Regulatory sandboxes provide a controlled environment for companies to test innovations while testing the bounds of regulation under the auspices of the regulator. In several jurisdictions, there are already provisions for sandboxes, which generally allow companies to apply for a waiver of regulatory obligations, often referred to as regulatory relief or mitigation, for a set period while the company tests out an innovative artificial intelligence system or feature. Often this can take the form of a company testing the impacts of an incremental change to current regulations. The coordinating regulator oversees the company and has greater access to observe whether the regulatory obligations should be modified in the future.
Regulatory sandboxes were first employed to test financial regulations in the U.K. in 2015, leading to various changes to regulations. In recent years, the idea of applying this concept to other innovative technologies has been put forth, as these technologies will likely change in coming years.
The Organisation for Economic Co-operation and Development, citing the use of regulatory sandboxes for financial technologies, recommends governments "consider using experimentation to provide a controlled environment in which AI systems can be tested and scaled up" in its AI principles, when regulatory sandboxes could provide such an environment. So far, regulatory sandboxes for AI will be administered in each EU member state, Utah, Singapore and the United Arab Emirates.
The UAE has a goal of becoming the world's AI regulatory testing ground and has had a regulatory sandbox, Regulations Lab, since January 2019 after the creation of the lab was authorized through federal legislation. The lab is a space where companies can apply for temporary licenses to test and vet innovations for innovative technologies, including AI. The lab also seeks to use this lab to anticipate and develop future legislation, learning from the outcomes of the Regulations Lab.
Under Article 57 of the EU AI Act, each member state must set up its own AI regulatory sandbox or participate in a multistate sandbox. The AI regulatory sandboxes in the EU were seen as a way to support innovation in SMEs through limited regulatory relief. During the AI regulatory sandbox period, companies would be permitted to ignore or apply a modified form of a regulation. In 2022, Spain became the first country to pilot an AI sandbox. Each EU member state is obliged to set up their own regulatory sandbox or join another member state's sandbox by 2 Aug. 2026.
Singapore has also used AI sandboxes as a method to boost innovation and gain more insights into a specific topic. In 2023, Singapore had its first sandbox specifically to gather insights into the gaps in generative AI large language model evaluations. Unlike the sandboxes in the EU or UAE, this experiment was aimed at fostering technical innovation in certain sectors rather than regulatory innovation.
It is not clear whether organizations that take part in the sandboxes have access to regulatory relief, as Singapore does not have an EU AI Act-style law regulating AI. Singapore continued to use sandboxes to test innovations in 2024 with one that supported local companies looking to incorporate generative AI in customer engagement and marketing and sales, naming specific AI providers in Singapore with which trials can be conducted.
Utah passed S.B. 149, or the Artificial Intelligence Policy Act, in 2025, leading to the first AI sandbox in the U.S. The Learning Lab allows for participants to receive regulatory mitigation, which aligns more closely with the EU sandboxes than those employed in Singapore. In the U.S., Connecticut, Oklahoma and Texas have proposed bills that would set up sandboxes in their jurisdictions. The proposed legislation includes regulatory mitigation for participation in the sandbox with the goal of supporting innovation.
Organizations that would like to participate in a regulatory sandbox, such as the Learning Lab in Utah, will need to submit a formal application. The regulator overseeing the sandbox will evaluate the economic or societal benefits of the proposed innovation while weighing potential negative implications of regulatory mitigation.
Depending on the jurisdiction, the regulator will accept applicants to a specific cohort or sprint, which groups participants into a specific thematic area, such as generative AI or HR technologies. Before being given regulatory mitigation, the participants might be required to adhere to voluntary data management and security protocols. It should be noted that for participants, they might have to concurrently comply with laws outside of the sandbox while regulatory mitigation is provided only in the specific jurisdiction the sandbox is in.
During the active or testing phase, regulators will receive greater insight into the operations of the participants. After the active phase, regulators will have collected data about the actual benefits of the proposed innovation, as well as the necessity and efficacy of the regulations which were temporarily mitigated. In past regulatory sandboxes, the results of the sandbox led regulators to change their regulations if they were seen to be hampering innovation without providing benefit to consumers.
Many legislators around the world are looking to AI sandboxes as an opportunity to work together with companies to test the utility of regulations. For example, the EU, UAE and several U.S. states have implemented or have pending legislation to implement regulatory sandboxes. Singapore has taken a different approach to gain participants in their sandbox: instead of offering regulatory mitigation, they provide grants and access to AI systems. Advice for regulators and participants in AI sandboxes is forthcoming, as more and more jurisdictions look to implement sandboxes. For example, the Datasphere Initiative has done significant work to design and develop different sandbox initiatives for AI globally. In a recent report, they summarized current and planned sandboxes for AI and data, and provided in-depth guidance on where and how regulatory sandboxes can be best utilized.
The types and configurations of sandboxes are numerous, as there does not seem to be a one-size-fits-all approach to setting up a regulatory sandbox. For companies interested in participating, regulatory sandboxes provide a unique environment to test out their ideas in a controlled, sanctioned environment.
Richard Sentinella is the AI governance research fellow at the IAPP.
