(1)

In accordance with Regulation (EU) 2024/1689, AI regulatory sandboxes are intended to provide a controlled framework established by competent authorities to enable the development, training, validation and testing, including in real-world conditions, of innovative AI systems pursuant to a sandbox plan under regulatory supervision for a limited time before their placement on the market.

(2)

To avoid fragmentation across the Union, maximise the benefits of AI regulatory sandboxes for all, and guarantee the consistent implementation of Regulation (EU) 2024/1689, it is important to adopt common rules setting out the detailed arrangements regarding the establishment, development, implementation, operation and supervision of the AI regulatory sandboxes. Such rules should be in line with the objectives of the AI regulatory sandboxes and other relevant provisions set out in Regulation (EU) 2024/1689. These rules should also ensure coherence and complementarity with Union initiatives supporting data-driven innovation and with relevant Union sectoral frameworks governing the development and placing on the market of regulated products and systems.

(3)

AI regulatory sandboxes aim to enhance legal certainty for innovators and support them in achieving regulatory compliance with Regulation (EU) 2024/1689 and, as appropriate, other Union law, such as Regulation (EU) 2016/679 of the European Parliament and of the Council (2), and Union product safety legislation. They should also promote responsible innovation and competitiveness and accelerate access of innovative AI systems to the Union market by removing barriers for small and medium enterprises (‘SMEs’), including start-ups. AI regulatory sandboxes play a key role in connecting innovators with competent authorities through a collaborative approach and in enhancing the competent authorities’ oversight and understanding of the opportunities, emerging risks and the impacts of AI use. Participation in AI regulatory sandboxes should focus on issues that may raise legal uncertainty for providers and prospective providers to innovate and experiment with AI in the Union.

(4)

Services provided in an AI regulatory sandbox typically constitute non-economic activities that include providing regulatory guidance, advice, and supervision by a competent authority of AI system development, testing and validation and support for conformity assessment as special supervisory and regulatory arrangement for regulatory compliance and regulatory learning purposes, to the extent they can be seen as an exercise of public powers. The AI regulatory sandbox must ensure transparent admission criteria and a fair process that focuses on regulatory challenges, time-limited participation, transparency and a wide dissemination of the outcomes for regulatory learning purposes and for the benefit of other participants, the wider (internal) market and the AI innovation ecosystem for trustworthy AI. This is without prejudice to State aid rules, as applicable, for activities and services of an economic nature by the AI regulatory sandbox (if any) provided to participants.

(5)

This Regulation lays down detailed rules as regards the establishment, development, implementation, operation and supervision of AI regulatory sandboxes by competent authorities pursuant to Article 57(1), (2), (3) and (3a) of Regulation (EU) 2024/1689. For reasons of uniform application and common interpretation concerning regulatory questions examined in the AI regulatory sandbox, as well as mutual recognition of the results, this Regulation should apply to all AI regulatory sandboxes under Regulation (EU) 2024/1689.

(6)

AI regulatory sandboxes should be widely available across the Union and enable broad and equal access to providers and prospective providers. Member States should have at least one AI regulatory sandbox at national level as required by Regulation (EU) 2024/1689. To that end, any provider or prospective provider within the scope of Regulation (EU) 2024/1689 should be able to apply and participate in the AI regulatory sandbox as long as the relevant conditions and procedures established in this Regulation are met. Such AI regulatory sandboxes should be established in the Member States by 2 August 2027. Piloting projects are also encouraged before competent authorities under Regulation (EU) 2024/1689 have been formally designated by the Member States. Joint AI regulatory sandboxes may be set up with competent authorities from other Member States for fulfilling the obligation of establishing an AI regulatory sandbox with an equivalent level of national coverage. Member States are encouraged to establish joint AI regulatory sandboxes facilitating cross-border collaboration, streamlining coordination, optimising resources and strengthening consistency in the implementation of Regulation (EU) 2024/1689. Joint AI regulatory sandboxes should be established through appropriate framework agreements, for example a memorandum of understanding. Additional AI regulatory sandboxes may also be established in specific sectors (including jointly with competent authorities of other Member States), at regional or local level, or at Union level. Sector-specific AI regulatory sandboxes may be established at different levels (regional or local, national or jointly) and can be particularly useful in industrial or public areas of particular strategic importance and in areas of notable regulatory implementation challenges that are in need of support, including in the public sector.

