EU AI Act Regulatory Sandboxes: What They Are and How SMEs Get In
EU AI Act regulatory sandboxes (Articles 57–59): each member state runs one by 2 August 2026, with priority, free access for SMEs and start-ups.
A regulatory sandbox under the EU AI Act, Regulation (EU) 2024/1689, is a controlled framework set up by a national authority where you can develop, train, test and validate an AI system under regulatory supervision before it goes to market. For a small company facing the high-risk regime, it is one of the most concrete forms of help in the Act — and it is deliberately tilted toward SMEs and start-ups.
The obligation on member states (Article 57)
Article 57(1) requires each member state to establish at least one AI regulatory sandbox at national level, operational by 2 August 2026. The sandbox provides a supervised environment to test innovative AI against the Act's requirements, with guidance from the competent authority and a measure of regulatory certainty about how the rules apply to your system.
Importantly, the sandbox does not suspend the law: participation does not grant immunity from the Act, but authorities exercise their powers proportionately and supportively, and good-faith participants who follow the agreed plan are not fined for breaches identified and corrected within it.
Priority and free access for SMEs (Article 58)
This is the part that matters for the ICP. The detailed sandbox arrangements under Article 58 require that SMEs and start-ups have priority access to the sandbox where they meet the eligibility conditions, and that access is free of charge for them (without prejudice to exceptional, proportionate costs). The aim is explicit: lower the barrier for smaller innovators who cannot absorb large compliance-testing costs.
Real-world testing (Article 60)
Article 60 goes further, allowing testing of high-risk AI systems in real-world conditions outside a sandbox, under conditions and safeguards — including a defined testing plan, informed consent of participants where relevant, and oversight. It is a route to validate a system in the field before full conformity, again with supervision rather than after-the-fact enforcement.
The wider SME support package
Sandboxes sit within a set of proportionality measures worth knowing as a small company:
- Proportionate conformity-assessment fees for SMEs under Article 62 (distinct from the free sandbox access).
- A simplified technical-documentation form for SMEs under Article 11(3).
- The SME fine cap under Article 99(6) — the lower of the percentage or the fixed amount.
Together these are the Act's acknowledgement that a 20-person company cannot carry the same overhead as a multinational.
Worked example: a 15-person health-AI start-up
Pulse Diagnostics OÜ, a 15-person start-up building a triage-support tool, expects a high-risk classification and cannot afford a full external validation. It applies to its national sandbox, qualifies for priority and free access as an SME under Article 58, and uses the supervised environment to test its risk-management and data-governance approach against Articles 9 and 10 with the authority's guidance — and to run a defined real-world test under Article 60. By the time it reaches conformity assessment under Article 43, the hardest questions have already been worked through with the regulator, not discovered at launch.
How Confir helps
Confir maps where your systems sit against the Act and which obligations a sandbox would help you de-risk — Article 9 risk management, Article 10 data governance, the Article 11 / Annex IV documentation — so you arrive at a sandbox or a real-world test with the structured record an authority expects, not a blank page. The engine is deterministic and rule-based, and it surfaces the SME supports (Articles 58, 62, 11(3), 99(6)) that apply to you.
Frequently asked questions
What is an EU AI Act regulatory sandbox?
It is a controlled framework run by a national authority, under Articles 57–59, where you can develop, test and validate an AI system under regulatory supervision before market entry. It offers guidance on how the Act applies to your system and a degree of legal certainty, without suspending the law itself.
When must regulatory sandboxes be available?
Article 57(1) requires each member state to establish at least one national AI regulatory sandbox operational by 2 August 2026.
Do SMEs get special access to sandboxes?
Yes. Under Article 58, SMEs and start-ups that meet the eligibility conditions have priority access and access is free of charge, apart from exceptional and proportionate costs. The design intent is to lower the barrier for smaller innovators.
Does joining a sandbox exempt me from the EU AI Act?
No. A sandbox does not suspend the Act or grant immunity. Authorities supervise proportionately, and good-faith participants who follow the agreed plan are generally not fined for breaches identified and corrected within the sandbox, but the underlying obligations still apply.
What other SME supports does the Act provide?
Proportionate conformity-assessment fees under Article 62, a simplified technical-documentation form under Article 11(3), and the fine cap under Article 99(6) — which sets an SME or start-up fine at the lower of the percentage or the fixed amount. Real-world testing under Article 60 is also available with safeguards.
Related guides
- The SME relief in the AI Act
- EU AI Act compliance software for SMEs
- Conformity assessment, defined
- Is the EU AI Act delayed?
- EU AI Act for startups
Manage your EU AI Act compliance in one place
Confir automates risk classification, technical documentation, and audit trails for any company. No consultants. No 6-month projects. 14-day free trial.
Start free trial →