What is a regulatory sandbox under the EU AI Act?

A controlled environment where a provider develops, trains, tests and validates an AI system for a limited time before market launch, under a sandbox plan agreed with the authority (Article 57(5)). The authority gives guidance; at exit you get written proof and an exit report that notified bodies take positively into account.

Who qualifies for the EU AI Act SME measures?

SMEs under the EU definition: fewer than 250 staff and turnover up to 50 million euros or balance sheet up to 43 million. That includes medium-sized firms and start-ups. Since the Digital Omnibus, small mid-caps (under 750 staff) also get the simplified documentation form and the lower fine cap for Article 99(4) and (5).

Does sandbox participation mean I can skip conformity assessment?

No, and it does not postpone it either. The conformity assessment still applies before you place a high-risk system on the market. What the sandbox gives you is written proof and an exit report, which you may use in that assessment and which notified bodies must take positively into account (Article 57(7)).

Which EU countries have AI regulatory sandboxes?

Spain ran the first pilot, with 12 high-risk systems selected in April 2025; it has ended. Germany's Bundesnetzagentur is setting one up under the KI-MIG law in force since July 29, 2026. Each Member State must have one operational by August 2, 2027. We could not confirm a running sandbox in France or the Netherlands.

How long does a regulatory sandbox last?

The AI Act sets no fixed term. Participation lasts for a period appropriate to the complexity and scale of the project and the national authority may extend it (Article 58(2)(h)). Authorities must tell applicants their decision within three months of the application (Article 58(2)(a)).

Is a regulatory sandbox worth it for most startups?

Only if you build high-risk AI and your compliance questions are specific and hard. Access is free for SMEs, but you work to an agreed plan under supervision. For general questions, the free AI Act Service Desk and the simplified documentation form give most small teams more for less effort.

EU AI Act SME Support and Sandboxes: What Small Firms Get

Image: Unsplash.

If your company has fewer than 250 staff and builds a high-risk AI system, the EU AI Act gives you five concrete things: free and priority access to a regulatory sandbox, a simplified form for the Annex IV technical documentation, a lighter quality management system if you have no partner or linked enterprises, lower conformity assessment fees, and fines capped at the lower of the percentage or the fixed amount. None of them lowers what the system itself has to do. For most small teams the documentation form and the free Service Desk matter more than a sandbox.

What SMEs actually get

"SME" means the EU definition: fewer than 250 staff and turnover up to 50 million euros or a balance sheet up to 43 million (European Commission). Medium-sized firms and start-ups are included. Article references are to the consolidated AI Act as amended by the Digital Omnibus.

Measure	Who gets it	Article	What it means in practice
Simplified technical documentation	SMEs, including start-ups, and SMCs	11(1)	The Commission sets a simplified Annex IV form. If you opt in, you use that form, and notified bodies must accept it.
Simplified quality management system	SMEs, including start-ups, with no partner or linked enterprises	63(1)	Certain elements of the Article 17 system may be met in a simplified manner, per Commission guidelines.
Lower conformity assessment fees	SME providers, including start-ups	62(2)	Fees are reduced in proportion to size, market size and other indicators.
Fine cap at the lower amount	SMEs: every fine; SMCs: fines under 99(4) and (5)	99(6), 99(6a)	Each fine is capped at the percentage or the amount, whichever is lower.
Priority access to national sandboxes	SMEs, including start-ups, with a registered office or branch in the EU	62(1)(a)	Priority if you meet the eligibility and selection criteria.
Free sandbox access	SMEs, including start-ups	58(2)(d)	No charge, except exceptional costs an authority may recover fairly.
Priority access to a Union-level sandbox	SMEs, start-ups and SMCs	57(3a)	Only if the AI Office sets one up, and only for systems it supervises under Article 75(1).
Training, dedicated channels, standardisation	SMEs, from Member States	62(1)(b)-(d)	Awareness and training activities, channels for questions, help to take part in standards work.
Templates, information platform, campaigns	Everyone, from the AI Office	62(3)	Standardised templates, a single information platform and awareness campaigns.

The limit is written into the Act. Article 63(2) says the simplified quality management system does not exempt anyone "from fulfilling any other requirements or obligations laid down in this Regulation, including those established in Articles 9, 10, 11, 12, 13, 14, 15, 72 and 73". Risk management, data governance, logging, transparency, human oversight, accuracy, post-market monitoring and incident reporting stay in full. A small company building a hiring tool still has to show it does not discriminate; it gets a shorter form to show it with.

