On 17 June 2026, Ireland published the Regulation of Artificial Intelligence Bill 2026. It stands up the machinery that will enforce the EU AI Act on Irish soil: a new AI Office of Ireland, due to be operational by 1 August 2026, and a distributed model that hands AI oversight to fifteen existing regulators, the Data Protection Commission and the Central Bank among them.
Most Irish businesses have not noticed. The ones who have mostly filed it under “legal, later”. And nearly all of them are still doing the one thing this shift should make them think twice about: pouring their prompts, their customer records and their case files into American AI providers, on the comfortable assumption that a European data centre makes it fine.
It does not. And this is not an Irish story. It is a European one.
What Ireland just did
The Bill is Ireland’s implementation of Regulation (EU) 2024/1689, the AI Act. The new AI Office coordinates, advises, and acts as Ireland’s single point of contact with Brussels. The actual supervision sits with the regulators you already answer to: the Central Bank for financial services, the Health Products Regulatory Authority for medical devices, Coimisiún na Meán for online platforms, and the Data Protection Commission for data. Ireland had already designated fifteen national competent authorities in September 2025. The Bill puts that structure on a statutory footing.
Lawyers are debating the detail, how much power the central Office really holds, whether the funding is adequate, and that is worth reading. But for a business using AI, the headline is simpler: the people who regulate your industry are now the people who regulate your AI.
The assumption almost nobody has checked
Here is the line that gets waved through in almost every procurement conversation. “We use a US provider, but it runs in their EU region, so the data stays in Europe.” Everyone nods. The box is ticked. The matter is closed.
The matter is not closed. Data residency, where the bytes physically sit, is not the same as data sovereignty, who holds legal power over them. An EU region gives you the first. It does nothing for the second, because legal power follows the company, not the server.
Why “fine” is a European problem, not an Irish one
When the company holding your data is US-controlled, US law reaches it wherever it sits. The CLOUD Act lets American authorities compel a US-based provider to produce data it holds anywhere in the world, including its European data centres, without notifying you and without involving any European court. A European subsidiary with a sovereign-sounding name does not sever that, because the US parent still exists, and the parent is still bound.
You do not have to take our word for it. In June 2025, at a hearing of the French Senate, Microsoft’s own director of legal affairs for France was asked under oath whether he could guarantee that French citizens’ data held in Microsoft’s cloud would never be passed to US authorities without the approval of the French state. His answer was one sentence.
No, I cannot guarantee it.
And the ground underneath all of this is moving. The EU-US Data Privacy Framework, the mechanism meant to make these transfers lawful, is under fresh legal challenge. The two frameworks before it were both struck down. This is the third.
None of that is specific to Ireland. The AI Act is an EU regulation. All twenty-seven member states are standing up the same enforcement, pointed at the same kind of regulators, over the same data. Ireland is simply one of the first to show its hand.
The question your regulator is about to ask
Put the two halves together. Enforcement of AI is moving to your sector’s regulator. And your AI, for most European businesses, runs on infrastructure a foreign government can reach.
It is not hard to see where that goes. A bank under the Central Bank, a hospital, an insurer, a public body, will at some point be asked a plain question: where does your AI send its data, and can anyone outside the EU compel access to it? “We trust our provider not to look” is an answer about willingness. It is not an answer about capability. And the provider’s own lawyer has already said, under oath, that willingness is all there is.
The fix is architecture, not a better promise
Every reassurance on offer is a version of the same thing: a stronger contract, a sovereign-region rebrand, a no-training pledge. They are all promises. They all ask you to trust that a company which can hand over your data will choose not to.
Sovereignty is not a better promise. It is an arrangement in which the provider is structurally incapable of betraying you, because your data never sits anywhere it could be compelled from.
You do not want a provider who promises not to look. You want a provider who structurally cannot.
That is what we built TensorX to be. EU-incorporated and EU-resident, so there is no US parent to compel and no CLOUD Act hook. Zero data retention by design, for everyone, so there is nothing stored to hand over. Open-weight models on our own European hardware, so your data never leaves European jurisdiction and never touches infrastructure a foreign government can reach.
Ireland set the alarm. The rest of Europe is next. The businesses that come through this well will be the ones who stopped assuming, and started asking where their AI actually runs.
Read why an EU region is not the same as sovereignty, or the five questions every enterprise should ask its AI vendor. Or talk to us about sovereign inference.
