Skip to main content
Audact
See the offer

Milestone · 2 August 2026

Article 57: the national sandboxes had to be running by 2 August 2026.

Required to be operational since 2 August 2026

Last reviewed: 5 October 2026

Article 57 of the EU AI Act obliges every Member State to have at least one AI regulatory sandbox established at national level and operational by 2 August 2026. A sandbox is a supervised environment in which a provider can develop, train and test an AI system under the eye of the competent authority before it goes to market. It is a route you can choose, not a duty you carry. It does not suspend liability towards the people you interact with.

What the law requires

Each Member State must ensure that its competent authorities establish at least one AI regulatory sandbox at national level, operational by 2 August 2026.
Regulation (EU) 2024/1689, Art. 57(1)
SMEs and start-ups with a registered office or a branch in the Union have priority access to the sandboxes, provided they meet the eligibility conditions.
Regulation (EU) 2024/1689, Art. 62(1)(a)
Participants remain liable under Union and national liability law for damage caused to third parties during the experimentation. Where a participant observes the agreed plan and follows the authority's guidance in good faith, no administrative fines are imposed for infringements of the Regulation.
Regulation (EU) 2024/1689, Art. 57(12)
On request, the competent authority provides written proof of the activities successfully carried out in the sandbox. It also provides an exit report detailing the activities, the results and the learning outcomes.
Regulation (EU) 2024/1689, Art. 57(7)

What Audact brings to an application

A receipt is visible in the product for governed calls: the input hash, the output hash, the link to the receipt before it, and Merkle inclusion. The first three recompute without a key; the fourth, inclusion in the Merkle root, is checked against the published root with the inclusion proof from the call's Article 50 report.
Visible in product · Merkle roots published
The Article 50 disclosure is spoken inside the call flow and recorded per interaction, which is one of the controls an authority will ask about.
In controlled testing
The policy pack for the supervising country, so the sandbox sees the rules of its own jurisdiction.
Germany: national policy layer active. Netherlands: in development. Belgium and Austria: planned.
Policy configuration and the receipt chain as a dated export you can attach to an application or an exit report.
Working today

What it is

Supervised testing, with the authority in the room.

A regulatory sandbox is a controlled environment run by the national competent authority. Within it, a provider or prospective provider develops and tests a system against an agreed plan, with the authority giving guidance as it goes. The point is not relief from the rules; it is that you find out what the authority expects while the system is still cheap to change.

Two things are worth being precise about. The sandbox does not suspend liability towards third parties. Article 57(12) says that in as many words. And the shelter it does offer is narrow: no administrative fines under this Regulation, for a participant that stays inside the agreed plan and follows the guidance in good faith.

How to get in

The route runs through your own Member State.

The duty in Article 57 is on the Member State, not on the Commission, so the application route, the intake calendar and the eligibility criteria differ per country. Start at the competent authority for your own market; the sandbox you apply to will be the one supervised by the authority that would supervise you anyway.

What travels with you when you leave is documentation. On request the authority provides written proof of what was successfully carried out, and it provides an exit report on the results. That report is the artefact a client, an insurer or a later supervisory question will be interested in. That is why the way you record what happened during the test matters more than it looks.

Note

Information, not legal advice.

This page sets out the rules as we read them, with the article numbers so you can check us. It is not legal advice, and your own position depends on facts this page cannot know. Take advice from qualified counsel before you rely on it.

Questions

Does a sandbox make my deployment exempt from the AI Act?
No. It changes the enforcement posture, not the rules. Article 57(12) keeps you liable under Union and national liability law, and the relief it offers is limited to administrative fines under the AI Act for a participant that observes the agreed plan and follows the authority's guidance in good faith.
Is the sandbox only for high-risk systems?
Article 57 addresses providers and prospective providers of AI systems; it is not written as a high-risk-only route. In practice the national programmes set their own priorities and eligibility conditions, so read the criteria of the authority you are applying to.
Does it cost anything?
That depends on the national programme. Article 62(1)(a) gives SMEs and start-ups with a registered office or a branch in the Union priority access where they meet the eligibility conditions; the fee arrangements are set per Member State.

A record, not an intention

What an authority asks for during supervised testing is what happened, per interaction. Audact records that as the calls run rather than reconstructing it afterwards.

See a receipt

Related