The Floor That Never Got Poured: What the EU AI Act's First Two Years Reveal About Governing the Wrong Layer — and Why the Exposure Lands on Underwriters

An analysis arguing that the EU AI Act governs the wrong layer, and that its implementation record now demonstrates the point rather than merely inviting it. The Act's obligations attach to the system as an artifact and to the process around it — classification, conformity assessment, registration, post-market monitoring — producing periodic assurance and retrospective record while imposing no requirement that a specific consequential action be admissible at the moment it is taken. Validation establishes fitness for a use; it does not establish that a particular execution, under a particular authority, at a particular moment, was permitted. The paper then sets the structural critique against the record: the Digital Omnibus on AI deferred the Annex III high-risk obligations by sixteen months to December 2027 because the standards and assessment machinery were not ready, and the Article 57 sandbox obligation slipped a year largely because the Commission had not adopted the implementing act the sandboxes required. It argues that the withdrawal of the AI Liability Directive, formalised in October 2025, left strict product liability extending to AI from December 2026 against twenty-seven national tort regimes with no harmonised standard of care and no pre-execution evidentiary record required of anyone. Drawing on the precedent of steam boiler inspection and marine classification, it concludes that the enforceable floor for consequential AI will be set through the underwriting bind before it is set by statute. EU AI Act; Digital Omnibus; AI Liability Directive; Product Liability Directive; strict liability; standard of care; underwriting; AI liability insurance; pre-execution governance; admissibility; Annex III; regulatory sandbox