(7)

The European Data Protection Supervisor may establish an AI regulatory sandbox to support the responsible development, testing and use of AI systems provided by the EU institutions, bodies, offices and agencies. Additionally, the AI Office may establish an AI regulatory sandbox at Union level for AI systems covered by Article 75(1) of Regulation (EU) 2024/1689, which is to be implemented in close cooperation with relevant competent authorities.

(8)

It is important that the terms and conditions for the participation in an AI regulatory sandbox are made clear to the provider or prospective provider as early as possible in a transparent and non-discriminatory manner and agreed upon before entering the sandbox. These can be accepted with an electronic signature.

(9)

Participation by SMEs, including start-ups, should be free of charge unless exceptional costs are incurred in the AI regulatory sandbox. In those cases, SMEs, including start-ups, should be informed in advance and the exceptional costs recovered in a fair, transparent and proportionate manner, without prejudice to Member States making use of possibilities foreseen under the State aid rules. The same pricing regime should apply to public authorities, bodies and agencies.

(10)

For all other participants, the costs of participation must be non-discriminatory and transparent. Competent authorities may charge fees that equal the actual costs incurred for the provision of those services. This is without prejudice to State aid rules, as applicable, for services of economic nature provided in the AI regulatory sandbox (if any). The competent authority should therefore communicate the applicable fees to the provider or prospective provider in an AI regulatory sandbox as early as possible and at the latest before the participation starts and when the services are determined, as well as any exceptional costs that may arise. If the competent authority claims exceptional costs, the invoice should be sufficiently detailed that the participant understands which costs have occurred, for what services and how they have been calculated.

(11)

Competent data protection authorities should be associated to the operation of the AI regulatory sandbox and supervise when personal data is processed for the development, training or testing of the AI system in the context of the AI regulatory sandbox. When the AI regulatory sandbox projects examine issues that otherwise fall under the supervisory remit of other competent authorities, including those supervising the protection of fundamental rights or those providing or supporting access to data, the latter should be associated as appropriate.

(12)

While aiming to ensure the objective of regulatory learning through the sharing of results of participation in AI regulatory sandboxes, competent authorities should respect the confidentiality of information and data obtained in carrying out tasks connected to the AI regulatory sandbox, in accordance with Article 78 of Regulation (EU) 2024/1689.

(13)

It is important to avoid fragmentation and to ensure that the necessary procedures, processes, and administrative requirements are clearly described, accessible, streamlined and easy to understand, as well as to ensure mutual recognition of the results. Competent authorities across the Union should apply uniform and common criteria as defined in this Regulation and should apply relevant available templates and guidance material adopted by the European Artificial Intelligence Board (‘the Board’) under Article 66(d) of Regulation (EU) 2024/1689 for participating in all AI regulatory sandboxes. Possible adjustments to these templates by competent authorities in specific AI regulatory sandbox projects within clearly defined cases may be done only where strictly necessary and duly justified due to the specific needs and context of the AI regulatory sandbox, while taking due account of the need to avoid fragmentation, ensure common criteria for and consistency in the implementation of the AI regulatory sandboxes across the Union, keep the process simple and streamlined for participants in an AI regulatory sandboxes and not lead to increased administrative burden. Under Article 66(d) of Regulation (EU) 2024/1689, the Board may decide to amend or update the templates, where appropriate, in light of practical experience gained from their application and policy and technological developments.

