On 10 November 2026, the European Commission adopted the implementing regulation that sets out how the AI Act’s “regulatory sandboxes” work: spaces where a company can test an AI system under the supervision of an authority before placing it on the market. Published in the Official Journal on 11 November, it enters into force on 1 December. SMEs and start-ups benefit from priority access and free support.
What a regulatory sandbox is for
The AI Act imposes heavy obligations on systems deemed high-risk: documentation, risk management, human oversight, conformity assessment. For a young company, knowing how these requirements apply to a product still under development is often guesswork. The sandbox addresses this problem: the company develops and tests its system, possibly in real-world conditions, under the supervision of a competent authority that helps it interpret the text.
Implementing Regulation No 2026/2487, available on EUR-Lex, harmonises these schemes to prevent each country from inventing its own rules. As MLex sums it up, the aim is to avoid fragmentation of the European market and to give developers legal certainty. According to the preamble, Member States must have set up their sandboxes by 2 August 2027.
Who can apply, and how
Applications may be submitted by providers and prospective providers of an AI system that is not yet on the market, that is undergoing a substantial modification, or that moves into the high-risk category. An important point for start-ups: a company can apply to the sandbox of any Member State, not just that of its own country. A provider established outside the EU must apply with a European authorised representative, who is answerable for its activities.
Authorities select projects according to several criteria:
- a genuine need for regulatory support;
- what the project can teach the regulator;
- the public interest or benefit to society;
- the maturity of the proposal and its innovative nature.
Applicants must be informed of the decision within three months of submitting a complete application, and they have a right of appeal. Once selected, they sign a plan with the authority specifying the objectives, roles, safeguards against risks, incident reporting, the involvement of the data protection authority and, where applicable, real-world testing.
Free for SMEs, paid for others
The text draws a clear distinction based on size. SMEs, including start-ups, get priority access and pay neither for regulatory advice, nor for support, nor for supervision. The authority may only charge them “exceptional costs” for additional agreed services, with prior notice and a detailed invoice. Other organisations may be asked to pay fees covering the full costs, and non-European providers pay participation fees.
The sandbox does not protect against everything: participants remain responsible for complying with EU law, and the length of support depends on the scheme’s capacity and the complexity of the project. An extension requires the agreement of both parties and a justification; it must be decided no later than 30 calendar days before the planned end date.
An exit that counts towards compliance
At the end of the process, the authority issues written proof of the activities carried out and an exit report, the latter no later than 45 working days after participation ends. These documents are not a declaration of conformity, but market surveillance authorities and notified bodies throughout the Union must take them into account. For a company, this is a concrete argument: the work done in the sandbox can speed up the conformity assessment that follows.
Publication of the report requires the participant’s consent; failing that, the authority may disseminate the main non-confidential lessons learned. National authorities will have to report annually on their activity to the AI Office and the European AI Board.
The limits to be aware of
The regulation sets a framework; it does not create a front desk. In France as elsewhere, companies will have to wait for the competent authority to open its scheme, by summer 2027 at the latest. For those leading high-risk projects, it is an opportunity to prepare for compliance with a public interlocutor rather than alone, provided that authorities build the teams needed to process applications within the three-month deadline, which the text does not guarantee.
Frequently asked questions
When will the AI Act sandboxes open?
The implementing regulation enters into force on 1 December 2026. Member States have until 2 August 2027 to set up their schemes; the actual opening date will depend on each national authority.
Can a French start-up join a German sandbox?
Yes. The text allows an applicant to apply to any sandbox in the Union, not just in its country of establishment. Joint schemes between several States are also encouraged.
Does going through a sandbox amount to a certificate of conformity?
No. The written proof and the exit report do not constitute a declaration of conformity. They must, however, be taken into account by surveillance authorities and notified bodies during subsequent checks.
Sources
- Implementing Regulation (EU) 2026/2487 on AI regulatory sandboxes — EUR-Lex (Official Journal of the EU), 2026-11-11
- EU rules for AI regulatory sandboxes to allow supervised development, testing — MLex, 2026-11-12