Small mid-caps (SMCs). Regulation (EU) 2026/1744, the Digital Omnibus on AI, in force since July 27, 2026, extends some of these measures to "small mid-cap" enterprises as defined in Commission Recommendation (EU) 2025/1099: fewer than 750 employees and annual turnover not exceeding 150 million euros (or balance sheet not exceeding 129 million). SMCs may use the simplified Annex IV form, quality management obligations are proportionate to their size, and fines under Article 99(4) and (5) are capped at the lower amount. Priority access to national sandboxes under Article 62 stays with SMEs, including start-ups; SMCs get priority only in a Union-level sandbox, if the AI Office creates one.

Regulatory sandboxes: how they work

An AI regulatory sandbox (Article 57(5)) is a controlled environment for developing, training, testing and validating an AI system "for a limited time" before it reaches the market, under a sandbox plan you agree with the authority. It can include supervised testing in real-world conditions. The authority gives guidance on risks and on how to meet the Act's requirements.

The rules an applicant needs:

Who can apply. Sandboxes are open to "any applying provider or prospective provider of an AI system" that meets transparent, fair criteria (Article 58(2)(a)). The AI Act Service Desk says the same: any provider with an AI system in scope of the Act. You do not need to be high-risk or an SME; SMEs get priority and free access.
Decision time. The authority must tell you its decision within three months of your application (Article 58(2)(a)).
Duration. No fixed term. Participation lasts for a period appropriate to the complexity and scale of the project and can be extended by the authority (Article 58(2)(h)).
When national sandboxes must exist. Each Member State must have at least one sandbox operational by August 2, 2027, alone or jointly with other Member States (Article 57(1), as amended by the Omnibus). The Service Desk FAQ still says August 2, 2026, the date before the amendment.

A row of European Union flags in front of a modern glass-and-steel building

Image: Unsplash.

What sandbox participation does and does not do

What it does. At the end, the authority gives you written proof of the activities successfully carried out and an exit report with the results (Article 57(7)). You may use both in the conformity assessment or in market surveillance, and market surveillance authorities and notified bodies must take them "positively into account". If you follow the sandbox plan, the terms of participation and the authority's guidance in good faith, no administrative fines are imposed for infringements of the AI Act during the sandbox (Article 57(12)).

What it does not do. It does not replace or postpone the conformity assessment: a high-risk system still needs one before it goes on the market. It does not shield you from liability: participants "remain liable under applicable Union and national liability law for any damage inflicted on third parties" during the experiment (Article 57(12)). If a hiring tool discriminates against real candidates during a sandbox test, those candidates keep their rights.

Which countries have sandboxes (checked October 19, 2026)

Spain. The first pilot ran under Royal Decree 817/2023 of November 8, 2023, run by the State Secretariat for Digitalisation and AI (SEDIA). The call opened by resolution of December 20, 2024, drew 44 applications by January 30, 2025, and 12 high-risk systems were selected (announced April 3, 2025). The pilot has ended and a results report is published; the technical guides it produced are on the AESIA site and are not binding.
Germany. The KI-MIG law entered into force on July 29, 2026. The Bundesnetzagentur became market surveillance authority and single point of contact, and is establishing an AI regulatory sandbox meant in particular for SMEs. Before that, a trilateral pilot simulating a sandbox concluded on March 17, 2026.
Netherlands. The RDI and the Dutch data protection authority (AP) published a proposal for a Dutch sandbox on March 26, 2025, aiming to launch a final sandbox by August 2026 or earlier. We could not confirm that it has launched.
Other Member States, including France: we could not confirm an operating sandbox. Check with your national market surveillance authority; our guide to what applies since August 2026 explains which authority enforces what.
EU level. The AI Office may set up a Union-level sandbox for AI systems it supervises under Article 75(1), with priority access for SMEs, start-ups and SMCs (Article 57(3a)). The Act allows it; we found no announcement that it exists.

A semicircular legislative chamber seen from above, with rows of desks facing a central table

Image: Unsplash.

