What happened
On 11 November 2026 the European Commission published Commission Implementing Regulation (EU) 2026/2487 in the Official Journal (adopted 10 November 2026), laying down detailed common rules for the establishment, development, implementation, operation and supervision of AI regulatory sandboxes under Article 58(1) of the AI Act (Regulation (EU) 2024/1689). It applies from 1 December 2026 and standardises eligibility criteria, selection/application templates, admission timelines (decision within 3 months of a complete application, right of appeal), sandbox-plan safeguards and real-world testing conditions, exit reports within 45 working days, and cross-border recognition of sandbox exit reports and written proof by market surveillance authorities and notified bodies. SMEs and start-ups get priority access and free regulatory guidance/support; costs can only be charged where disclosed in advance.
Why it matters
This is the operational rulebook for the AI Act's sandbox mechanism — the primary venue for testing high-risk and general-purpose AI systems in real-world conditions with a regulator before market placement. It creates a single EU-wide application pathway (a firm may apply in any Member State, not just its own) and makes a sandbox exit report portable for later conformity assessment. It also confirms entering a sandbox is not market approval and creates no presumption of conformity, so participants remain fully subject to the AI Act's obligations.
Action needed
AI providers/deployers, especially SMEs and start-ups, should identify the national sandbox arrangements being stood up in their Member State and the AI Act questions (e.g. high-risk classification, GPAI obligations, GDPR/AI Act interplay) they want to resolve through a sandbox, given applications will open over the coming months and each Member State must have one live by 2 August 2027.