AI Omnibus extends EU AI Act sandbox deadline for member states to 2027

The EU AI Act Omnibus Regulation moves the deadline for every EU member state to have at least one national AI regulatory sandbox operational from 2 August 2026 to 2 August 2027.

The change took legal effect when the Omnibus Regulation entered into force on 27 July 2026, days before the original deadline would have passed.

What it is

The underlying AI Act entered into force on 1 August 2024 and follows a phased implementation, with sandbox obligations originally sitting on the same 2 August 2026 track as many other AI Act requirements.

The European Commission's own implementation timeline notes that it takes into account the AI Act amendments introduced by the Digital Omnibus on AI, and that the full roll-out of the Act's main application milestones is now foreseen by 2 August 2028.

The sandbox provision is one piece of a wider set of changes in the Digital Omnibus on AI, whose most significant element is postponing the applicability of high-risk AI obligations.

The agreement aims at postponing the deadline for member states to establish AI regulatory sandboxes by national competent authorities to 2 August 2027.

What it requires

Each national sandbox must still be established by a competent national authority, and that authority is responsible for overseeing the sandbox and providing guidance to participating companies on regulatory compliance during the testing phase.

The Regulation also introduces an EU-level regulatory sandbox that may be established by the AI Office in cooperation with relevant authorities, which is meant to complement rather than replace the national programs.

SMEs, start-ups and small mid-cap companies will receive priority access to sandboxes established by the AI Office.

The broader package containing this sandbox change cleared its final legislative step when the Council of the European Union gave final approval to the Digital Omnibus simplification package on 29 June 2026.

What security leaders should do

Security leaders planning to use a national sandbox to validate an AI system should assume staggered openings across member states through 2 August 2027 rather than uniform availability starting now, since that date is only the deadline for each country to have at least one program running. Teams that intended to lean on sandbox testing while preparing for the separately delayed high-risk obligations under Annex III should track the two timelines independently in their compliance calendars, because sandbox access and Annex III deadlines move on related but distinct schedules. Organizations with limited headcount, such as SMEs and small mid-cap companies, should also evaluate whether the EU-level sandbox run by the AI Office, which gives them priority access, is a faster path than waiting on a national authority that has not yet stood up its own program.