(14)

When selecting participants, competent authorities should review the eligibility of the candidates and the selection criteria laid down in this Regulation, where competent authorities may take into account the available resources and capacity for the number of applicants they can accept. For the selection criteria, this includes the specific regulatory and practical challenges in the proposed sandbox project, such as the lack of (physical, digital or hybrid) testing environments or when there are regulatory challenges related to potential unclarity or challenges for an AI system to meet specific legal requirements. Competent authorities should also review the potential for and scalability of regulatory learning for the specific sector, such as to what extent participation in the AI regulatory sandbox will lead to more regulatory knowledge about the specific sector and the technology, and to what extent the legal questions examined in the sandbox will enhance the learning and the potential of broader uptake and development of AI in the specific sector. When assessing the extent to which the project will contribute to the public interest or societal benefit and Union policy, competent authorities may consider the collective interest, the positive impact to a specific sector and its contribution to competitiveness, which may encompass the benefit to the Union’s AI ecosystem. There may be different levels of maturity in the proposals for an AI regulatory sandbox project, where competent authorities may consider the maturity of the proposal in light of the authority’s available capacity and the other selection criteria. When assessing the innovative character of an AI system in a proposal for an AI regulatory sandbox project, competent authorities should take into account the novelty of the AI system, with such novelty arising in particular either from novel or improved technologies, design, methods, or architectures or other elements throughout any stage of the AI system’s life cycle relative to the current state of the art, or from the novel application or adaptation of existing technology to a new domain or use case. The innovative character may also arise from novel measures aimed to ensure compliance with applicable legal requirements, enhanced fundamental rights safeguards or improved safety performance of the AI system. Any additional selection criteria that may be added by competent authorities should be reasonable, proportionate and duly justified due to the context and objectives of the AI regulatory sandbox and broader national strategies and priorities, while taking into account the aim of AI regulatory sandboxes allowing broad and equal access through national coverage and having uniform and common selection criteria in the Union.

(15)

The right to appeal decisions made by competent authorities may cover non-compliance with the eligibility criteria or the outcome of the selection procedure. The appeal should be filed in accordance with the relevant Union or national legislation and procedures for appeal of administrative decisions. The appeal procedure should include the right of every person to be heard, the right of every person to have access to his or her file, and the obligation of the administration to give reasons for its decision.

(16)

Due to their limited administrative resources to navigate the legal landscape and ensure compliance with Regulation (EU) 2024/1689, SMEs, including start-ups, should have priority access to AI regulatory sandboxes if they meet the eligibility and selection criteria, and have a registered office or a branch in the Union. The AI regulatory sandboxes that may be established by the AI Office should provide priority access to SMEs, including start-ups, and small mid-cap enterprises (‘SMCs’), pursuant to Article 57(3a) of Regulation (EU) 2024/1689.

(17)

In line with broader Union and national AI strategies and priorities, while respecting the aim of achieving national coverage in the AI regulatory sandbox, competent authorities may, in the selection of participants, choose to periodically focus on multiple, specific sectors that are in industrial or public areas of particular strategic importance and in areas of notable regulatory implementation challenges that are in need of support, depending on their capacities, especially in the early implementation phases of the AI regulatory sandbox.

(18)

Competent authorities are encouraged to offer or refer to digital, physical or hybrid testing infrastructure in the AI regulatory sandbox. In order to adequately leverage available resources and infrastructure at the Union and national level and promote synergies with the AI regulatory sandboxes, competent authorities should, as appropriate, ensure cooperation with and facilitate the involvement of relevant AI ecosystem actors, such as the Testing and Experimentation Facilities, the European Digital Innovation Hubs, AI Factories, and other AI innovation initiatives. Competent authorities should, where appropriate, facilitate involvement of actors such as national or European standardisation organisations, notified bodies, research and experimentation labs and relevant stakeholder and civil society organisations. Involvement of notified bodies in an AI regulatory sandbox should not compromise their tasks nor their compliance with the requirements to which they are subject to under Regulation (EU) 2024/1689, while facilitating early knowledge of the activities performed in the AI regulatory sandbox and their general alignment with the state of the art benchmarks and testing methodologies. Where appropriate, there should be supervision by the competent authority of specific projects within the AI regulatory sandboxes that may be carried out in existing Union and national AI ecosystem initiatives and infrastructure. Member States are encouraged to establish joint AI regulatory sandboxes leveraging these infrastructures and facilitating cross-border collaboration and testing.

