AI Sandboxes in the EU: How to Access and What It Means for Your Business in 2026

Key data

If your company develops artificial intelligence systems and needs to test them in real conditions before launching them to market, the Commission Implementing Regulation (EU) 2026/2487 opens a concrete door for you: controlled AI testing spaces, also called regulatory sandboxes. This regulation, published on 11 November 2026 and in force from the previous day, develops Article 57 of the AI Act (Regulation EU 2024/1689) and establishes the operational rules that both participating companies and national authorities managing these environments must follow.

The impact is direct: for the first time, there is a harmonized European framework that allows innovation in high-risk AI with legal certainty, without having to immediately comply with all AI Act regulatory requirements, always under official supervision.

What does this regulation establish?

Regulation 2026/2487 specifies how AI sandboxes work in practice. These are the operational elements it regulates:

In essence, an AI sandbox is a real but supervised environment where a company can operate its AI system without being subject to all the obligations of the AI Act, during a limited period and under the control of the competent national authority. It is not a permanent exemption: it is a testing phase with legal coverage.

Economic and operational impact

For technology companies and startups, this regulation represents a real reduction in costs and market entry risks. Developing and certifying a high-risk AI system in compliance with the AI Act involves significant investments in technical documentation, conformity assessments and risk management. The sandbox allows progress in product development under real conditions before assuming that full regulatory burden.

The most relevant operational implications are:

• Legal certainty during development: the company operates under official supervision, which reduces the risk of sanctions for AI Act non-compliance while the product is not mature.
• Access to real data and environments: the sandbox allows testing under real market conditions, something impossible in a laboratory.
• Priority access for SMEs and startups: the AI Act explicitly recognizes that these companies have fewer resources to comply with regulation, so they are given preference in admission.
• Obligations of national authorities: each Member State must create and manage these spaces in accordance with the harmonized criteria of Regulation 2026/2487, which ensures consistency across the EU.

For companies already developing high-risk AI without this framework, the risk is operating in a regulatory gray area. The sandbox eliminates that uncertainty during the testing phase.

Who does it affect?

• Artificial intelligence startups that develop systems classified as high-risk under the AI Act (e.g., AI in healthcare, education, employment, critical infrastructure).
• Technology SMEs that want to test AI solutions in real environments before commercialization, with guaranteed priority access under the regulation.
• Larger technology companies that meet the selection criteria established by national authorities.
• National AI supervisory authorities in all EU Member States, which must create, manage and supervise these spaces in accordance with the harmonized criteria of the Regulation.
• CFOs and innovation directors of companies evaluating investments in high-risk AI: the sandbox can change the timeline and cost of regulatory compliance.

Practical example

Imagine a Spanish startup with 15 employees that has developed an AI system for automated evaluation of candidates in employment selection processes. This type of system is classified as high-risk under the AI Act, which would normally require completing all technical documentation, conformity assessments and registration in the EU database before being able to operate.

With Regulation 2026/2487, this startup can:

1. Submit an application to the competent Spanish national authority (following the procedure set out in the Regulation) to participate in the AI sandbox.
2. Being an SME, it has priority access over larger companies.
3. If admitted, it can test its system under real conditions with real customers during the program duration period, with temporary regulatory flexibility and under official supervision.
4. When the sandbox ends, it exits the controlled environment with a validated product and the documentation needed to fully comply with the AI Act, having reduced the regulatory and financial risk of development.

Without the sandbox, this same startup would have to assume all AI Act compliance costs from day one, which could make the project unfeasible.

What should companies do now?

1. Identify whether your AI system is high-risk under the AI Act (Regulation EU 2024/1689). If it is, the sandbox is the most efficient pathway to develop it with legal certainty.
2. Contact the competent national AI supervisory authority in your country to learn about the status of national sandbox implementation and call timelines.
3. Prepare the application documentation in accordance with the procedure established by Regulation 2026/2487: system description, testing program objectives, technical resources and compliance capacity.
4. If you are an SME or startup, claim your priority access expressly in the application: the AI Act and this Regulation explicitly recognize it.
5. Plan your sandbox exit strategy from the start: the goal is that when the program ends, the system is ready to fully comply with the AI Act and can be commercialized without regulatory friction.
6. Involve the CFO and legal team from the application phase: the sandbox has implications for the investment timeline, compliance costs and go-to-market strategy.

Official source

Consult the full regulation on the official source

Disclaimer: This article is for informational purposes only and does not constitute legal advice. For specific decisions, consult a qualified professional. Source: https://eur-lex.europa.eu/./legal-content/AUTO/?uri=OJ:L_202602487