✓ Low compliance impact for SMEs
WHAT THE ARTICLE IS ABOUT
The operational rulebook for AI regulatory sandboxes
Article 58 provides the detailed framework for how AI regulatory sandboxes function in practice. Where Article 57 established the obligation to create sandboxes and set their purpose, Article 58 defines the selection process, the sandbox plan requirements, the supervisory arrangements, and the protections available to participants during their sandbox period.
WHAT IT SAYS
Selection criteria, sandbox plans, supervisory oversight, and liability protection
- National competent authorities must establish clear and transparent criteria for selecting sandbox participants — selection must be based on objective criteria with priority for SMEs and startups
- Sandbox participation is based on a sandbox plan agreed between the participant and the authority — setting out objectives, duration, monitoring arrangements, and milestones
- Participants must provide accurate information and cooperate fully with the supervisory authority during the sandbox period
- During the sandbox, participating providers are not subject to penalties for non-compliance with the Act’s requirements as long as they follow the sandbox plan in good faith — this is the regulatory safe harbour
- The duration of sandbox participation is limited — typically up to twelve months, renewable once for an equal period
- At the end of the sandbox, participants receive a report from the authority summarising the results and, where applicable, guidance on compliance for market placement
- Personal data processed during the sandbox is subject to specific rules under Article 59
WHO IS AFFECTED
Sandbox participants and the national authorities managing them
- Companies accepted into national AI regulatory sandboxes — primarily SMEs and startups
- National competent authorities managing sandbox programmes
- Prospective providers evaluating whether to apply for sandbox participation
- The Commission which may adopt implementing acts on sandbox functioning for consistency across member states
WHAT IT MEANS FOR SMES
The sandbox safe harbour is real — use it if you qualify
- The penalty safe harbour is Article 58’s most practically significant provision for SMEs — if you participate in good faith and follow the sandbox plan, you cannot be fined for non-compliance with the AI Act during the sandbox period
- This removes the regulatory risk of testing and iterating on your AI system before you have achieved full compliance — exactly the flexibility that small innovators need
- The twelve-month duration with one renewal gives you up to two years of supervised development time — plan your sandbox period to coincide with your most intensive development and testing phase
- The end-of-sandbox guidance from the authority is valuable: it gives you a regulator’s assessment of your compliance position before you launch, reducing market entry risk
- Apply early — sandbox places are limited and demand from SMEs and startups will be high as the Act’s requirements begin to apply
Related Articles
- Article 57 — AI regulatory sandboxes (the parent article establishing the sandbox obligation)
- Article 59 — Personal data in sandboxes (the data processing rules that apply within sandboxes)
- Article 62 — SME measures (the broader innovation support framework for small businesses)
- Article 74 — Market surveillance (the authorities who also manage sandboxes in many member states)
