance are all rising together, which is precisely the configuration in which a paused enforcement calendar does its damage.

The damage mechanism is organisational, not legal. Compliance programmes built against the August 2026 date now face a reallocation decision, and the institutional reflex is predictable: budgets migrate toward revenue, assessment work is descoped to the new date, and the governance function holds documentation rather than operating discipline. Deployment does not wait for the programme to resume. Every consequential system embedded in operations between now and December 2027 will fall inside the regime's scope on the day obligations attach, and governance retrofitted onto a system that the business already depends upon is more expensive, more contested, and less effective than governance built at deployment. The organisations most exposed at the end of a deferral are not those that never started but those that stood down, because standing down converts a running programme into a paper one while the deployed estate keeps growing.

V. WHAT THE WINDOW IS FOR

The deferral is coupled to the readiness of the compliance infrastructure: the Commission must adopt specified delegated acts and, by 1 August 2027, request that European standardisation bodies deliver the harmonised standards through which conformity will be demonstrated [16]. The window exists so that obligations arrive together with the standards that make conformity demonstrable. For a deploying organisation, the rational response is symmetrical: use the window to build the operating practice the standards will eventually formalise.

The materials for doing so are not in dispute, and they are regime-neutral. The NIST AI Risk Management Framework, released in January 2023 as a voluntary framework structured around govern, map, measure, and manage functions, supplies the scaffold [15]. The obligations already in force converge on the same operational core: an inventory of systems influencing consequential decisions, documented risk assessment, meaningful human oversight, notice to affected individuals, and durable records, the last of which Illinois now mandates for four years and Colorado's replacement statute for three [9, 11]. An organisation that builds that core once, against the strictest baseline that applies to it, holds a position that survives regulatory movement in either direction. When the Annex III obligations arrive in December 2027, they will function in practice as an audit of what the organisation was doing during the window.

VI. THE LEADERSHIP IMPERATIVE: GOVERN TO THE DEPLOYMENT CALENDAR

The board question the deferrals pose is not when the statutes apply but which consequential decisions the organisation has already delegated to models. Annex III supplies a serviceable checklist for that inquiry even while its obligations are deferred, because it names the decision classes, from hiring and worker management to creditworthiness and access to essential services, where error compounds into legal, financial, and reputational exposure [5]. A board that cannot obtain a current inventory of such systems, with an owner and a documented assessment for each, has an oversight gap no enforcement deferral mitigates.

The second board obligation is to treat regulatory volatility itself as a planning input. Colorado's thirteen-month arc, a delay, a constitutional challenge, a federal intervention, an enforcement stay, and a repeal-and-replace, demonstrates that the enforcement calendar is currently the least stable variable in the AI governance model [7, 8, 9]. The deployment calendar, by contrast, is the one variable the organisation fully controls. Pacing governance to deployment rather than to enforcement is elementary planning discipline: it indexes the control environment to the risk the organisation is actually creating, rather than to a date that has now moved in both jurisdictions. An AI governance programme built on that principle absorbs the next deferral, and the next acceleration, without redesign.

VII. CONCLUSION: THE WINDOW WILL BE AUDITED

The 2026 deferrals rescheduled obligations; they did not reschedule exposure, and they left in force the prohibitions, the general-purpose AI obligations, two state statutes, and the general law under which AI liability is already being litigated. The interval to December 2027 will be governed less by the deferred regimes than by discrimination litigation, incident economics, and the statutes that did commence. Two predictions follow. State-level AI legislation in the United States will continue converging on the Colorado replacement model, disclosure, records, and cure periods rather than duty-of-care architecture, while general-law litigation supplies the operative discipline. And when the Annex III obligations attach on 2 December 2027, the divide among organisations will not run between large and small but between those that treated the window as a construction period and those that treated it as relief. The first group will convert existing practice into conformity documentation. The second will discover that two years of governance does not compress into the months remaining, and that the record of the window, in Illinois retention files, in Colorado disclosures, and in discovery, was being written whether or not anyone was keeping it deliberately.

RECOMMENDATIONS

Within 30 days:

Commission a board-level inventory of AI systems that make or materially influence consequential decisions, hiring and worker management, creditworthiness, eligibility, and pricing among them, mapped against the Annex III categories [5] and against the Illinois and Texas statutes already in force [10][11]. Confirm which obligations apply to the organisation today, not at the deferred dates.

Within 90 days:

Re-baseline the risk assessment and documentation discipline that the deferred regimes will eventually audit, using the NIST AI RMF's govern, map, measure, and manage functions as the scaffold [15]. Bring vendor and procurement contracts into the assessment, allocating responsibility for bias testing, records, and notice between developer and deployer. Adopt the strictest applicable record-retention floor, four years under Illinois law [11], as the default.

Within 6 months:

Integrate AI incidents into the organisation's existing incident management architecture, with defined thresholds, ownership, and escalation to the board. Run a discovery-readiness exercise on one deployed screening or scoring system, testing whether the organisation could produce its assessment record, testing history, and decision logs under litigation conditions.

