Skip to main content
Audact
See the offer

Article 57 sandboxes

AI regulatory sandboxes: a supervised conversation that ends in a written report.

Member States had to have one operational by 2 August 2026

Last reviewed: 5 October 2026

Article 57 requires every Member State to run at least one AI regulatory sandbox: a controlled environment where a system can be developed, trained, tested and validated under the eye of the competent authority before it goes on the market. What a participant walks out with is a written exit report describing the activities and the results, which market surveillance authorities and notified bodies may take into account. That is a supervisory dialogue with a paper trail, not an approval.

What the law requires

Each Member State must ensure at least one AI regulatory sandbox is established at national level and operational by 2 August 2026; it may be set up jointly with other Member States.
Regulation (EU) 2024/1689, Art. 57(1)
The sandbox provides a controlled environment for development, training, testing and validation before a system is placed on the market or put into service, under the supervision of the competent authority.
Regulation (EU) 2024/1689, Art. 57(5)
Competent authorities provide guidance and supervision inside the sandbox, and on exit issue a written exit report on the activities carried out and their results.
Regulation (EU) 2024/1689, Art. 57(7)
That exit report may be taken into account by market surveillance authorities and notified bodies to speed up conformity assessment.
Regulation (EU) 2024/1689, Art. 57(7)
The sandbox does not affect the supervisory or corrective powers of the competent authorities supervising it, including at regional or local level.
Regulation (EU) 2024/1689, Art. 57(11)
Participants remain liable under applicable Union and national liability law for damage inflicted on third parties as a result of the experimentation in the sandbox.
Regulation (EU) 2024/1689, Art. 57(12)
SMEs, including start-ups, have access free of charge, without prejudice to exceptional costs the authorities may recover.
Regulation (EU) 2024/1689, Art. 58(2)(d)

What Audact brings to that conversation

Architecture documentation that a supervisor can actually read: where the boundary sits, what a receipt contains, how the policy engine reaches a verdict. Shareable under an appropriate confidentiality arrangement.
Available today
Redacted extracts are derived objects: the bytes differ from the record they came from, so the hash checks that run on an original receipt do not run on the extract. They are supplied with a note saying which record they came from and what was removed.
In development
Working sessions for competent authorities to run a scenario end to end and check the claims against what the system does.
On request
Applying to the relevant sandboxes when intake opens.
Planned

What it produces

An exit report is a description, and that is its value.

The output of a sandbox is defined in Article 57(7): a written report on the activities carried out and the results. It describes what was tested and what happened. Market surveillance authorities and notified bodies may take it into account, which is why it shortens a conformity assessment rather than replacing one.

Two further paragraphs settle the other half, and they are not one paragraph. Article 57(11) leaves the supervisory and corrective powers of the authorities supervising the sandbox untouched, including at regional or local level. Article 57(12) keeps the participant liable under Union and national liability law for damage inflicted on third parties by the experimentation. Read alongside 57(7), they describe something genuinely useful and precisely bounded: a documented conversation with the authority that will later inspect your customers' deployments.

Why it matters

Grey areas get answered by the party that will later ask the questions.

The value of a sandbox is not the badge that does not exist. It is access: a direct line for the questions that have no published answer yet, and an authority that has seen the architecture before it sees it in a complaint.

For an evidence-chain product that matters more than for most, because the hard questions are architectural rather than procedural: what a third party can recompute, what needs a key, what a receipt actually establishes. Those are better settled in a supervised room than in an enforcement letter.

Note

Information, not legal advice.

This page sets out the rules as we read them, with the article numbers so you can check us. It is not legal advice, and your own position depends on facts this page cannot know. Take advice from qualified counsel before you rely on it.

Questions

What is an AI regulatory sandbox?
A controlled environment established by a national competent authority under Article 57, in which an AI system can be developed, trained, tested and validated before it is placed on the market, with guidance and supervision from that authority.
Does taking part mean the system is approved?
No. What a participant receives is a written exit report on the activities and their results, which market surveillance authorities and notified bodies may take into account. Article 57(11) leaves the authority's supervisory and corrective powers intact, and Article 57(12) keeps the participant liable under Union and national liability law.
What does it cost?
Article 58(2)(d) gives SMEs, including start-ups, access free of charge, without prejudice to exceptional costs that authorities may recover.
How can a competent authority reach the Audact policy team?
Through the contact page. We share architecture documentation, evidence-chain detail and, on request, redacted extracts (derived objects, see above) under an appropriate confidentiality arrangement.

The architecture a supervisor would want to see

Proof sets out what a receipt contains, which fields a third party can recompute, and which one needs Audact's key. It is the same material we bring to a supervisory conversation.

See a receipt

Related