EU publishes common rules for AI Act regulatory sandboxes

The European Commission published Commission Implementing Regulation (EU) 2026/2487 in the Official Journal of the European Union on November 11, 2026. The regulation, adopted under Article 58(1) of the AI Act (Regulation (EU) 2024/1689), lays down EU-wide detailed rules for how AI regulatory sandboxes must be set up, run and supervised, aiming to stop Member States from fragmenting sandbox rules and to give AI developers more legal certainty before market entry.

Key provisions of the new rules

• The regulation is Commission Implementing Regulation (EU) 2026/2487, adopted under Article 58(1) of the AI Act (Regulation (EU) 2024/1689)
• Entry into force is set for December 1, 2026
• Each EU Member State must have at least one operational AI regulatory sandbox by August 2, 2027
• SMEs and startups can take part free of charge, while larger companies may face cost-recovery fees
• Eligible systems include unpublished AI systems, substantially modified existing systems, or previously non-high-risk systems newly used in high-risk contexts
• Sandbox exit reports, covering issues examined, resolutions, recommended practices and incident logs, must be delivered within 45 working days

What it means for people who build with AI

For companies building coding tools, agents and other AI systems, the regulation turns Article 58 of the AI Act into a concrete compliance pathway rather than an abstract principle, since it sets out how unreleased or high-risk systems can be tested under EU supervision before launch. Participation does not grant formal compliance or conformity-assessment clearance, so normal AI Act conformity procedures still apply before market placement. Participants acting in good faith under an agreed sandbox plan receive limited protection from certain penalties, but general third-party liability is not waived.

Data rules and next steps

Inside a sandbox, reuse of personal data is limited to five defined public-interest areas, and participants must show that anonymized or synthetic data alternatives are unavailable before reusing personal data. Together with the entry-into-force date and the Member State deadline, this gives AI builders a clear timeline for when supervised testing routes open up across the EU.

Sources

• Commission Implementing Regulation (EU) 2026/2487 (EUR-Lex / Official Journal of the European Union, November 11, 2026, official)
• Commission lays down common rules for AI regulatory sandboxes (EU Law Live)
• EU rules for AI regulatory sandboxes to allow supervised development, testing (MLex)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.