EU AI Act Provisional Agreement: The Sandbox Reprieve and Ireland’s August 2026 Challenge

On May 7, 2026, the Council presidency and European Parliament negotiators reached a provisional agreement on substantive amendments to the EU AI Act—and the implications for Ireland’s distributed enforcement architecture are more complex than the headline suggests.

What Changed: Timeline Adjustments and Jurisdictional Clarity

The agreement introduces two significant shifts:

Sandbox Deadline Extension: The establishment of AI regulatory sandboxes by competent national authorities is now postponed to August 2, 2027—a full year extension from the original timeline. This gives member states breathing room, but creates an awkward interim period where high-risk systems rules take effect (August 2, 2026) while testing infrastructure isn’t yet mandated.

AI Office Competence Clarification: The deal explicitly carves out exceptions where national authorities—rather than the centralised EU AI Office—remain responsible for supervision. These include law enforcement, border management, judicial authorities, and financial institutions. This is the critical detail for Ireland.

SME and Small Mid-Cap Relief: The Commission’s proposal extends certain regulatory exemptions from SMEs to small mid-caps (SMCs), and crucially, expands the possibility to process sensitive personal data for bias detection—a concession that significantly reduces compliance friction for smaller providers.

Why This Matters for Ireland’s 15-Authority Model

Ireland adopted a distributed enforcement approach, empowering 15 competent authorities across different domains to supervise high-risk AI systems. This mirrors the EU’s carve-outs for law enforcement, courts, and financial regulators—but it creates a coordination problem the provisional agreement doesn’t fully address.

With the AI Office of Ireland due to launch August 2, 2026, the country faces a synchronisation challenge: the central office must immediately coordinate oversight across 15 separate authorities on day one, while the sandbox infrastructure they’ll eventually use doesn’t need to be operational for another 14 months.

This creates a gap where early enforcement decisions will set precedent without the testing infrastructure that’s supposed to reduce compliance uncertainty.

Practical Implications for Irish Builders and Deployers

For high-risk system developers: You now have clarity that certain law enforcement and financial AI systems will be supervised by domain-specific authorities rather than the central AI Office. Check which of your 15 Irish competent authorities has jurisdiction over your use case.

For SMEs and small mid-caps: The expanded exemptions and bias-detection allowances reduce your compliance burden—but only if you’ve properly classified your systems. Misclassification is now a material risk with 15 authorities potentially interpreting scope differently.

For sandbox participation: The August 2027 deadline means any testing programme you’re planning should be designed to work within existing regulatory frameworks first, then migrate into sandboxes later. Don’t wait for the infrastructure.

Open Questions Before August 2026

Coordination protocols: How will Ireland’s AI Office coordinate enforcement decisions across 15 authorities in the first 14 months? What dispute-resolution mechanism exists if authorities disagree on risk classification?

Domain authority readiness: Have all 15 competent authorities published guidance on their AI supervision expectations? Early clarity prevents August surprises.

Cross-border consistency: If financial regulators supervise AI differently in Ireland than in Germany, what happens to pan-European financial AI systems?

The May 7 agreement is substantive progress—but it’s exposed that Ireland’s distributed model will face its real test in the August 2026–August 2027 sandboxless period. Builders should engage with their relevant competent authority now, not after high-risk rules take effect.

Source: Council of the European Union / artificialintelligenceact.eu