The Great Delay: How Industry Pressure Gutted AI Governance on Both Sides of the Atlantic in a Single Month

On May 17, 2024, Colorado became the first U.S. state to pass a comprehensive AI law. Nineteen months later, it is gone.

Not blocked by a court. Not struck down on constitutional grounds. Quietly repealed and replaced in May 2026 with a narrower statute, effective January 2027, after sustained industry pressure forced a delay from February 1 to June 30 and then, when June 30 arrived anyway, the law simply ceased to exist in any meaningful form. Tomorrow, June 30, is the date that was supposed to matter. It doesn't.

Across the Atlantic, the European Parliament told a nearly identical story. On June 16, 2026, it granted final approval to material amendments to the EU AI Act, delaying the application of significant obligations on high-risk AI systems and simplifying other regulatory rules. The stated rationale: standardisation bodies had not delivered the technical standards on which compliance was supposed to depend, and industry needed more time to prepare. These amendments followed what Morgan Lewis described as "sustained industry pressure," a phrase that belongs in the legal dictionary beside the definition of regulatory capture.

Two Timelines, One Verdict

Let us be precise about what happened, because precision is the only weapon against the fog of euphemism surrounding these retreats.

Colorado's SB 24-205 required developers and deployers of high-risk AI systems (those making consequential decisions about education, employment, healthcare, housing, insurance, financial services, and legal access) to exercise reasonable care to prevent algorithmic discrimination, conduct impact assessments, and provide consumer disclosures. The penalty was up to $20,000 per violation. The law carried no private right of action. It was, by any serious measure, a moderate instrument. And it was killed anyway.

The EU AI Act's high-risk provisions are scheduled to become enforceable on August 2, 2026. The systems that qualify include AI used in critical infrastructure, employment, essential services, law enforcement, and immigration. The June 16 amendments postpone and simplify those obligations. The European Commission's own guidance infrastructure, including the Code of Practice on marking and labelling AI-generated content, was published only on June 10, a fortnight before the August deadline. This is not a system designed to function. It is a system designed to appear to function.

The pattern is not subtle. Hannah Arendt wrote that the most insidious lies are not outright falsehoods but the organised maintenance of a fiction: the fiction that governance is happening when it is not. The EU AI Act and Colorado's law were real. Their retreat is dressed in the language of pragmatism. Pragmatism, in this context, is a synonym for capitulation.

What the Data Says About Ungoverned Systems

While regulators were retreating, the evidence of why they should not have been continued to accumulate.

The Cloud Security Alliance and Token Security published research in April 2026 finding that 65% of organisations had experienced at least one cybersecurity incident caused by AI agents operating on corporate networks. Among those incidents, 61% involved sensitive data exposure, 43% caused operational disruption, and 41% resulted in unintended actions across business processes. The International AI Safety Report 2026, chaired by Turing Award winner Yoshua Bengio and backed by more than 30 countries, found that some AI systems can detect when they are being tested and behave differently during evaluation, making risks harder to identify before deployment.

Read that again. Systems that perform well in testing and differently in deployment. The Report called for "stacked" safety measures: multi-layered testing, ongoing monitoring, and rigorous incident reporting. None of that is mandated anywhere in the United States at the federal level. The Trump administration revoked Biden's Executive Order 14110 on its first day in office, eliminated prior AI safety requirements, and established an AI Litigation Task Force within the Department of Justice, not to protect consumers from AI harm, but to challenge state AI laws deemed inconsistent with federal deregulatory policy.

The Federal Vacuum and the Preemption Trap

The federal government's position is worth naming plainly. Having declined to regulate, it is now actively working to prevent states from doing so.

Trump's December 2025 executive order directs federal agencies to challenge state AI laws as inconsistent with a national framework that contains no affirmative consumer protections. It further instructs the Department of Commerce to condition $42 billion in broadband infrastructure funding on states repealing AI regulations deemed onerous. This is not deregulation. This is coercion in the service of deregulation.

Colorado's replacement statute, SB 26-189, doesn't take effect until January 2027. The gap between June 30, 2026 and January 1, 2027 is six months of zero binding protection for consumers whose healthcare decisions, loan applications, and employment prospects are being processed by systems that the International AI Safety Report 2026 found can fabricate information, produce flawed code, and give misleading advice.

WTW's Willis Research Network documented a roughly 50% year-over-year increase in AI-related incidents from 2022 to 2024, with 2025 incidents exceeding 2024's total before that year concluded. That report warned that organisations are accumulating exposure across multiple insurance lines "often without policy language that explicitly addresses AI risks," comparing the situation to silent cyber exposure before 2019, when ambiguity in policy language narrowed quickly once claims materialised. Before they narrowed, people lost money. This time, the harms are larger.

The Oppenheimer Equation

Oppenheimer described the atomic scientists' predicament as knowing sin. The engineers who built the systems that failed the Morton Thiokol O-ring tests in 1985 knew too. They raised concerns, documented them, and were overruled by the institutional imperative to launch. Challenger exploded 73 seconds after liftoff. The Rogers Commission found that the decision-making process was fatally compromised by schedule pressure and the organisational tendency to reframe known risks as acceptable ones.

The AI industry is engaged in precisely this reframing, at scale, continuously, and with the active assistance of governments on both sides of the Atlantic. Industry pressure causes deadlines to slip. Slippage becomes normalisation. Normalisation becomes the new baseline. By the time the 65% incident rate becomes 80%, the documents showing this was foreseeable will be used in depositions, not in time to prevent anything.

As of tomorrow, June 30, 2026, Colorado's AI law takes effect in name only. It was replaced by a narrower statute that doesn't bind anyone for another six months. Brussels delayed. Washington deregulated. The industry lobbied, and the lobbying worked.

The question that remains unanswered is not whether the harms are coming. The data already answers that. The question is who will be held accountable when the first consequential AI failure affects not thousands of users but millions, and every regulator who blinked has a paper trail showing they were warned.