How to apply

National programmes set their own forms, under the eligibility, selection and application rules the Commission lays down in implementing acts (Article 58(1)). Expect to describe the system and its intended purpose, why you think it is or may be high-risk, and a sandbox plan: what you will test, with whom, with which data and for how long. If the system processes personal data, the data protection authority is involved in supervising those aspects (Article 57(10)).

Is a regulatory sandbox worth it?

For most early-stage startups, not as a first step. The sandbox is for "more specific and complex regulatory questions", in the Service Desk's words, while the Service Desk itself answers general ones.

A sandbox makes sense when:

You build high-risk AI in a regulated area such as health, recruitment or credit
Your Annex III classification is genuinely unclear and you want the authority's view before committing to a design
You have real users available for supervised testing
Your launch can wait for an application decision (up to three months) plus the sandbox period

For AI productivity tools, coding assistants or customer service bots, the limited-risk and minimal-risk paths are more direct. Start with the Service Desk and the AI compliance cost guide. If you also use third-party high-risk systems, the deployer evidence gaps guide covers the records a deployer keeps.

What simplified documentation means in practice

The full Annex IV technical documentation covers the system description and architecture, training data and data governance, development and testing methods with metrics, the risk management system, post-market monitoring, instructions for use, the EU declaration of conformity and conformity assessment records.

The simplification under Article 11(1) is a form, not a free hand. The Commission sets one simplified technical documentation form for SMEs, start-ups and SMCs; if you opt for the simplified route you must use it, and notified bodies must accept it. Check the Service Desk for the current version before you start.

"Simplified" does not mean "absent". An authority reading simplified documentation still expects to see what data trained the model, how it was tested before deployment, which risks the risk management process found and how they are monitored. Risk management under Article 9 is a substantive duty; the paperwork can be shorter, the process cannot be skipped.

The glass facade of the European Parliament building in Brussels with an EU flag on it

Image: Pexels.

Getting help: the AI Act Service Desk

The free help channel is the AI Act Service Desk, the Commission's single information platform. It has the AI Act Explorer (the text, browsable by chapter and annex), a Compliance Checker for a first view of whether your system or model is covered, an FAQ, and a contact form: you can ask questions "including in your own language" and get answers from "a team of experts working in close cooperation with the EU AI Office".

Use it for classification questions (is my system high-risk under Annex III?), for what the simplified documentation means for your system, and for which national authority to contact. Its answers are guidance, not a binding ruling: if a large investment rides on your classification, get a written opinion from counsel as well. National authorities also run their own channels for SMEs under Article 62(1)(c); Germany's Bundesnetzagentur, for example, runs an AI Service Desk.

For a full picture of what compliance costs a small company, see the AI compliance cost for small teams in 2026 guide.

What we could not confirm

Whether the Commission has published the simplified Annex IV form and the Article 63 quality management guidelines; whether the Dutch sandbox, a French sandbox or a Union-level sandbox is operating; and how many sandboxes are open across the EU today. We will update this page when the Commission or a national authority announces them.

Correction (October 19, 2026, second update): We rechecked every legal claim in this guide against the consolidated AI Act and official pages and fixed these errors. The simplified technical documentation is in Article 11(1), not Article 53(4), which is about general-purpose AI codes of practice, and it covers all SMEs including medium-sized ones, plus SMCs. "Article 13(4)" reduced information obligations does not exist; we removed it. Sandboxes do not postpone the conformity assessment; they produce an exit report that counts in it (Article 57(7)). There is no default 12 plus 12 month term (Article 58(2)(h)). Sandboxes are open to any provider in scope, not only high-risk SMEs. National sandboxes are due by August 2, 2027, not 2026. The AI Office may set up a Union-level sandbox (Article 57(3a)); it does not run a "virtual sandbox", and the "SME helpdesk" is the AI Act Service Desk. Spain's pilot was run by SEDIA under a 2023 decree, selected participants in 2025 and has ended; it was not launched by AESIA in 2023. We removed unsourced claims about application screening times, French and Dutch sandbox status, AI Office sector guidance and priority sectors. Standardisation support for SMEs is a Member State duty (Article 62(1)(d)). Correction (October 19, 2026): The small mid-cap note credited the change to the May 7, 2026 provisional agreement, said it would apply once adopted, and said SMCs get priority sandbox access. The change is in Regulation (EU) 2026/1744, in force since July 27, 2026, and Article 62 priority access stays with SMEs, including start-ups.