Governance debt: what the EU AI Act delay actually bought you

The European Commission proposed the deferral on 19 November 2025 (European Commission, 2025). The Council and the Parliament reached a provisional agreement on 7 May 2026, and the package was formally adopted in June 2026 (Council of the EU, 2026). The result: compliance obligations for standalone high-risk AI systems under Annex III now apply from 2 December 2027 instead of 2 August 2026. For high-risk AI embedded in regulated products under Annex I, the timeline moved to 2 August 2028 (Gibson Dunn, 2026).

The core high-risk obligations survive the Omnibus largely intact. Risk management, logging, human oversight, technical documentation: those read much as they did before. But the package changed more than dates. It narrowed the definition of a safety component, which changes which systems count as high-risk in the first place, added a prohibition on systems that generate non-consensual intimate images or child sexual abuse material, and softened the AI literacy obligation (Gibson Dunn, 2026). If you classified your portfolio before November 2025, that classification is already stale.

Governance debt is the gap between what your organization has deployed and what it can prove about it. The principal is specific: an agent deployment that reached production without sign-off, a model decision nobody can reconstruct after the fact, a change applied to a live system outside change management. None of these appears on a balance sheet. Each one makes the next borrowing cheaper, because the unreviewed deployment becomes the precedent, and the precedent becomes the process.

That is why the sixteen months are not what they look like. For an organization with working governance, the delay is slack in the schedule. For an organization without it, the same sixteen months are an accrual period. Every ungoverned system that ships between now and December 2027 adds principal that will have to be reconstructed or written off before an auditor arrives. The delay is interest, not runway.

A Tuesday in late 2027. A market surveillance authority has sent a documentation request, and the question on the table is why the model declined a specific application the previous March. The team pulls the logs. The logs hold the output but not the inputs. The model version that made the call was retired two releases ago. The prompt template lived in a repository that was archived when a contractor rolled off. The person who approved the deployment, if anyone formally did, has changed jobs.

Nobody in that room is negligent. Everyone did their work the way the organization allowed it to be done. And still the honest answer is: we cannot reconstruct it.

That answer is not a documentation gap discovered in 2027. The debt was taken on in 2026, and it grew. And the Tuesday is not even the earliest date the question can arrive. A data subject contesting an automated decision under GDPR Article 22 can put the same question to you now. For reconstructing individual decisions, nothing was delayed.

In DryRun Security's March 2026 study, 87%[4] of AI-agent pull requests, 26 of 30, introduced at least one vulnerability. Veracode's 2025 tests, 80 curated security-relevant tasks across more than 100 models, found AI-generated code introduced a security flaw in 45%[5] of tasks. Both are lab numbers. Neither is your rate after review, static analysis, and CI. They still point one way: the volume of agent output you merge without checking it against a policy is a fair proxy for how fast the debt grows.

And the bill does not wait for a regulator. In March 2026, Business Insider reported from internal Amazon documents that a single configuration change made outside change management caused a six-hour outage and an estimated 6.3 million lost orders[15]. No AI Act applied to that change. Amazon's response was a 90-day reset: mandatory two-person review and a formal approval process for changes to critical systems (Business Insider, March 2026). Sign-off controls installed after the incident are the retrofit cost, paid in public.

For much of this essay's audience, the schedule was never yours to set anyway. Financial entities already owe ICT change management, logging, and incident evidence under DORA (Regulation 2022/2554). Essential and important entities owe similar controls under NIS2 (Directive 2022/2555). Neither was deferred. The AI Act delay staggered one inspection date out of three.

The organizations that pass in late 2027 started this summer. Preparing for a governance audit is not a document sprint. It is a change in how systems reach production, and it looks unglamorous.

• Inventory what you run. Which systems will plausibly classify as high-risk, who owns each one, and what you could show an auditor today. Classifications done before the Omnibus need a re-run against the narrowed safety-component definition.
• Make decisions reconstructable. For every consequential model output, keep the inputs, the model version, and the policy that was in force at the moment of the decision. Those inputs are usually personal data, so agree the lawful basis and the retention schedule with your DPO rather than defaulting to keep everything.
• Put production changes back under sign-off. A named human accountable per change, recorded at the time, not reconstructed for the audit.
• Let the audit trail be a byproduct. If proving what happened requires a project, the debt is still growing. If it requires a query, you are paying the principal down.

This list is not the full Annex III program. A high-risk provider still owes a quality management system, data governance, conformity assessment, registration, and post-market monitoring, and the deadline still governs those. The list is the part you cannot retrofit. You can write a quality manual in 2027. You cannot log 2026 in 2027.

Governance is the product shows what delivery looks like when the audit trail is a byproduct of the build. If you want a number for your own principal, the self-test asks six questions against our published 22-check bar[7], one at a time, in your browser. Not sure counts as no.