As Europe prepares to showcase 91 AI pilots at the upcoming EUSAiR closing event, one major question remains: where do national AI regulatory sandboxes actually stand under the EU AI Act? To find out, I examined publicly available records and national authority data across Europe. Here is what the landscape looks like today.
Which European countries have operational AI sandboxes?
Since the adoption of the EU AI Act, which requires every EU Member State to establish at least one AI regulatory sandbox, such initiatives have been expanding across the EU and the wider European Economic Area (EEA). But how far have these initiatives progressed, and what can we learn from what has been made public so far? Here is a snapshot of the landscape as of October 2026.
The findings offer a snapshot of an evolving landscape. By the date of analysis, publicly available information pointed to completed AI Act’s sandbox pilots in Denmark, Germany, the Netherlands and Spain. Estonia, Latvia and Lithuania had launched pilots, while Sweden, Liechtenstein and Norway had publicly announced sandbox coordinators, but the reviewed information confirmed no sandbox pilots.
Table 1 summarises the findings across all 27 EU Member States and the three non-EU EEA countries. The four categories reflect the stage of development based on public available information at the time of the research.
Table 1. Publicly documented state of play of AI Act regulatory sandboxes in the EU and EEA (October 2026)
| Status identified in public sources | Countries | Number |
| Pilot completed | Denmark, Germany, Netherlands, Spain | 4 |
| Pilot launched | Estonia, Latvia, Lithuania | 3 |
| No sandbox pilot publicly announced yet; sandbox coordinator(s) appointed | Sweden, Liechtenstein (EEA), Norway (EEA) | 3 |
| No sandbox pilot or sandbox coordinator publicly announced | Austria, Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Finland, France, Greece, Hungary, Ireland, Italy, Luxembourg, Malta, Poland, Portugal, Romania, Slovakia, Slovenia, Iceland (EEA) | 20 |
| Total | 27 EU Member States + 3 non-EU EEA countries | 30 |
Note: Data compiled from official public sources as of October 2026.
Note: The lack of public announcement of a sandbox coordinator or a sandbox pilot does not mean that these have not been appointed/established. Rather, it indicates that official public websites do not provide clear information on either as of October 2026. Data compiled by Thiago Moraes.
These figures should not be interpreted as a ranking of national maturity or preparedness. They do not establish which countries are more advanced, nor do they provide a comprehensive account of everything happening behind the scenes. They simply show what could be identified in public sources at the time of the research. Moreover, a completed pilot does not necessarily mean that a permanent AI Act sandbox is fully operational.
It is also important to note that, although the Member States in the largest group have not publicly confirmed the designation of their AI Act regulatory sandbox coordinator(s), the Market Surveillance Authorities appointed as Single Points of Contact (SPoCs) under the AI Act are likely to assume this role. The European Commission keeps an updated list of designated SPoCs. At the time of writing, only six Member States — Austria, Belgium, Bulgaria, Croatia, Hungary and Slovakia — had not formally appointed their SPoCs. Iceland, as a non-EU EEA country, is not required to designate one.
Key insights: pre-existing experience and emerging governance models
The absence of publicly documented developments does not necessarily mean an absence of relevant experience. France, Luxembourg, Malta, Poland, Portugal and Sweden, for example, had already experimented with regulatory sandboxes before the AI Act, with many testing activities involving AI systems under sector-specific or data protection legal frameworks. These initiatives may provide useful foundations for future AI sandboxes, although the extent to which their practices will transfer is still an open question.
Examples of pre-existing sandbox initiatives include the French Data Protection Authority’s CNIL Sandbox, Luxembourg’s Sandkëscht regulatory sandbox, Malta’s Technology Sandbox, Portugal’s Zonas Livres Tecnológicas and Sweden’s Innovation Sandbox.
The landscape also reveals different approaches to governance. The Netherlands, for example, has opted for a collaborative model involving its Data Protection Authority and the Authority for Digital Infrastructure. Norway has also chosen joint coordination between the Norwegian Digitalization Agency (Digdir), Data Protection Authority (Datatilsynet) and Communications Authority (Nkom).
Meanwhile, Latvia has entrusted the establishment of its AI Act sandbox to the National AI Center, a private non-profit organisation. Such differences illustrate how sandbox models can reflect national institutional contexts rather than follow a single European arrangement.
Distinguishing national AI Act sandboxes from EUSAiR pilots
It is equally important to distinguish these national developments from EUSAiR’s 91 pilots. EUSAiR has supported sandbox initiatives across all 27 EU Member States, providing a broader opportunity to experiment and learn across different national settings.
These pilots are not interchangeable with the establishment of permanent national AI Act sandboxes. Rather, they offer a complementary source of practical experience. The upcoming closing event will be an opportunity to learn how the pilots can contribute to the wider European landscape.
At the end of the day, the question is not simply how many sandboxes have been announced or launched. It is also how authorities can learn from one another, share practical knowledge and develop approaches that work across different regulatory and institutional contexts. Making these experiences visible is an important step towards that goal.
Building a shared knowledge base for sandboxes
The Datasphere Initiative is actively engaged in developing several tools and platforms for sharing knowledge and improving the design and implementation of sandboxes in the EU and beyond.
To monitor the development of sandboxes, it is preparing to launch its Sandbox Explorer, an open-access database designed to make sandbox initiatives more visible and accessible. Sandbox coordinators and relevant authorities are invited to share any publicly available information about their initiatives so these can be included in the database.
The Datasphere Initiative also welcomes dialogue with authorities looking to benchmark existing initiatives or design new sandbox models. Its Sandbox Assessment Framework offers a practical resource to support this work.
Through the Global Sandbox Forum (GSF), the Initiative further connects authorities and other stakeholders to exchange experiences across jurisdictions. The next GSF Summit is planned for February 2027, with further details to be announced soon.
