AI regulatory sandbox in Europe: how startups can use one

An AI regulatory sandbox is a controlled environment, set up by a national competent authority, in which a startup or other provider can develop, train, test and validate an AI system for a limited time under an agreed plan and with guidance from the regulator. Under the EU AI Act, every Member State must have at least one operational by 2 August 2027, access is free for SMEs, and participants acting in good faith face no AI Act fines.

Key takeaways

• An AI regulatory sandbox is a controlled environment, run by a competent authority, where providers develop, train, test and validate an AI system for a limited time under an agreed plan and with regulatory guidance.
• After the Digital Omnibus, every Member State must have at least one national sandbox operational by 2 August 2027, and the AI Office may run an EU-level sandbox with priority access for SMEs and small mid-caps.
• Access is free for SMEs and start-ups, apart from exceptional costs, and participants who follow the plan in good faith face no AI Act fines.
• The exit report must be taken into account positively by market surveillance authorities and notified bodies in conformity assessment.
• In Ireland the AI Office of Ireland is set to host a sandbox under the Regulation of Artificial Intelligence Act 2026; check its status before planning around it.

What is an AI regulatory sandbox under the AI Act?

The legal basis is Article 57 of the AI Act, as amended by the Digital Omnibus on AI. A sandbox provides "a controlled environment that fosters innovation and facilitates the development, training, testing and validation" of AI systems for a limited time before they are placed on the market, under a sandbox plan agreed between the provider and the authority. It can include testing in real-world conditions.

Inside, the authority provides "guidance, supervision and support" to identify and mitigate risks, particularly to fundamental rights, health and safety, and explains what the Act expects and how to meet it.

How does it work, step by step?

1. Apply. Sandboxes are open to providers and prospective providers that meet transparent and fair eligibility and selection criteria. Applications can be made jointly with deployers and other partners. Authorities must tell applicants their decision within three months, under Article 58.
2. Agree a sandbox plan. You and the authority agree what will be developed and tested, how and for how long, and the safeguards for any real-world testing.
3. Develop and test under supervision. The authority advises as you go. Participation lasts for a period suited to the project's complexity, and can be extended.
4. Exit. On request you receive written proof of the activities carried out, and an exit report detailing the activities carried out in the sandbox.
5. Use the exit report. Market surveillance authorities and notified bodies must take it into account positively in conformity assessment, to speed procedures up to a reasonable extent.

What does a startup actually gain?

Four concrete benefits are written into the law:

Benefit	What the AI Act says	Where
Free access	Free of charge for SMEs and start-ups, except exceptional costs	Article 58(2)(d)
No AI Act fines in good faith	No administrative fines if you follow the plan and terms and act in good faith on guidance	Article 57(12)
Faster conformity	Exit reports taken into account positively by authorities and notified bodies	Article 57(7)
Priority and simpler procedures	Priority access for EU-based SMEs; simple, streamlined procedures for firms with limited legal capacity	Article 62, Article 58(2)(g)

Participation in a sandbox set up by one Member State is also mutually recognised across the Union with the same legal effects, under Article 58(2)(g). The limits matter too: you remain liable under EU and national law for damage to third parties, and the sandbox does not waive the Act's requirements.

What changed with the Digital Omnibus?

Two things. First, the deadline: the original text required national sandboxes to be operational by 2 August 2026; the consolidated Article 57(1) now says 2 August 2027. Second, a new EU-level option. The AI Office may establish a sandbox at Union level for AI systems it supervises under Article 75(1), working closely with national authorities, and it "shall provide priority access to SMEs, including start-ups, and SMCs". The Commission describes this as widening access to sandboxes for more innovators.

The Omnibus also requires the Commission's implementing acts on sandboxes to cover governance, including involvement of data protection authorities where relevant. Those implementing acts set the detailed eligibility, application and exit rules, so check whether they have been adopted before preparing an application.

What is the situation in Ireland?

Ireland's plan is for the AI Office to host the sandbox. When the government designated the 15 national competent authorities in September 2025, it said the National AI Office would drive AI innovation and adoption "by hosting a regulatory sandbox". The AI Office of Ireland was established in July 2026 under the Regulation of Artificial Intelligence Act 2026, and Matheson's summary of the Act notes it provides for regulatory sandboxes and real-world testing. At the time of writing we could not find a published call for applications, so contact the AI Office directly before building a timeline around it.

Which startups should apply?

A sandbox is worth the effort when regulatory uncertainty is a real obstacle:

• Likely high-risk products, such as AI for recruitment, credit scoring or education, where the Annex III obligations apply from 2 December 2027. Our high-risk AI checklist helps you decide.
• Borderline classification, where you want an authority's view on the Article 6(3) exemption.
• Real-world testing needs, where you must trial the system with real users before conformity assessment.
• Novel combinations of AI with other regulated areas, such as health data or financial services.

For a chatbot or content tool with only transparency duties, a sandbox is usually unnecessary.

How should I prepare an application?

1. Write a precise intended purpose and risk classification.
2. Prepare a draft sandbox plan: objectives, testing approach, timeline, success criteria.
3. Set out the safeguards for users and data, including your GDPR basis.
4. Assemble early technical documentation; the work overlaps with the steps in our guide to AI Act compliance by design.
5. Identify partners, such as a deployer willing to pilot with you.
6. Budget your team's time realistically: the sandbox is free, the preparation is not.

What are the pitfalls?

• Treating it as a licence. It is supervised development, not an exemption.
• Expecting speed. Decisions can take up to three months, and some national sandboxes are not yet running.
• Weak plans. Vague objectives make guidance less useful and exit reports less persuasive.
• Ignoring other law. Data protection, consumer and sector rules still apply.

If you also sell into the UK, its proposed AI Growth Labs, consulted on from October 2025 to January 2026, follow a different model; see our comparison of the EU AI Act vs the UK AI approach.

Frequently asked questions

Is joining an AI regulatory sandbox mandatory?

No. Participation is voluntary. A sandbox is most useful for novel or borderline products, especially potential high-risk systems, where early regulator guidance can save redesign later.

How much does an AI regulatory sandbox cost?

Access is free of charge for SMEs, including start-ups, under Article 58(2)(d) of the AI Act. Authorities may recover exceptional costs in a fair and proportionate way. Your own time and the cost of preparing documentation are the main expense.

Does a sandbox exempt me from the AI Act?

No. You must still meet the Act's requirements; the sandbox gives guidance and supervision while you do. What it offers is protection from AI Act administrative fines if you follow the sandbox plan and terms and act in good faith on the authority's guidance. You remain liable for damage to third parties.

Can a non-EU startup join an EU sandbox?

Sandboxes are open to providers and prospective providers that meet the eligibility and selection criteria. Member States must give priority access to SMEs with a registered office or a branch in the EU, but this does not exclude others that meet the criteria.

Is the UK AI Growth Lab the same thing?

It is a similar idea with a different legal basis. The UK government consulted on AI Growth Labs from October 2025 to January 2026, proposing supervised pilots where specific rules are temporarily adjusted. An EU AI Act sandbox, by contrast, is a statutory mechanism every Member State must provide.

If you are weighing whether a sandbox would help your AI product, book a free 30-minute call.

Cover photo by Thirdman on Pexels.