A board chair I have known for years called me the week the Colorado legislature voted to repeal the law everyone had been preparing for. He was relieved, and he wanted me to share the relief. The deadline that had been sitting on his calendar since last winter, the one his general counsel kept circling in his board materials, had just been pushed eighteen months down the road. He said it the way a man says it when he believes he has been handed back his summer.
I did not share the relief. I told him I thought he had just been handed a more dangerous moment than the one he was escaping.
He had spent the better part of a year being told that a statute required him to govern his company's artificial intelligence. The statute is what made it real to him. The deadline is what made it urgent. And when the legislature signed the repeal and replacement in May, he heard the only thing he had ever really been listening for: not yet.
I want to tell you why "not yet" is the most expensive phrase in governance.
The Statute Was Never the Reason
The Colorado Artificial Intelligence Act was scheduled to take effect at the end of this month. In May the legislature repealed it and replaced it with a narrower transparency law, and pushed the operative date to January 2027. A great many boards read that as a reprieve. Some of them have already quietly set the governance work aside until next year, the way you set aside a project when the client moves the date.
Here is the part they have misread. The statute was never the source of the duty. It was only the alarm clock.
The obligation a board carries to oversee a material risk does not come from Colorado, or from any single state, or from any single deadline. It comes from a much older place. A board's duty to build a system that lets it detect and respond to the risks that can destroy the company has been settled law in Delaware for thirty years. The artificial intelligence statute did not create that duty. It only pointed at it. When the statute was repealed, the thing it pointed at did not move an inch.
So the board chair who feels relieved has confused the alarm clock with the fire. The clock got reset. The building is still full of smoke.
What I Have Watched This Pattern Cost
I have spent more than thirty years watching boards govern, and I have seen this exact substitution destroy good organizations. A board treats the existence of a rule as the existence of an obligation. When the rule is delayed, softened, or struck down, the board behaves as though the obligation went with it. It did not. The obligation was always the board's, independent of whoever happened to be writing it down that year.
There is a name for what is happening in these boardrooms right now. I call it the Declarative Board Failure Pattern. A board declares its commitment to managing a risk, points to an external requirement as proof that it is taking the matter seriously, and builds nothing underneath the declaration. Then the requirement changes, and the board discovers it had a policy where it needed an architecture. Declaration says what the board believes. Governance proves it. The repeal in Colorado did not change that arithmetic. It only removed the one excuse a board had for confusing the two.
The boards I have watched survive their hardest tests were never the ones with the most current compliance calendar. They were the ones that asked a different question. Not "what does the law require of us this quarter," but "if this went wrong tomorrow, what would we be able to show that proves we governed it." That question does not have an expiration date. It cannot be repealed. It is the same question whether the deadline is this month or two years out, and the board that lives inside it is never caught waiting for a statute to tell it to begin.
The Inheritance Question
I told my friend the chair that the reprieve he was celebrating was the cleanest test of his board he would get all year. Anyone will build the architecture when the deadline is twelve days away and the lawyers are in the room. The board worth being on is the one that builds it now, when nothing is forcing it, because it understands that the duty was never on loan from the legislature.
The reason that matters is the only reason I care about any of this. The architecture a board builds today is not for today. It is for the directors who inherit these chairs after the current ones are gone, who will sit down to a company that already knows how to govern the things it cannot fully see, and who will never know how close their predecessors came to setting it aside because a deadline moved. That is what a board leaves behind when it builds from conviction rather than crisis. Not a paper trail. A company that can carry the standard forward without the people who set it.
The law moved. Let the people who come after you find that your duty never did.
The governance architecture behind this is developed in the Leadership Reinvention in the AI Era research hub.