The Library Media — Business & Markets · AI News & Intelligence Desk
Inside the EU AI Act’s Regulatory Sandboxes: A Controlled Route From Testing to Market
By Eleanor Ever Loyal
Follow The Library Media
The European Union’s AI Act creates a formal route for companies to test artificial intelligence systems under regulatory supervision before those systems reach the market. The mechanism is the AI regulatory sandbox, a controlled environment in which developers can experiment, gather evidence and identify compliance problems while regulators watch, advise and, where necessary, intervene.
The Act requires each member state to establish at least one AI regulatory sandbox at national level, with the provision in force since 2 August 2026. Sandboxes may also be established jointly by member states, or by the European Data Protection Supervisor for EU institutions, bodies, offices and agencies. Their purpose is to let providers develop, train, test and validate innovative AI systems under a plan agreed in advance with the competent authority, before the system is placed on the market or put into service.
The sandboxes are intended principally for providers of AI systems — especially small and medium-sized enterprises and start-ups, which the Act says should be given priority access — but participation is not limited to them. The Commission’s guidance envisages that prospective providers, deployers and other participants, including research organisations, may take part where their involvement supports testing and learning.
The sandbox is not a free pass to deploy an untested system: systems tested inside a sandbox remain subject to supervision, and any use outside the agreed plan is not covered. Providers must follow the sandbox plan, including its safeguards, risk-mitigation measures and data-protection arrangements. Where testing involves personal data, it must be processed in a way that complies with the EU’s data-protection law.
The arrangement also provides legal certainty. Where a provider follows the sandbox plan and the competent authority’s instructions in good faith, the Act provides that no administrative fine will be imposed for an infringement of the AI Act arising from the testing, although that protection does not extend to infringements of other law. Regulators may also give written guidance to participants, which the Act says is intended to help them meet their obligations once the system leaves the sandbox.
Sandboxes are also a tool for regulators as well as for industry. The Act expects authorities to use the evidence gathered in sandboxes to identify risks, improve their understanding of new technologies and inform later guidance and enforcement. Each sandbox must publish an annual report, and the Act requires the Commission to publish an annual report drawing on those national reports.
The framework also anticipates “real-world testing” outside sandboxes, under a separate set of rules, for high-risk AI systems under strict conditions and with informed consent where the testing involves people. That is a distinct route, not part of the sandbox itself, and is governed by its own conditions and safeguards.
Where the rules stand now is more complex. The sandbox obligations in Article 57 of the Act are in force, and the Commission has published guidance on the operation of sandboxes. The next stage — detailed rules on how sandboxes are established, operated and supervised — is still being developed through an implementing act. That implementing act has not yet been adopted, so while the obligation to establish sandboxes and the core principles are settled law, some operational detail remains to be finalised.
For companies planning to use a sandbox, the practical position is therefore clear in outline but incomplete in detail: the route exists, the intended participants are identified and the legal protections are defined, but the precise procedures for applying, operating and exiting a sandbox will depend on the implementing act and on the arrangements each member state puts in place.
— Eleanor Ever Loyal, National Desk
From The Library — the estate of our family.