Article 57: AI Regulatory Sandboxes

Article 57 creates the mandatory sandbox infrastructure across the Union. Each Member State must have at least one operational sandbox by 2 August 2026. Sandboxes serve three functions:

1. Innovation support — providers (and prospective providers) can develop, train, and test AI systems in a controlled environment with direct access to supervisory authorities. 2. Regulatory learning — competent authorities gain hands-on insight into how innovative AI systems work, improving their supervisory capacity. 3. Compliance preparation — sandbox participants receive guidance on regulatory expectations, which helps them prepare conformity documentation and risk management before formal market placement.

Critically, sandbox participation does not exempt anyone from compliance with the AI Act or other Union or Member State law. Authorities retain full supervisory and corrective powers over sandbox participants. The sandbox is a guidance channel, not a regulatory holiday.

Sandboxes may be established by:

• National competent authorities designated under Article 70
• The AI Office (for Union-level or cross-border sandboxes)
• Data protection authorities where the sandbox involves processing of personal data

Participation is open to providers and prospective providers of AI systems. "Prospective providers" captures entities still in the development or pre-market phase—meaning you do not need to be an established company with a finished product to apply. The sandbox may also involve deployers where testing requires real deployment conditions.

Member States are encouraged to involve SMEs and start-ups (see Article 62) and to coordinate cross-border sandboxes where AI systems affect multiple jurisdictions.

• Article 58 — operational rules for how sandboxes function day-to-day (plans, exit criteria, confidentiality, safeguards).
• Article 59 — special rules for further processing of personal data inside sandboxes for public-interest AI.
• Article 60 — testing of high-risk AI in real-world conditions outside sandboxes (complementary pathway).
• Article 76 — confidentiality obligations of authorities, including sandbox supervisors.
• Article 113 — application timeline (sandbox obligation from 2 August 2026).

If you plan to apply for a sandbox:

1. Identify the competent authority in your Member State responsible for operating the sandbox (this may differ from the market surveillance authority). 2. Prepare a sandbox plan describing your AI system, its intended purpose, the tests you want to run, the data you will use, and the compliance questions you need guidance on. 3. Map applicable rules — the sandbox does not waive any obligations. Come prepared with a draft conformity plan, including risk management (Article 9) and technical documentation (Article 11). 4. Engage data protection counsel if personal data is involved, especially if you plan to invoke Article 59 for further processing. 5. Document everything — sandbox outcomes (including authority feedback and test results) become valuable evidence for your conformity file.