AI regulatory sandboxes – rules for their set-up and operation

European Commission · Have your Say · Initiative 15952

Update after the Digital Omnibus on AI (Regulation (EU) 2026/1744) · Statement of October 28, 2026 (updated version, replaces the first version)

Core statement: Whoever postpones the testing environment postpones protection. The Digital Omnibus on AI extends the deadline for national AI regulatory sandboxes to 2 August 2027 – one year after the AI Act’s general date of application. The testing infrastructure thus arrives only after the systems it is meant to test are already in operation. And with the Union-level sandbox of the AI Office, a single body emerges that operates, supervises and enforces – three roles in one hand. GISAD maintains its position: a sandbox is not an escape safeguard. The amendments raise the structural questions instead of resolving them.

What has changed

Regulation (EU) 2026/1744 (Digital Omnibus on AI, in force since 27 July 2026) changes the AI Act’s sandbox regime: the obligation for Member States to ensure at least one operational national sandbox moves from 2 August 2026 to 2 August 2027. A new Article 57(3a) allows the AI Office to establish a Union-level sandbox, with priority access for SMEs, start-ups and small mid-cap enterprises (as defined by Commission Recommendation (EU) 2025/1099). Article 58 extends the catalogue for the implementing act to governance – explicitly including the involvement and supervision of data protection authorities and coordination at national and Union level. At the same time, the new Articles 75a–75d introduce direct enforcement at Union level. The implementing act itself (draft of 3 December 2025, consultation until 13 January 2026) has not been adopted; the general date of application of the AI Act, 2 August 2026, remains unaffected – there is no moratorium.

Recognition: more independent supervision in the rulebook

GISAD acknowledges that Article 58 now expressly provides for the involvement and supervision of the data protection authorities and for coordination at national and Union level. This is a step towards what the EU-D-S demands: review by bodies that do not operate what they review. The time-limiting logic also remains correct: the sandbox plan and the exit report are single-step instruments with a defined end – no release without an enforced next step.

Criticism 1: the extension reverses the order

Structure protects only if it exists before operation begins. The general obligations of the AI Act apply from 2 August 2026 – but comprehensive sandbox coverage in the Member States only from 2 August 2027. The result is a year of operation without testing infrastructure: systems enter the market before the space exists in which they could have been tested. Deadlines do not protect – structure protects. Whoever postpones protection should not call it relief.

Criticism 2: three roles in one hand

With the Union-level sandbox and Articles 75a–75d, the AI Office gathers operating, supervising and enforcing into a single institution. Whoever operates the sandbox reviews their own testing conditions; whoever enforces measures their own practice. This is precisely the constellation the EU-D-S resolves through the concept-fidelity audit: the review layer lies outside the manipulable area, read-only and independent – not in the hands of what is being reviewed. Access control adds to this: priority access for SMEs and small mid-caps requires transparent, fair criteria – otherwise the Union sandbox becomes an allowlist of the AI Office, a gatekeeper for testing rights.

What remains valid from the first version

No reduction of protection standards inside the sandbox – the Hugging Face attack of July 2026 happened with reduced guardrails precisely in a testing environment. An escape safeguard is not a sandbox feature but a product feature: single-step release, signed instance numbers from the Truststation, measurement outside the manipulable area, zero-tolerance rule. And sandboxes need sovereign operating environments – US hyperscalers as the test infrastructure of the European AI regulatory framework are a contradiction in themselves.

GISAD’s recommendations

1. Reverse the order: at least one pilot operation of national sandboxes before 2 August 2027 – testing infrastructure before full application of obligations, not after.
2. Separation of roles for the Union sandbox: operating (AI Office), reviewing (an independent, read-only review layer – standard: concept-fidelity audit), enforcing (a separate body under Articles 75a–75d) must not fall into one hand.
3. Access criteria transparent, fair and documented; no de facto allowlist; every rejection reasoned and reviewable – measurement outside the manipulable area.
4. Escape safeguard as a condition of admission to every sandbox: single-step release and signed instance numbers for every participating AI system; zero-tolerance rule for instance-identifying markers outside the system.
5. Sovereign test infrastructure: European operating environments for the sandbox – no US hyperscalers, no CLOUD Act risk inside the testing framework of European AI regulation.