AI Regulatory Sandboxes: The EU Rulebook Is Set, and You Can Apply Abroad
From 1 December 2026, every AI regulatory sandbox in the EU will run on the same rulebook. The European Commission adopted Implementing Regulation (EU) 2026/2487 on 10 November and published it in the Official Journal a day later. It decides who may apply, how fast an authority must answer, who pays, and what a company gets on the way out.
For a Bulgarian company the most useful line is easy to miss: you can apply to a sandbox in a Member State other than the one where you are established. That matters because Bulgaria is one of six countries that, according to the Commission figures reported by POLITICO on 8 November, had not yet selected a national AI Act enforcement authority, more than a year after the August 2025 deadline. Today, EU leaders are holding their first strategic discussion on AI at the informal European Council in Dublin. The sandbox rules are one of the few parts of that agenda a company can act on next quarter.
My reading is simple. The sandbox is not for everyone, and most companies should ignore it with a clear conscience. But for the narrow group that builds AI likely to fall under the high-risk rules, it has just become a realistic option, and the paperwork it asks for is the same paperwork they will need anyway.
First, check whether this is about you
A sandbox is a controlled setting where a competent authority supervises the development, training, testing and validation of an AI system for a limited time before it goes on the market or into service. That is how Article 57 of the AI Act describes it, and the new regulation keeps that frame.
Who can apply? Providers or prospective providers. Based on the regulation as summarised by Lovguiden, the application must concern one of three situations:
- an AI system not yet placed on the market or put into service;
- a system that will undergo a substantial modification;
- a system that has become high-risk because of the way it is used.
If your company buys Microsoft Copilot, ChatGPT Business or a ready-made chatbot and uses it as delivered, you are a deployer, not a provider. A sandbox gives you very little. The picture changes when you build something yourself, even on top of someone else's model, and put it into use under your own name. A tool that ranks job candidates, scores credit applications, or evaluates employees sits close to the areas listed in Annex III. After the Digital Omnibus, the Annex III high-risk duties apply from 2 December 2027, as we covered in our Omnibus calendar.
What the new rules actually promise
The regulation makes the process predictable, and that is its real contribution. The points that matter for a business decision:
An answer within three months. The authority must tell you the outcome no later than three months after a complete application, or after the deadline of a call. A rejection can be appealed under national administrative rules.
Free for SMEs, at cost for everyone else. SMEs, including start-ups, get priority access, and regulatory guidance, advice and supervision are free of charge, including supervision of real-world testing. Exceptional costs can still be charged, but they must be announced before participation starts. Larger companies can be charged the full cost, and the fee list must be published when applications open. Providers with no office in the EU pay a participation fee and must appoint an authorised representative.
Five selection criteria. Authorities assess at least the need to participate because of specific regulatory or practical challenges, the potential for regulatory learning, the contribution to public interest and Union policy, the maturity of the proposal, and how innovative the system is. "We would like legal comfort" is not one of them. You need a concrete open question.
A sandbox plan. Selected participants agree a plan with the authority: timeline, roles, which requirements are being tested, how personal data is processed, risk safeguards, the procedure for serious incidents, and any real-world testing. Where personal data is involved, the data protection authority has to be part of the supervision.
An exit report with weight across the EU. At the end, the authority issues written proof of the activities and an exit report, which you must receive within 45 working days. Neither is a declaration of conformity, and participation is not permission to launch. But market surveillance authorities and notified bodies in every Member State must recognise these documents, and under Article 57(7) they are to be taken into account positively to speed up conformity assessment.
There is also a protection that is easy to overlook. Under Article 57(12), participants remain liable for any damage caused to third parties during the experiment. However, as long as they follow the plan and act in good faith on the authority's guidance, no administrative fines are imposed for infringements of the AI Act. That is not immunity, but it is a meaningful reduction of regulatory risk during testing.
A hypothetical example
Imagine a Bulgarian recruitment firm with 180 employees. Over the winter it builds a tool on top of a commercial language model that reads CVs and proposes a shortlist for each client vacancy. It plans to use the tool for its own clients from autumn 2027.
Recruitment and candidate selection are on the Annex III list, so the firm should assume it will be treated as the provider of a high-risk system. With fewer than 250 employees it is likely to count as an SME, so guidance and supervision in a sandbox would be free. Because it does not need to wait for a Bulgarian sandbox, it can watch the list of planned and existing sandboxes that the AI Office must publish under Article 57(15) and apply where a call opens first. Denmark, for example, already runs a sandbox through its Agency for Digital Government and data protection authority, with programmes running from September to December 2026, according to Lovguiden.
The open question the firm would bring is specific: how to show that the shortlisting does not systematically disadvantage certain groups of candidates, and what level of human review is enough. That is exactly the kind of question an authority can help answer, and the answer ends up in a document that other regulators must recognise.
Before the sandboxes open
National sandboxes must be operational by 2 August 2027. That sounds far away, but an application judged on "maturity of the proposal" needs work done in advance.
Start with classification. Go through the AI you build, not the AI you buy, and mark what could fall under Annex III. If you are unsure, the AI Act readiness test is a quick first filter before you talk to a lawyer.
Then decide what stays confidential. Under the regulation, information from a sandbox project is presumed to be publishable unless it is marked confidential in the plan or by the participant before the project ends. The exit report itself is only published if both sides agree. Decide early which parts of your training data, prompts and evaluation results you need to protect, and write that into the plan rather than discovering it later.
Finally, decide who owns it. Somebody inside the company has to own the sandbox plan, the risk log and the contact with the authority. Without that person, the plan becomes a document nobody updates, and the exit report records exactly that.
What stays uncertain
The regulation fixes the rules, not the capacity. We do not yet know how many sandboxes will open before August 2027, which sectors authorities will prioritise, or how quickly a sandbox in another country will accept a Bulgarian applicant in practice. Bulgaria still has to designate its own authorities, and until it does, there is no domestic route.
For a company building high-risk AI, that is not a reason to wait. The sandbox plan asks for the same risk management, data governance and human oversight evidence that the AI Act will require from December 2027. If you prepare it now, you either enter a sandbox with a strong application or arrive at your conformity assessment with half the work done.
