On a Formula One Grand Prix circuit, race cars blast off to more than 200 miles per hour. Europe hopes to build similar safe — and fast — racetracks for AI.
“If you want to learn how to drive fast safely, you go to a track where experts — maybe even the police — guide you,” says Professor Antonino Rotolo of the University of Bologna and coordinator of Europe’s AI sandbox strategy. “A regulatory sandbox is the same idea: a controlled environment for innovators to test new technology quickly, under the eyes of the regulators.”
Europe’s new AI Act, the world’s first major attempt to regulate the technology, aims to protect against potential dangers. It prohibits deploying AI in certain cases and imposes strict limits on other high-risk areas. For critics, the restrictions threaten to keep the continent in the AI slow lane.
Enter sandboxes. They allow participants to use personal data without explicit user consent — an exemption from Europe’s strict General Data Protection Regulation — to train their models. But they also require innovators to comply early with the AI Act, generating criticism that they are too focused on regulatory learning, rather than enabling technical breakthroughs. Instead of regulatory sandboxes, critics suggest that Europe would be better off funding innovation hubs and innovation accelerators.
The AI Act’s Article 57 in Chapter VI defines sandboxes as a “controlled environment that fosters innovation and facilitates the development, training, testing, and validation of innovative AI systems for a limited time before their being placed on the market.” Participation is voluntary. Sandboxes offer support for AI Act compliance, services ranging from a conversational walk-through of the technology to testing and auditing models.
The concept is not new. The UK’s financial regulator launched sandboxes in 2016, focused on fintech. Participating startups are exempt from onerous banking and other regulations. To date, the UK experiment has launched more than 1,000 firms, including Zilch, an ad-subsidized payments network that became a double unicorn in 2020. The UK built on this success to launch the Supercharged Sandbox in June 2025, focused on AI, in partnership with AI chipmaker NVIDIA.
Other European countries have initiated their own national sandbox strategies ahead of the AI Act. In 2020, Norway launched its AI sandbox Datatilsynet. In 2021, France took a different path, launching sector-specific sandboxes focused on health data and government service delivery.
Spain became the first country in 2024 to inaugurate an AI regulatory sandbox after the adoption of the AI Act. The Spanish program kicked off in May 2025 with workshops led by AI and legal experts. It is currently incubating 12 AI projects and offers access to the Barcelona Supercomputing Center, one of Europe’s most powerful supercomputers.
Startup Dedomena.ai secured a spot. As a company producing AI products with privacy protections, including data anonymization and synthetic data generation, it was a natural candidate. The team is now working with compliance advisors to align their models with the regulation.
“Complying with the AI Act adds some paperwork, but the sandbox provides direct access to top-tier experts and a chance to give feedback to influence future regulation,” says Germán Lahera, Dedomena’s Chief Technology Officer. The results so far? Participation in the sandbox reassures and impresses potential customers, Lahera says. It helps Dedomena refine its product roadmap to speed eventual compliance for certification with the AI Act.
The European Commission plans to standardize sandboxes through a two-year project called EUSAiR. It is also investing €220 million in four sectoral sandboxes designed to promote food, healthcare, manufacturing, and Smart Cities AI innovation.
The crucial question of whether sandboxes catch up in the AI race remains unanswered. They are not a silver bullet. Many continue to question whether they will counterbalance the constraints of the AI Act, especially as Europe’s competitors speed ahead. Only time will tell if this little-known legal, operational, and regulatory tool can propel the continent into the AI fast lane.
Melanie Girod is a French Master’s student in Public Policy at the University of California, Berkeley, with a background in accounting and finance at tech startups in San Francisco.
Bandwidth is CEPA’s online journal dedicated to advancing transatlantic cooperation on tech policy. All opinions expressed on Bandwidth are those of the author alone and may not represent those of the institutions they represent or the Center for European Policy Analysis. CEPA maintains a strict intellectual independence policy across all its projects and publications.
2025 CEPA Forum Tech & Security Conference
Explore the latest from the conference.
