Commission sets first common rules for artificial intelligence regulatory sandboxes

The European Commission has adopted the first harmonised EU rules for establishing, developing, operating and supervising artificial intelligence regulatory sandboxes, the controlled frameworks in which providers test innovative AI systems under regulatory supervision before placing them on the market. Commission Implementing Regulation (EU) 2026/2487 of 10 November 2026 was published in the Official Journal of the European Union on 11 November 2026. It enters into force on 1 December 2026, the twentieth day after publication, and is binding in its entirety and directly applicable in all Member States.

The regulation is adopted under Article 58(1) of Regulation (EU) 2024/1689 (the AI Act) and applies to all sandboxes set up under Article 57 of that regulation, including those of national competent authorities, the European Data Protection Supervisor and the AI Office. It is structured in four chapters and ten articles, preceded by 26 recitals, and carries EEA relevance. The European Data Protection Supervisor was consulted and delivered an opinion on 6 March 2026, and the text received the favourable opinion of the Artificial Intelligence Committee.

The stated aim is to prevent fragmentation of the single market and to guarantee mutual recognition of sandbox results. Under the AI Act, each Member State must have at least one AI regulatory sandbox at national level by 2 August 2027; joint sandboxes between Member States, as well as sectoral, regional or local ones, are expressly encouraged.

Priority and free access for start-ups

Cost and access are the core of the new regime:

• Participation is prioritised and free of charge for SMEs, including start-ups, and for public authorities, bodies and agencies, for regulatory guidance, advice, supervision, real-world testing and conformity assessment support.
• Exceptional costs may only be recovered in a fair, transparent and proportionate way, and must be flagged before participation starts.
• Sandboxes run by the AI Office must also give priority to small mid-cap enterprises (SMCs).
• Undertakings other than SMEs may be charged fees equal to the full cost of the services, published when the call opens.
• Providers without a registered office or branch in the Union must pay a participation fee and designate an authorised representative established in the EU.

Selection in three months, exit report in 45 working days

Applications are open to any provider or prospective provider, including for AI systems not yet placed on the market, systems subject to substantial modification, and systems that became high-risk after entry into service. Five cumulative selection criteria are fixed: the need for the sandbox, the potential and scalability of regulatory learning, contribution to public interest, maturity of the proposal, and the innovative character of the system. Competent authorities must notify applicants of the outcome within three months of a complete application or of the call deadline, and rejected applicants have a right of appeal.

Once selected, a sandbox plan is agreed setting the timeline, objectives, supervised requirements, risk-management safeguards, incident-reporting procedure and, where relevant, a real-world testing plan. Projects may be extended by mutual agreement until 30 calendar days before the planned end date, and suspended if the plan is breached or if unmitigable risks to health, safety or fundamental rights arise; suspensions must be notified to the AI Office.

On completion, the participant receives a written proof and an exit report no later than 45 working days after finishing participation. Neither document has the legal effect of a declaration of conformity under Article 47 of the AI Act, but market surveillance authorities and notified bodies in any Member State must recognise them as documentation of the work carried out, and should take them into account to speed up conformity assessment.

Transparency and reporting duties

Competent authorities must send the Commission the information required for the single information platform, may share compliance tools such as technical specifications, benchmarks and testing tools, and must apply templates and guidance adopted by the European Artificial Intelligence Board. Data protection authorities are associated whenever personal data are processed, and confidentiality under Article 78 of the AI Act is preserved. Annual reports go to the AI Office and the Board and must be published online, excluding sensitive operational data of law enforcement, border control, immigration or asylum authorities.

The regulation gives Europe’s AI start-ups a single, predictable route into supervised testing, with a clear cost regime, deadlines and portable results. For readers across the industry, the practical test begins now: national authorities have until 2 August 2027 to have sandboxes running under these common rules.

Source: Official Journal of the European Union, L series, No 2026/2487, 11 November 2026, Legislation (section I), p. 1/12 (official reference: Commission Implementing Regulation (EU) 2026/2487; ELI: reg_impl/2026/2487/oj).