EU adopts common AI sandbox rules without granting compliance clearance

The European Commission has adopted common rules for supervised AI testing that take effect December 1, 2026. Companies completing these regulatory sandboxes will receive records recognized across the EU—but not legal clearance to sell their systems. They will also remain liable for damage to third parties, despite conditional protection from administrative fines.

Adopted November 10 and published in the Official Journal the next day, Implementing Regulation (EU) 2026/2487 establishes common rules for national sandboxes under the AI Act. December marks the rulebook’s start, not a simultaneous opening of testing programs: each member state has until August 2, 2027, to have at least one national sandbox operational.

A testing plan, then a portable record

A sandbox is a controlled, time-limited environment for developing, training, validating and testing AI before market entry. The company and supervising authority agree on a plan covering objectives, activities, responsibilities, timing and costs. It identifies the legal obligations to examine and sets safeguards for managing risks and reporting serious incidents.

At completion, the authority supplies written proof of the activities and an exit report, due within 45 working days. The report documents regulatory questions, their resolution, recommended practices, tools, benchmarks and serious incidents. EU market oversight authorities and designated conformity assessors must recognize these records.

Those bodies are supposed to take the documents positively into account to help speed conformity assessment—the process for demonstrating that a system meets applicable requirements. Neither document replaces that process or has the legal effect of an EU declaration of conformity.

Fine protection follows the agreed plan

The AI Act protects participants from administrative fines for AI Act infringements when they observe the sandbox plan and follow the authority’s guidance in good faith. Protection extends to other laws only when the relevant authorities actively supervised the system and provided compliance guidance. Changes to the plan require both sides’ agreement.

Who gets access—and who pays

Providers and prospective providers can apply outside their home member state. Eligible projects cover three situations:

• An AI system not yet placed on the market or put into service.
• An existing system due to undergo substantial modification.
• A system not originally intended as high-risk, but already used in a way that makes it high-risk.

Small and medium-sized businesses and startups with an EU registered office or branch receive priority access and free core guidance and supervision. Extraordinary costs for other agreed services can still be charged. Other companies can face full service costs, with fees published when applications open.