EU AI Sandboxes Start 1 December: What They Offer
The EU has set common rules for AI regulatory sandboxes from 1 December 2026. What companies gain, the limits and how to apply.
If you are building an AI product for the European market, you can soon test it with a regulator watching instead of guessing how the rules apply. The European Commission adopted common rules for AI regulatory sandboxes on 10 November 2026; they were published the next day and take effect on 1 December 2026. TechTimes reported the detail. This is a summary, not legal advice.
What a sandbox is
A regulatory sandbox is a supervised, time-limited setting in which a company develops and tests an AI system before placing it on the market. The company agrees a plan with the national authority, works through the regulatory questions with it, and leaves with a record of what was examined.
The AI Act requires every EU member state to run one. The new implementing regulation, (EU) 2026/2487, sets the rules they share. Each country now has until 2 August 2027 to have at least one national sandbox operating — a deadline moved back a year by the 2026 Digital Omnibus on AI.
What you get
- Supervised testing and dialogue with the regulator on the questions your system raises.
- Written proof of the activities completed, and an exit report within 45 working days of finishing. The report covers the issues examined, how they were resolved, recommended practices and any serious incidents.
- Recognition across the EU. Every market surveillance authority and notified body must accept those documents as a record of the work.
- Protection from AI Act fines, provided you followed the agreed plan and the authority's guidance in good faith.
- Access to an EU-level sandbox run by the AI Office, with priority for small and medium-sized firms, start-ups and small mid-cap companies.
What you do not get
The headline of the TechTimes report makes the point: tests earn no compliance clearance, and liability stays.
- No certificate. Neither the proof nor the exit report counts as a declaration of conformity. A high-risk system must still go through the normal conformity procedure, though authorities are asked to view sandbox documents favourably.
- No shield against harm to others. You remain liable for damage to third parties and must still follow other applicable law.
- Limited use of personal data. Reusing personal data is allowed only for certain public-interest systems, such as public health, environmental protection, transport safety and critical infrastructure. You must show that anonymised or synthetic data would not do, keep the data isolated and delete it afterwards.
- A plan you cannot change alone. Changes need the authority's agreement, and it can suspend or end participation if significant risks are not dealt with.
Who can apply
Providers and prospective providers of AI systems, alone or with deployers and other partners. Eligible systems are:
- systems not yet on the market;
- systems on the market that are about to be substantially modified;
- systems that are not high-risk by design but are used in a way that makes them so.
You may apply in a member state other than your own.
How applications are judged
Authorities look at five things:
- whether the system raises specific regulatory questions that need a sandbox;
- how much regulators can learn from it;
- its contribution to the public interest;
- how mature the proposal is;
- how innovative it is.
You should receive a decision within three months, and you can appeal.
Costs
| Applicant | Cost |
|---|---|
| EU-based small firms and start-ups | Priority access; core regulatory services free. Extra services may be charged, with fees disclosed in advance |
| Other companies | May be charged full costs; fees published when applications open |
| Non-EU providers | Must pay the fee and appoint an authorised EU representative |
How to prepare an application
- Describe the system and its intended use precisely. Vague scope is the commonest weakness.
- Identify the regulatory questions. Which requirements are unclear for your case?
- Draft a testing plan with a timetable, data sources and risk controls.
- Explain the public benefit and what regulators would learn.
- Check your data. If you need personal data, be ready to justify it.
- Watch your national authority's website for the opening of applications.
Is it worth it?
For a start-up building something that may be classed as high-risk, the answer is often yes: you get early, free feedback from the body that will later supervise you, and a document other EU authorities must recognise. For a company with a low-risk product, the time involved may outweigh the benefit.
Publication of exit reports is optional and needs both sides to agree, though authorities may publish non-confidential findings. If confidentiality matters to you, mark sensitive material clearly.
The sandbox rules sit alongside the obligations that begin a day later; see what changes under the EU AI Act on 2 December.
Sources
Frequently asked questions
What is an AI regulatory sandbox?
A supervised, time-limited environment in which a company can develop and test an AI system with a regulator before putting it on the market.
When do the EU AI sandbox rules start?
The common rules take effect on 1 December 2026. Member states have until 2 August 2027 to run at least one national sandbox.
Does completing a sandbox mean my AI system is compliant?
No. The exit report is a recognised record of the work, not a declaration of conformity.
Is the EU AI sandbox free?
Core services are free for EU-based small firms and start-ups. Other companies may be charged.
This article was checked against the sources listed above on 12 November 2026. AI products change quickly: features, prices and availability can differ by plan and country, so confirm details with the company before relying on them. GetAIHow is independent and not affiliated with the companies it covers. Read our editorial policy and disclaimer.
