The Rule and the Ruler
On a compliance regime written before the means to verify it existed.
A rule and the instrument that measures compliance with it are two different things. One states what must be true. The other establishes whether it is. They tend to be discussed as if they arrive together. They do not always arrive together — and the distance between them is where a surprising amount of governance quietly lives.
When a rule is published before its instrument exists, something has to give. The obligation cannot be checked, so it cannot be enforced, so — sooner or later — the date attached to it moves. That is not a failure of resolve. It is what happens when a requirement is written faster than the means to test it.
The deadline that moved
One example has just completed. A regime governing the highest-risk uses of automated decision-making — systems that screen candidates, score creditworthiness, weigh who is hired and who is let go — was due to apply from a fixed date this month. Days before that date arrived, an amendment moving it back by sixteen months entered into force. The stated reason was not a reassessment of the risk. It was that the harmonised standards and conformity-assessment tools needed to make the obligations checkable were not ready in time.
Stated plainly: the rule had arrived before its ruler. The intent was settled. The instrument to measure compliance with it was not.
There is a detail in how the new date was set that is easy to miss. The original proposal tied the deferral to the instrument: the obligations would apply once the missing standards were confirmed to exist, with a fixed date only as a backstop. That condition was removed before adoption. The replacement dates are unconditional — chosen, it was said, for clarity and predictability. So a deadline deferred because the means of verification did not exist was then detached from any requirement that the means of verification ever exist.
What a deferral admits
A deadline moved because verification is not ready admits something the original deadline kept hidden — that “compliant by the date” was always going to be a documentation event, not a capability event. If no agreed means exists to measure whether a system is safe, then meeting the deadline could only ever have meant assembling the records that assert safety, not demonstrating it.
This is the familiar gap between a certificate and a capability, surfacing at the scale of a jurisdiction. A certificate attests that a procedure was followed at a moment in time. It does not attest that the thing works, or keeps working. When the instrument behind a deadline is missing, the deadline measures conformance to a process — not the property the process was meant to secure.
The risk keeps its own schedule
A deadline can be deferred. The risk cannot. The systems the rule was written to govern do not pause for sixteen months; they keep screening, scoring and deciding across the entire gap. Moving the date moves the paperwork. It leaves the exposure exactly where it was.
And there is a sharper edge. Where rules of this kind do not apply retroactively, a system already placed on the market before the new date can often avoid the obligations altogether — unless it is substantially changed. A delay introduced to ease compliance therefore also widens the window to escape it: an incentive to ship the most consequential systems now, ahead of the rule, rather than building them to meet it. The mechanism meant to buy time to comply also buys time to avoid complying.
The room where the date is set
It is worth noticing which question actually moved the date. Not “is the risk still real?” — that was never in dispute. The date moved on a different question entirely: “can compliance be verified yet?” The timing of the rule was set by the readiness of its instruments, negotiated in the room where operability is decided — not the room where the governed harm lands.
This is the ordinary shape of such decisions. The merit of a rule rarely sets its schedule; feasibility does. And feasibility is assessed a long way from the place where the consequences are felt.
The useful question here is smaller than the politics around it. For any compliance deadline — regulatory or contractual, external or imposed on yourself — there is one diagnostic worth running before treating the date as protection: what verifies this, and does that thing exist yet? A deadline with no working instrument behind it is not a control. It is a date.
A rule that cannot yet be measured is not yet in force. It is an intention with a schedule attached — and the risk it names is keeping a schedule of its own.