Regulation and innovation are in tension, especially with a technology whose risks often only show in use. The regulatory sandbox is the AI Act’s instrument to ease that tension: companies test under supervision, authorities learn alongside.
What a sandbox is
A sandbox is a framework set up by a competent authority in which an AI system is developed, trained, validated and, where appropriate, tested in real-world conditions for a limited time according to an agreed plan. The authority accompanies the work, gives guidance on meeting requirements and documents the results. Under Article 57 of the AI Act, each member state must ensure that at least one sandbox is established at national level; several states can run joint sandboxes.
What it provides
Participants get early clarity on how the authority interprets requirements, for example on data quality, documentation or human oversight. Documentation from the sandbox, in particular an exit report, can be taken into account in the later conformity assessment. Those who follow the plan in good faith are protected from AI Act fines; liability towards third parties remains.
What it does not provide
A sandbox is no exemption from the law. Data protection law continues to apply, and data protection authorities are involved where personal data is processed. A sandbox does not replace market access either; it prepares it. And it is not a funding programme: the benefit is regulatory clarity, not money.
Benefits for SMEs and start-ups
The AI Act provides that SMEs and start-ups with a registered office or branch in the EU get priority access to sandboxes and that participation is in principle free of charge for them. For young companies developing a system that may be classified as high-risk, this can be the most efficient way to avoid wrong turns early.
And Switzerland?
Switzerland does not adopt the AI Act. The Federal Council chose to implement the Council of Europe’s AI Convention and adapt existing law sector by sector. Swiss providers wanting to offer in the EU can look into sandboxes via an EU establishment or partners. To start with whether a product is high-risk at all, a structured classification comes first, for example with our high-risk classification checklist.