EU sets common rules for AI regulatory sandboxes

The European Commission adopted Implementing Regulation (EU) 2026/2487 on 10.11.2026, published in the Official Journal on 11.11.2026, setting common rules for AI regulatory sandboxes in which firms can develop and test systems under supervision before they enter the market.

What does Implementing Regulation 2026/2487 change?

The act sets out the detailed arrangements that Article 58 of the AI Act, Regulation (EU) 2024/1689, requires the Commission to adopt, so that sandboxes do not fragment across the Union. It applies to all AI regulatory sandboxes established under Article 57 and enters into force on 01.12.2026, the twentieth day after publication in the Official Journal.

Article 57 of the AI Act, in the consolidated version of 27.07.2026 published by the Commission's AI Act Service Desk, requires Member States to ensure that their competent authorities "establish at least one AI regulatory sandbox at national level, which shall be operational by 2 August 2027." The sandbox may be set up jointly with other Member States, or a Member State may take part in an existing sandbox if this gives equivalent national coverage. The AI Office may also establish a Union-level sandbox for certain systems, with priority access for SMEs, including start-ups, and small mid-cap companies.

These sandboxes are a controlled framework for the development, training, validation and testing of innovative AI systems, including in real-world conditions where appropriate, under a sandbox plan and for a limited time before they are placed on the market.

Who can use an AI regulatory sandbox for free?

Access is not automatically free for every participant. For SMEs, including start-ups, access and participation "shall be prioritised and free of charge" for regulatory guidance, advice and supervision concerning the AI Act and other law supervised in the sandbox, including supervision of testing in real-world conditions. Authorities may still recover exceptional costs for other services agreed in the sandbox plan, in a fair, transparent and proportionate way. Prospective participants must be told about that possibility at least before participation starts, and any invoice must be sufficiently detailed.

Public authorities, bodies and agencies benefit from the same pricing regime. For undertakings that are not SMEs (start-ups fall within the SME category here), authorities may charge a fee equal to the full costs incurred and must publish the fee list when they open the application phase. The authority must inform the applicant of the selection outcome no later than three months after a complete application or after the deadline of a call. If selected, the parties agree a sandbox plan without undue delay, covering the timeline, objectives, legal requirements supervised, and any testing in real-world conditions.