TLDR: A new research paper by Deirdre Ahern examines the EU AI Act’s requirement for national AI regulatory sandboxes, intended to foster innovation and compliance. The paper identifies a “triple challenge” for Member States: building sufficient capacity (expertise and resources), ensuring coordination to prevent fragmentation and “sandbox arbitrage,” and making these sandboxes attractive to AI providers. Key concerns for innovators include the inability to relax legal rules, the lack of a presumption of conformity upon exit, confidentiality issues, and potential liability during testing. With many Member States still in early stages of implementation, the paper emphasizes the critical need for decisive EU leadership and clear guidance to ensure the sandboxes’ effectiveness and cohesion.
The European Union’s Artificial Intelligence Act, adopted in 2024, marks a significant step towards regulating AI systems within the EU market. A core component of this new rulebook is the requirement for Member States to establish national AI regulatory sandboxes. These sandboxes are envisioned as controlled environments where innovative AI systems can be tested and validated under regulatory supervision, with the dual aim of fostering innovation and ensuring compliance with the Act’s stringent requirements. However, a recent research paper, “Operationalising AI Regulatory Sandboxes under the EU AI Act: The Triple Challenge of Capacity, Coordination and Attractiveness to Providers” by Deirdre Ahern, delves into the considerable challenges facing Member States in operationalizing these sandboxes.
The Dual Mandate: Innovation and Compliance
AI regulatory sandboxes are designed to support the testing and compliance needs of providers of high-risk AI systems. They aim to allow short-term testing under supervision, boosting competition by aiding market entry for compliant AI. This concept draws inspiration from fintech regulatory sandboxes, which have been widely used globally to help innovators navigate complex financial services frameworks. However, the AI Act presents a unique setting, covering a broad spectrum of risks from health and safety to ethics and fundamental rights, making its application more complex than its fintech predecessors.
The Triple Challenge
The paper identifies three primary challenges for Member States in successfully implementing AI regulatory sandboxes:
1. Capacity: Establishing and running these sandboxes demands a formidable array of resources and expertise. National competent authorities need to integrate technical understanding of AI, regulatory knowledge, and expertise in fundamental rights. This is a steep learning curve, requiring diverse and appropriately skilled personnel. Fintech sandboxes have proven to be resource-intensive, and AI sandboxes, with their broader scope, will be no different. Without adequate resourcing and cross-cutting expertise, sandboxes may struggle to provide trusted and useful insights, potentially losing market confidence.
2. Coordination: The decentralized nature of the AI Act means that each Member State will establish its own national sandbox. This raises a significant risk of differing approaches and interpretations of the AI Act across the EU. Such fragmentation could lead to “sandbox arbitrage,” where innovators strategically choose sandboxes perceived as less stringent, undermining the goal of a uniform application of the AI Act. The paper strongly argues for decisive action from the European Commission and the AI Board to develop clear rules and guidance, ensuring a cohesive and coordinated approach among national sandboxes. Delays in providing such guidance exacerbate this risk, forcing Member States to act in a vacuum.
3. Attractiveness to Providers: Participation in AI regulatory sandboxes is voluntary, and innovators may find alternative compliance routes more appealing. Several factors contribute to this potential lack of attractiveness:
- No Rule Relaxation: Unlike some fintech sandboxes, the AI Act generally does not permit the relaxation of existing legal rules during sandbox participation. Other EU laws, including consumer protection and data protection (GDPR), continue to apply. While there’s a limited exception for processing personal data for certain public interest AI systems, it’s considered burdensome. This rigidity may deter innovators seeking more flexible testing environments.
- No Presumption of Conformity: Upon exiting a sandbox, participants receive an exit report, which “shall be taken positively into account” by market surveillance authorities and notified bodies to “accelerate conformity assessment procedures.” However, this falls short of granting a direct presumption of conformity with the AI Act, which is a significant benefit offered by adhering to harmonized standards. Innovators might prefer the more direct and legally certain route of applying harmonized standards.
- Confidentiality Concerns: Innovators are often reluctant to disclose proprietary algorithms, trade secrets, and confidential information to regulatory authorities, especially if those authorities also interact with competitors. While confidentiality obligations exist, the perceived risk of exposure could be a deterrent.
- Liability Issues: Despite insulation from administrative fines for good-faith participants, innovators could still face civil liability actions from third parties for harm caused during controlled testing. The lack of clearer protection against liability during sandbox testing is a significant concern.
- Competing Supports: Innovators have other options for compliance assistance, including the planned centralized AI Act Service Desk, private “Sandbox-as-a-Service” providers, and direct engagement with harmonized standards and notified bodies. These alternatives may offer perceived advantages in terms of cost, speed, or reduced regulatory scrutiny.
Member States’ Preparedness
As of June 2025, Member States show varying levels of preparedness for establishing their AI regulatory sandboxes. Spain is notably ahead, with its pilot sandbox already operational and having selected 12 projects for participation across diverse high-risk sectors. Other countries like Lithuania, Latvia, Poland, Croatia, and Finland are actively working on implementation plans. A smaller group, including Hungary, Luxembourg, the Netherlands, and Czechia, have declared tangible intentions. However, the majority—16 Member States, or 59% of the bloc—have not yet publicly announced detailed plans. This disparity highlights the urgent need for coordinated guidance and support from the EU.
Also Read:
- Shaping the Future: A New Curriculum for AI Governance in Higher Education
- Irish Businesses Show Surging Confidence and Practical AI Integration
The Path Forward
The paper concludes that for AI regulatory sandboxes to be truly effective, the EU must provide strong leadership. This includes issuing clear implementing guidelines to ensure consistency, facilitating cooperation and information-sharing among national sandboxes through the AI Board, and clarifying liability issues. Furthermore, innovators need transparent and coherent information about the entire ecosystem of available supports, allowing them to make informed decisions about the most beneficial pathways for their AI Act compliance journey. Without these measures, there’s a risk that the sandboxes could be dismissed as mere “hype” or lead to fragmentation, undermining the EU’s single market objectives for AI.
