The European Commission sets common rules for AI regulatory sandboxes
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
The European Commission sets out in its Implementing Regulation (EU) 2026/2487 how AI sandboxes will work in each country, where systems are tested under oversight before going on sale. Small businesses and startups go first, every project brings its own plan and tests can be suspended over serious risks. Spain already has a pilot with twelve high-risk systems and 16 guides.
The European Union now has common rules for testing AI systems under supervision before they reach the market.
The European Commission has approved Implementing Regulation (EU) 2026/2487, dated November 10, which details how member states must set up, run and oversee their AI regulatory sandboxes, the controlled testing environments provided for in the EU AI Act. Spain's AI supervisory agency, AESIA, reported it on Thursday.
Small and medium-sized businesses, startups and small mid-caps will have priority to join and can receive guidance. Every project will have to submit a testing plan with its goals, activities and measures against risks, and the authorities will be able to halt it if major risks emerge, ones that cannot be reduced enough, to safety, health or fundamental rights. At the end, a report with the results will be drawn up. Being in a sandbox does not grant permission to sell the system, nor does it guarantee that the system complies with the regulation.
Spain arrives with experience: a pilot by the Secretariat of State for Digitalization and Artificial Intelligence, together with the European Commission, supported twelve high-risk systems from Spanish companies in six sectors, including biometrics, employment and medical devices, and produced 16 practical guides, according to AESIA.
Why it matters · analysis and opinion
For a company developing a high-risk AI system, a sandbox is a way to check whether it complies with the regulator watching, before launching it. Those who join will have to work to a detailed plan and accept that tests can be stopped if something goes wrong, in exchange for guidance from the authorities. Priority for small businesses and startups aims to ensure that it is not only large firms that benefit from that support. One point to avoid confusion: getting through a sandbox is not the same as having permission to sell. Anyone already developing a system that could be high-risk has a good starting point in the guides left by the Spanish pilot.
Official source: AESIA · Written with the help of AI: how we make the news
What does it mean for your business? · analysis and opinion
This mainly affects small and medium-sized businesses, startups and small mid-cap companies developing their own AI system and planning to sell it or put it into service in the European Union, especially in areas such as employment, biometrics or medical devices, where the high-risk systems from the Spanish pilot were found. Anyone who only uses ready-made AI tools at work does not need to do anything about this regulation. For a Latin American company, what matters is whether it wants to reach the European market, in which case it is worth following these environments closely.
In practice, our advice is to start with what is cheap: check the 16 practical guides that came out of the Spanish pilot to understand what obligations the system would have, and keep an eye on the testing spaces opening at the national, regional or local level. It is worth preparing in writing now what the testing plan will require: objectives, planned activities, applicable regulatory requirements and risk-management measures. That work is useful even if the company does not end up joining a sandbox.
The main risk is confusing taking part with being approved. Having gone through a testing space does not grant permission to sell a product, nor does it guarantee that the system complies with the European AI Regulation, and authorities can suspend tests if significant risks to health, safety or fundamental rights appear. The sensible approach is to plan product timelines with that possibility in mind.
