5 AI regulation decisions a Series C board should make before Q3

On May 19, the European Commission did something it had been promising since February and kept not doing. It published draft guidelines for how to classify an AI system as high-risk under the AI Act. Two days later, on May 21, the White House did the opposite kind of thing. It postponed an executive order President Trump was scheduled to sign that afternoon, an order that would have set up a voluntary process for the federal government to review advanced AI models before release. One government made its rulebook more concrete. The other made its rulebook less predictable. Both moves happened inside 48 hours, and both landed on the desk of every late-stage founder building a Q3 plan.

If that feels like whiplash, it is. It is also the actual operating environment now.

What it actually means

Start with Brussels, because there are really two EU stories running at once and a board needs both. The first: under the Digital Omnibus simplification package, a provisional deal struck in early May moves the high-risk obligations for stand-alone AI systems out to December 2027, well past the original August 2026 date. More runway. The second story is the one from this week. On May 19 the Commission published the draft guidance for how a company decides whether its system is high-risk in the first place, with feedback open until June 23.

So the deadline got softer and the rules got sharper, in the same season. Anyone waiting for the EU to blink should sit with that. Brussels handed companies more time and, in the same breath, removed the ambiguity that the extra time might otherwise have been used to hide inside.

Now Washington. The postponed executive order had already been delayed several times, Nextgov reported, which is its own kind of signal. Press accounts put the pre-launch review window somewhere between 14 and 90 days, with companies like OpenAI and Anthropic negotiating for the shorter end. Trump’s stated reason for pausing was that he “didn’t like certain aspects” and worried the order could slow the US lead. But step back from the order itself. The larger shift, as Fortune reported the same week, is that the administration is drifting toward regulation at all, pushed by a public that is plainly uneasy.

Here is the thread connecting both events. For two years the safe planning assumption in the US was that no binding federal AI rule was coming any time soon. That assumption is now unstable. And in the EU, betting that the rules would quietly weaken has not paid off either, because the substance sharpened even as the calendar slipped. A board that anchored its AI roadmap to either kind of certainty is now exposed.

The five decisions to make before Q3

This is what I would put in front of the board this quarter. Not a compliance program. Five decisions, each one cheap to make now and expensive to skip.

1. Confirm the AI inventory exists, and name who owns it

   The EU classification guidelines ask a company to determine, system by system, whether each one is high-risk. You cannot classify what you have not listed. Before anything else, the board should get a yes-or-no answer to one question: do we have a current inventory of every AI system in use, and is there a named person accountable for keeping it current? If the honest answer is no, that is decision one, and it is a week of work, not a quarter.

2. Write down the classification rationale for each material system

   The Commission's guidance is explicit that high-risk status turns on the intended purpose and the context of use, not on the technology alone. Most teams have an opinion about whether their systems are high-risk. Few have it written down and approved. A one-paragraph rationale per material system, signed off, is what turns an opinion into a defensible position when a regulator or an enterprise customer asks.

3. Name a human owner for every high-stakes AI decision

   Human oversight is a core AI Act requirement, and it is also plain operational sense. Kiteworks reported this week that 60% of organizations cannot quickly terminate a misbehaving AI agent. For each AI system that touches a customer, a hire, or a dollar, the board should be able to point to a named person who can pause it. An org chart is not an answer. A name is.

4. Set the company's US posture while the rules are a moving target

   With the federal executive order postponed and the administration's direction unsettled, the board should not wait for clarity that may not arrive before Q3 closes. Decide now whether the company designs to the strictest credible standard it faces, usually the EU one, or runs two postures. Designing to the strictest standard is almost always cheaper than retrofitting later. Make that call deliberately rather than by default.

5. Put AI governance on the board's actual priority list

   This is the decision that sounds soft and is not. Board attention is the lever. The other four happen on time only if the board treats AI governance as a standing item, with an owner and a date, rather than a topic that gets ten minutes when something breaks.

That last point is worth sitting with. As Kiteworks put it in a piece this week: “54% of boards have not placed AI governance in their top five priorities, yet board engagement is the strongest predictor of governance maturity.”

Read that twice. The single strongest predictor of whether a company governs AI well is whether its board pays attention. And most boards are not on the list. That is not a doom statistic. It is the opposite. It means the fix is within reach of any board that decides to use it.

The 60-second brief

If there is one minute with the board, say this. Two governments moved their AI rules in opposite directions in the same week. The EU published the high-risk classification guidance everyone was waiting for, even as it moves the obligation deadline itself toward late 2027, so the rules are getting clearer, not softer. The US postponed its AI executive order, so the federal picture is now less predictable, not more. We are not going to predict the rules. We are going to make five decisions that hold regardless: confirm our AI inventory and its owner, write down our classification rationale, name a human owner for every high-stakes system, set our US posture deliberately, and keep AI governance as a standing board item. None of that needs a consultant. All of it is doable before Q3 closes.

What to watch

Three things, none of which should change the five decisions above. June 23, when EU feedback on the classification guidelines closes and the final version begins to take shape. The next few weeks in Washington, to see whether the executive order resurfaces in a different form or quietly fades. And the formal adoption of the Digital Omnibus timeline, which turns the provisional December 2027 date into settled law. Watching these is useful. Waiting on them is not. The point of choosing decisions that do not depend on the forecast is that the forecast can keep changing and the work still gets done.