Innovation Support and the Governance Architecture

The policy balance

Recital (138) responds to rapidly developing AI with both regulatory oversight and a safe, controlled space for experimentation. Innovation is expected to proceed with safeguards and risk mitigation.

At least one sandbox

The recital says: "Member States should ensure that their national competent authorities establish at least one AI regulatory sandbox at national level".

The sandbox supports development and testing under strict oversight before an AI system is placed on the market or otherwise put into service.

Coverage, form, and resources

A State could join an existing or joint sandbox only if national coverage is equivalent. Sandboxes could be physical, digital, or hybrid, and establishing authorities should ensure financial and human resources.

A pre-market environment

The objective is "to foster AI innovation by establishing a controlled experimentation and testing environment in the development and pre-marketing phase".

The environment aims to ensure compliance with this Regulation and other relevant Union and national law, while improving legal certainty and authorities' understanding of opportunities, risks, and impacts.

What supervision covers

Supervision should cover development, training, testing, and validation before market placement or putting into service, including whether a substantial modification may require a new conformity assessment.

The risk gate

Significant risks should trigger adequate mitigation. If mitigation fails, development and testing should be suspended. Authorities should cooperate where appropriate, including with fundamental-rights supervisors.

Real-world testing

Upon agreement between national competent authorities and sandbox participants, testing in real-world conditions may also be operated and supervised within the sandbox.

A limited data-reuse basis

Recital (140) permits the possibility to "use personal data collected for other purposes for developing certain AI systems in the public interest within the AI regulatory sandbox, only under specified conditions".

Other controller duties and data-subject rights remain applicable. The recital also says this Regulation should not provide the legal basis described in GDPR Article 22(2)(b).

Safeguards in the sandbox

Providers and prospective providers should use appropriate safeguards, follow authority guidance, cooperate, and act expeditiously and in good faith to mitigate significant safety, health, and fundamental-rights risks.

Testing in real-world conditions

For certain high-risk systems, a specific real-world testing regime may be available without sandbox participation, but it requires appropriate and sufficient guarantees and conditions.

A central safeguard is "requesting informed consent of natural persons to participate in testing in real world conditions, with the exception of law enforcement where the seeking of informed consent would prevent the AI system from being tested."

Beneficial outcomes

Member States are encouraged to support AI research and development for accessibility, reduced socio-economic inequality, and environmental targets, using sufficient resources and interdisciplinary cooperation.

Priority, not exclusivity

"Member States should provide SMEs, including start-ups, that have a registered office or a branch in the Union, with priority access to the AI regulatory sandboxes" if eligibility and selection conditions are met.

Priority does not exclude other providers or prospective providers: they may access the sandbox where they fulfil the same eligibility conditions and selection criteria.

Reducing practical burdens

The recital addresses guidance channels, standardisation participation, conformity-assessment fees, certification costs, translation costs, templates, a single information platform, and procurement best practices.

Microenterprises

The source seeks to "allow microenterprises to fulfil one of the most costly obligations, namely to establish a quality management system, in a simplified manner" without lowering protection or high-risk compliance.

The applicant

A Spanish start-up develops an accessibility tool and faces legal uncertainty while developing, training, testing, and validating it before market placement.

It should receive priority sandbox access if it meets eligibility conditions and selection criteria. Priority is not a guaranteed place, and it does not exclude other eligible applicants.

A risk appears

If testing reveals materially poorer outcomes for a regional-language group, that is a significant risk requiring adequate mitigation. If mitigation fails, the process should be suspended.

Proportionality is not exemption

A microenterprise may fulfil the quality-management system in a simplified manner, but Recital (146) preserves the protection level and the need to comply with high-risk requirements.

Testing infrastructure

The Commission should facilitate access, where possible, to testing and experimentation facilities for accredited bodies, groups, and laboratories that perform relevant conformity-assessment tasks.

The framework

The source establishes "a governance framework that both allows to coordinate and support the application of this Regulation at national level, as well as build capabilities at Union level and integrate stakeholders in the field of AI."

AI Office

Its mission is "to develop Union expertise and capabilities in the field of AI and to contribute to the implementation of Union law on AI." Member States should facilitate its tasks.

Board and advisory forum

The Board provides advice and guidance and has standing subgroups for market surveillance and notified bodies. The advisory forum brings stakeholder expertise from commercial and non-commercial interests.

Scientific panel

Independent experts should have up-to-date scientific or technical AI expertise, act impartially and objectively, and protect confidential information and data.

Member States should be able to request support from the scientific panel's expert pool for their enforcement activities. Union AI testing support structures should also be made available to Member States.

Two authority functions

"each Member State should designate at least one notifying authority and at least one market surveillance authority as national competent authorities".

One public-facing focal point

For efficiency and external coordination, "each Member State should designate a market surveillance authority to act as a single point of contact."

How authorities should act

National competent authorities should exercise powers independently, impartially, and without bias. Their members should avoid incompatible actions and should be subject to confidentiality rules.

Monitoring after deployment

Recital (155) says "all providers should have a post-market monitoring system in place." Where relevant, this includes analysing interaction with other AI systems, devices, and software.

Monitoring should not cover sensitive operational data of law-enforcement deployers. It helps address risks from systems that continue to learn after market placement or putting into service.

What counts as serious

Reportable serious incidents include death or serious health damage, serious irreversible critical-infrastructure disruption, certain fundamental-rights infringements, and serious property or environmental damage.

Enforcement ecosystem

Regulation (EU) 2019/1020 applies in its entirety. Authorities may address all AI systems presenting a risk, while fundamental-rights, equality, and data-protection bodies retain their competences and independence.