(19)

In order to frame a specific set of actions for developing, training, testing or validating concrete projects of innovative AI systems in the controlled environment of an AI regulatory sandbox and to allocate the necessary resources, the sandbox plan should address the needs of the participants, specifying their objectives, as well as the relevant risk management safeguards and the support to be provided by the competent authorities, and other entities involved.

(20)

Participation in an AI regulatory sandbox should support a path towards conformity with Regulation (EU) 2024/1689. Participation in and exiting from an AI regulatory sandbox should not be considered an approval by the competent authorities to the provider or prospective provider to place on the market or put into service the AI system supervised in the AI regulatory sandbox under Regulation (EU) 2024/1689. Since exiting an AI regulatory sandbox does not grant presumption of conformity with the legal requirements of Regulation (EU) 2024/1689, market surveillance authorities and notified bodies should positively take into account the exit reports and the written proof provided by the competent authority with a view to accelerating conformity assessment procedure to a reasonable extent.

(21)

In order to facilitate and accelerate the placing of AI systems onto the Union internal market, testing in real-world conditions may be conducted within the framework of an AI regulatory sandbox. Such testing should not affect other Union and national law on the testing in real-world conditions. With the involvement of the sectoral competent authority under the Union harmonisation legislation listed in Annex I to Regulation (EU) 2024/1689, testing of high-risk AI systems embedded in regulated products or systems that constitute products themselves subject to specific requirements set out in the relevant Union harmonisation law could also be conducted, as appropriate. For AI systems classified as high-risk AI systems in accordance with Article 6(1) or Regulation (EU) 2024/1689 related to products covered by the Union harmonisation legislation listed in Section B of Annex I, such testing may be conducted only in so far as the requirements for high-risk AI systems under Regulation (EU) 2024/1689 have been integrated in that Union harmonisation legislation.

(22)

Exit reports are useful for regulatory learning and contribute to the dissemination of lessons learned. It is necessary to lay down rules regarding the content of the exit report referred to in Article 57(7) of Regulation (EU) 2024/1689. Publication and dissemination of the results of a specific sandbox project for the benefit of everyone should encourage dialogue among competent authorities, participants and non-participants, such as relevant stakeholders. In order to enable regulatory learning in the Union and the ability of competent authorities in other Member States to consider, among others, the key findings and lessons learned, whenever the written proof and exit report are published, it should be done in one or more of the official languages of the institutions of the Union, as indicated by the competent authority. Competent authorities should possibly ensure that one of the languages determined by them is one which is broadly understood by the largest possible number of cross-border providers or prospective providers.

(23)

The Board and the Commission should collaborate on the evaluation of the AI regulatory sandboxes established in the Member States or at Union level. This should be done by taking into account the impact an AI regulatory sandbox has had, including the lessons learned, and in terms of evaluating the processes and governance. Such an evaluation may be done by an independent body.

(24)

AI regulatory sandboxes established under this Regulation are without prejudice to other legislation allowing for the establishment of other sandboxes aiming to ensure compliance with laws other than Regulation (EU) 2024/1689.

(25)

The European Data Protection Supervisor was consulted in accordance with Article 42(1) and (2) of Regulation (EU) 2018/1725 of the European Parliament and of the Council (3) and delivered an opinion on 6 March 2026.

(26)

The measures provided for in this Regulation are in accordance with the opinion of the Artificial Intelligence Committee,