In short
- Article 57(1) requires every Member State to have at least 1 national AI regulatory sandbox operational, a date Regulation (EU) 2026/1744 moved from 2 August 2026 to 2 August 2027.
- Article 57(12) is the concrete benefit: no administrative fines under the Regulation for a participant that follows the sandbox plan and the authority's guidance in good faith.
- That shield does not cover damage to third parties. Liability under Union and national liability law survives participation in full.
- The exit report under Article 57(7) has to be taken into account by market surveillance authorities and notified bodies, which turns supervised testing into reusable evidence.
- Regulation (EU) 2026/1744 added a Union level sandbox run by the AI Office, with priority access for SMEs, start-ups and small mid-caps.
A regulatory sandbox sounds like permission to skip the rules. It is closer to the opposite: supervised compliance work, with two specific benefits written into the text.
Articles 57 to 62 of Regulation (EU) 2024/1689 set the regime up, and Regulation (EU) 2026/1744 changed both its timing and its shape. What a sandbox gives you is a fine shield and a document, and both are narrower than the word suggests.
01What does a sandbox actually protect against?
Administrative fines under the AI Act, and nothing else.
Article 57(12) provides that no administrative fines shall be imposed for infringements of the Regulation where the participant observes the sandbox plan and the terms and conditions of participation, and follows in good faith the guidance given by the national competent authority. Where other authorities were actively involved in supervising the system, the same protection extends to the law they supervise.
The two conditions are cumulative and both are behavioural. A participant that departs from the plan, or ignores guidance, is outside the shield, and the evidence of which happened is the sandbox record itself.
| Exposure | Covered by Article 57(12) | Condition |
|---|---|---|
| Administrative fines under the AI Act | Yes | Plan followed, guidance followed in good faith |
| Fines under other supervised law | Yes | That authority actively involved |
| Damage to third parties | No | Liability law applies in full |
| Supervisory and corrective powers | No | Authorities keep them throughout |
Read the third row as the design point. The sandbox lowers regulatory risk and leaves civil risk untouched, which is the correct allocation for testing that touches real people but a poor fit for any team that expected indemnity.
02What is the exit report worth?
More than the testing, because it travels.
Under Article 57(7) the competent authority provides, on request, written proof of the activities successfully carried out and an exit report detailing the activities, results and learning outcomes. Market surveillance authorities and notified bodies are to take those documents into account when assessing conformity.
That is a rare thing in this Regulation: a document produced by a supervisor that the next supervisor has to consider. For a provider heading toward an internal control assessment with no third party involved, it is the closest available substitute for the external confirmation an audit normally supplies.
03What changed in 2026?
The date, the venue and the relationship with real-world testing.
| Element | Original text | After Regulation (EU) 2026/1744 |
|---|---|---|
| National sandbox operational | 2 Aug 2026 | 2 Aug 2027 |
| Union level sandbox | None | AI Office, Article 75(1) systems |
| Real-world testing plan | Separate track | Integrated into the sandbox plan |
| Priority access | SMEs and start-ups | SMEs, start-ups, small mid-caps |
The Union level sandbox is the change with the widest reach. It points at systems falling under Article 75(1), the general purpose model territory, which means the venue now exists for questions that no single national authority was well placed to answer about models bought rather than built.
The deadline move is the change most likely to be misread. A sandbox that a Member State does not have to run until 2 August 2027 is not a resource you can plan a 2026 launch around, and the deferral of the high-risk dates does not change the order: the sandbox arrives late relative to the work.
04Who should actually apply?
Teams with a classification problem, not teams with a schedule problem.
The sandbox is worth the administrative cost where the legal question is genuinely open: an Annex III use whose classification is contested, a data protection question under Article 59 about reusing data lawfully collected for another purpose, or a system whose human oversight design has no settled precedent.
It is poor value where the answer is already known and the work is simply unfinished. Supervision does not accelerate documentation, and a sandbox plan adds a reporting obligation to a team that was already behind. The honest test is whether you would pay for the exit report if the fine shield did not exist.
05Frequently asked questions
When must EU Member States have an AI regulatory sandbox running?
By 2 August 2027. Article 57(1) requires at least one national sandbox to be operational, and Regulation (EU) 2026/1744 moved that date back by one year from the original 2 August 2026.
Does joining a sandbox protect you from fines?
Partly. Article 57(12) provides that no administrative fines shall be imposed for infringements of the Regulation where the participant observes the sandbox plan and the terms of participation and follows the national authority's guidance in good faith.
Does a sandbox limit liability for harm caused during testing?
No. Participants remain liable under applicable Union and national liability law for damage inflicted on third parties as a result of the experimentation, which is stated expressly in Article 57.
What is the exit report worth?
It is evidence a regulator has to consider. On request, the authority provides written proof of the activities carried out and an exit report, and market surveillance authorities and notified bodies are to take those documents into account when assessing conformity.
06References and method
- Regulation (EU) 2024/1689, Articles 57 to 62, for the sandbox regime, the exit report, the limitation on administrative fines and the measures for SMEs and start-ups.
- Article 57 of Regulation (EU) 2024/1689 in the consolidated presentation, checked on 25 September 2026 for the amended establishment date and the Union level sandbox added by Regulation (EU) 2026/1744.
- Regulation (EU) 2026/1744, for the move of the national sandbox deadline to 2 August 2027, the Union level sandbox operated by the AI Office and the integration of real-world testing plans into the sandbox plan.
- Regulation (EU) 2024/1689, Article 59, for the conditions under which personal data collected for other purposes may be processed in a sandbox, and Article 75(1), for the systems the Union level sandbox is aimed at.