Who counts as obligated
Banking, telecoms, large online platforms, and services using strong customer authentication, including parts of healthcare. If you are in one of those, acceptance is a duty with a date on it rather than a project you can defer.