Operationalising AI Regulatory Sandboxes: Activities, Requirements, and Technical Assessment under the EU AI Act

Regulatory sandboxes require structured, multi-stage processes: The paper identifies 29 concrete activities spanning the entire sandbox lifecycle—from pre-participation guidance through application, preparation, participation, exit, and post-participation monitoring—demonstrating that effective AI oversight requires far more than simply allowing companies to test systems in a supervised environment.

Current assessment methods lack standardization and coordination: The research finds that assessment methods are "fragmented" and "tests lack standardisation," indicating that without common evaluation frameworks, different regulators may reach different conclusions about the same AI system, undermining fair and consistent oversight across the EU.

Technical testing infrastructure is essential but missing: The paper distinguishes between basic regulatory oversight and an "Extended AIRS" that includes structured technical testing through an AI Technical Sandbox (AITS), suggesting that regulators need dedicated technical capabilities and infrastructure—not just legal authority—to properly evaluate high-risk AI systems.

Weak feedback loops between developers and regulators hinder compliance: The research identifies inadequate communication channels between AI providers and Competent Authorities as a key challenge, meaning companies may struggle to understand regulatory expectations and regulators may lack insights into technical constraints, reducing the effectiveness of oversight.

Compliance pathways must be transparent and accessible to smaller companies: The framework explicitly aims to provide startups and SMEs with "a transparent pathway to compliance," addressing concerns that regulatory requirements could disadvantage smaller innovators who lack resources to navigate complex oversight processes independently.