The European Commission has set one rulebook for every EU AI Act regulatory sandbox. Implementing Regulation (EU) 2026/2487, adopted on November 10, 2026 and published in the Official Journal on November 11, fixes who can apply, what a sandbox may charge, how fast an authority must answer and what a company gets when it leaves. It enters into force on December 1, 2026, the twentieth day after publication.
An AI regulatory sandbox is a supervised test space run by a national authority under Article 57 of the AI Act. A provider develops, trains or tests an AI system there for a limited time, with regulators advising on how the rules apply, before the system goes on the market. Until now each country could design its own entry process; the new regulation applies to all of them, including any sandbox the AI Office runs at EU level.
Who can get in
Any provider or prospective provider may apply, and not only in the country where it is based. The project has to concern one of three kinds of AI system:
- a system not yet placed on the market or put into service;
- a system already on the market that will be substantially modified;
- a system that was not classed as high-risk but has been put to a use that makes it high-risk.
Authorities must weigh at least five criteria: the regulatory need, how much others can learn from the project, public-interest benefit, the maturity of the proposal and how innovative the system is. Small and medium-sized firms, start-ups included, get priority, provided they have a registered office or branch in the EU. Recital 6 of the regulation says each member state should have its sandbox running by August 2, 2027.
What it costs
| Applicant | Price of guidance, advice and supervision |
|---|---|
| SME or start-up | Free; only agreed “exceptional costs” for extra services can be charged, with an itemised invoice |
| Public authority or agency | Same as SMEs |
| Other companies | A fee up to the full cost, from a list the authority must publish when it opens applications |
| Provider with no EU office or branch | A participation fee, plus a written mandate naming an authorised representative in the EU |
Free supervision for smaller firms also covers testing in real-world conditions and support for conformity assessment, according to Article 2(3).
The deadlines that matter
| Step | Rule | Worked example |
|---|---|---|
| Decision on an application | No later than 3 months after a complete application, with a right to appeal | Complete application on January 15, 2027: answer due by April 15, 2027 |
| Extending a project | Both sides agree, until 30 calendar days before the planned end | Planned end June 30, 2027: last day to agree is May 31, 2027 |
| Exit report | Within 45 working days after participation ends | End on June 30, 2027: report due by September 1, 2027, before any public holidays are counted |
The example dates are our calculation from the regulation’s articles, not dates set by any authority. Public holidays differ by country and push the exit report later.
What a sandbox does not give you
Leaving a sandbox is not market approval. The written proof and the exit report “shall not have the same status or legal effect as a declaration of conformity,” the regulation says. Market surveillance authorities and notified bodies in every member state must recognise both documents as a record of what was tested, which should shorten a later conformity assessment, but participants stay responsible for complying with EU law throughout.
Exit reports can become public. With both sides’ agreement the full report goes to the Commission’s single information platform; without it, the authority may still publish non-confidential key findings. Information not marked confidential in the sandbox plan, or flagged before the project ends, is presumed open to disclosure, so companies should mark trade secrets in the plan from the start.
For other recent AI rules aimed at data handling, see our report on the UK ICO’s call for evidence on agentic AI.