Benchmarks that should change the recommendation:

A ruling on the preliminary injunction motion in the Colorado litigation; adoption of final Illinois Department of Human Rights rules; publication of the harmonised standards under the Commission's standardisation request; and any further deferral or federal preemption statute, which would extend the window but sharpen, not relax, the construction-period logic.

CAVEATS

Date of analysis: The regulatory positions stated here reflect the record as of September 2026. The state legislative landscape and the EU delegated-act programme are both moving; readers should verify current status before relying on specific dates.

Colorado enforcement stay: The 27 April 2026 order stayed enforcement until 14 days after a ruling on the preliminary injunction motion; the litigation posture may have changed since the sources cited were published.

Mobley v. Workday: Preliminary certification and court-authorised notice establish neither liability nor the merits of the disparate impact theory; the case is contested and its holdings may narrow on decertification or appeal.

Incident figures: The AI Incident Database records documented, publicly reported incidents; the series reflects reporting practice as well as occurrence and should be read as a reported-incident count, not a census of harm.

Adoption figure: The 88% organisational adoption figure is the Stanford AI Index 2026 headline; underlying survey instruments and definitions of adoption vary across sources.

EU dates: Regulation (EU) 2026/1744 dates are taken from the Official Journal publication of 24 July 2026 and entry into force of 27 July 2026; subsequent delegated acts may adjust the operational detail of the high-risk regime without moving the application dates.

REFERENCES

[1] European Parliament and Council of the European Union, "Regulation (EU) 2024/1689 (Artificial Intelligence Act)," EUR-Lex, June 2024. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32024R1689

[2] Future of Life Institute, "EU AI Act Implementation Timeline," artificialintelligenceact.eu, 2026. https://artificialintelligenceact.eu/implementation-timeline/

[3] European Parliament and Council of the European Union, "Regulation (EU) 2026/1744 (Digital Omnibus on AI)," EUR-Lex, July 2026. https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=OJ:L_202601744

[4] Gibson Dunn, "EU AI Act Omnibus Agreement — Postponed High-Risk Deadlines and Other Key Changes," 2026. https://www.gibsondunn.com/eu-ai-act-omnibus-agreement-postponed-high-risk-deadlines-and-other-key-changes/

[5] Future of Life Institute, "EU AI Act, Annex III: High-Risk AI Systems," artificialintelligenceact.eu, 2024. https://artificialintelligenceact.eu/annex/3/

[6] Colorado General Assembly, "SB 24-205: Consumer Protections for Artificial Intelligence," 2024. https://leg.colorado.gov/bills/sb24-205

[7] Akin Gump Strauss Hauer & Feld, "Colorado Postpones Implementation of Colorado AI Act, SB 24-205," 2025. https://www.akingump.com/en/insights/ai-law-and-regulation-tracker/colorado-postpones-implementation-of-colorado-ai-act-sb-24-205

[8] Proskauer Rose, "Major Developments Put Colorado's AI Law on Ice Ahead of Implementation," Law and the Workplace, May 2026. https://www.lawandtheworkplace.com/2026/05/major-developments-put-colorados-ai-law-on-ice-ahead-of-implementation/

[9] Seyfarth Shaw, "Colorado Enacts Artificial Intelligence Replacement Law," May 2026. https://www.seyfarth.com/news-insights/colorado-enacts-artificial-intelligence-replacement-law.html

[10] DLA Piper, "Texas Adopts the Responsible AI Governance Act," June 2025. https://www.dlapiper.com/en/insights/publications/2025/06/texas-adopts-the-responsible-ai-governance-act

[11] Hinshaw & Culbertson, "Illinois Adopts New AI-in-Employment Regulations: What Employers Need to Know for 2026," 2026. https://www.hinshawlaw.com/en/insights/blogs/employment-law-observer/illinois-adopts-new-ai-in-employment-regulations-what-employers-need-to-know-for-2026

[12] Holland & Knight, "Federal Court Allows Collective Action Lawsuit Over Alleged AI Hiring Bias," May 2025. https://www.hklaw.com/en/insights/publications/2025/05/federal-court-allows-collective-action-lawsuit-over-alleged

[13] Wiggins Childs Pantazis Fisher & Goldfarb, "Federal Court Authorizes Notice in Lawsuit Challenging AI Hiring Software for Potential Age Discrimination," 2026. https://www.wigginschilds.com/news/workday-case-update/

[14] Stanford Institute for Human-Centered Artificial Intelligence, "The 2026 AI Index Report," April 2026. https://hai.stanford.edu/ai-index/2026-ai-index-report

[15] National Institute of Standards and Technology, "AI Risk Management Framework (AI RMF 1.0)," January 2023. https://www.nist.gov/itl/ai-risk-management-framework

[16] Future of Life Institute, "Digital Omnibus on AI," artificialintelligenceact.eu, 2026. https://artificialintelligenceact.eu/ai-act-explorer/digital-omnibus/