The text runs to 12 pages in the Official Journal dated Nov. 11, and almost all of it is procedure. Who may enter an AI regulatory sandbox, how a project is admitted, what a supervisor must record, when testing can be suspended, and what document a participant receives on the way out. The Commission adopted it on Nov. 10 as Implementing Regulation (EU) 2026/2487.
What it does not contain is a single sandbox. Under Article 57 of the AI Act, Regulation (EU) 2024/1689, each member state must ensure its authorities establish at least one national sandbox that is operational by Aug. 2, 2027. The implementing regulation, which applies from Dec. 1, tells those authorities how to run one once they have it. The deadline arrives roughly nine months after the rules take effect.
The structure is federal in the European sense. A member state may build its own sandbox or establish one jointly with others, which is the route small countries with thin technical staff are expected to take. The Commission may provide technical support and tools. The AI Office may open a union-level sandbox for systems it supervises, and that one must give priority access to small and medium enterprises, including startups, and to small mid-caps.
Admission is where the regulation spends its detail. Competent authorities must publish transparent criteria and run a fair selection, and the regulation requires procedures for appealing administrative decisions, a provision that exists because a sandbox place is a scarce good with commercial value. Each participant gets a sandbox plan that specifies the activities, the objectives and the metrics against which progress will be judged.
Supervision is continuous rather than ceremonial. Authorities evaluate admitted projects against their plans, and the regulation sets out the conditions under which testing can be suspended temporarily or permanently, including a breach of the plan. Participants must be told what happens when a project fails, which in most regimes means the sandbox ends and the ordinary rules resume.
The exit document matters more than it sounds. Under Article 57(7) of the AI Act, a participant receives written proof of what was done in the sandbox, and the implementing regulation says that proof should feed regulatory learning and inform notified bodies and market surveillance authorities. In plain terms, a company that tests a model under supervision gets a paper trail it can show a conformity assessor, and a supervisor gets a record of what it learned about a technology it had not seen before.
That is the honest purpose of a sandbox, and it differs from the one in the marketing. A sandbox is usually described as a place where rules are relaxed. The AI Act’s version relaxes guidance, not law. Article 57 states that participants remain liable under Union and national liability law for damage caused to third parties, and the regulation repeats the point by building the process around documentation rather than immunity.
One narrower benefit is real. Where other regulators take part and provide guidance, the AI Act provides that no administrative fines will be imposed under their rules for conduct supervised in the sandbox. That is meaningful protection for a product that touches medical devices, machinery or financial services, and it is available only to participants who are admitted and who follow a plan.
Capacity will decide whether the deadline holds. Running a sandbox requires people who understand model evaluation, sector law and procurement, and several national authorities have said publicly that they are hiring. Joint sandboxes and Commission tooling are the answers the regulation offers, and neither replaces staff.
Comparisons are inevitable and mostly unflattering to the schedule. Britain’s sandbox, Singapore’s and several sectoral pilots have run for years with narrower scope and no statutory backing. The European version is broader, slower and uniform, which is the trade the single market requires. A company that wants one rule across 27 countries accepts that the rule arrives later.
For the companies that will apply, the strategic read is straightforward. Participation buys dialogue with the person who will later assess compliance, and it buys a written record. It does not buy permission. A startup that treats admission as a license to ship will learn at the exit interview that the sandbox produced a document, not a determination.
The nine-month runway also sits inside a longer compliance calendar. Prohibitions and general-purpose model obligations under the AI Act phase in on their own schedule, and the sandbox deadline is one item among several that national authorities must meet with the same small pool of experts. Ministries that have not named a sandbox team are already behind a schedule they did not set.
There is a political reading too. A sandbox is a place where a regulator learns what questions to ask, and Brussels has decided that this learning should happen under a common procedure rather than 27 improvisations. The regulation’s uniform admission criteria and reporting duties are how a decentralized system produces comparable experience, which is the only way a Union-level rulebook gets written by people who have watched the technology work.
The open question is what happens if Aug. 2, 2027 arrives without an operating sandbox. The AI Act states the obligation and the implementing regulation describes the machinery, and neither describes a consequence for a government that misses the date. Enforcement of the AI Act runs against companies. There is no equivalent mechanism aimed at a ministry, which is why the deadline will probably be met on paper and tested in practice.
